Bug 1831008

Summary: Manual procedure "Recovering from expired control plane certificates" results in "Unable to connect to the server: x509: certificate signed by unknown authority"
Product: OpenShift Container Platform Reporter: Martin André <m.andre>
Component: InstallerAssignee: Martin André <m.andre>
Installer sub component: OpenShift on OpenStack QA Contact: David Sanz <dsanzmor>
Status: CLOSED ERRATA Docs Contact:
Severity: medium    
Priority: high CC: dsanzmor, m.andre, pprinett, rheinzma
Version: 4.3.z   
Target Milestone: ---   
Target Release: 4.4.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Cause: The "Recovering from expired control plane certificates" procedure stands up a recovery API server on port 7443, conflicting with the port the haproxy process is listening on, on BM, OpenStack, oVirt and vSphere platforms. Consequence: The procedure results in "Unable to connect to the server: x509: certificate signed by unknown authority" Fix: Move the haproxy port to 9443 instead. Result: The recovery API server is able to bind port 7443 allowing to proceed with the "Recovering from expired control plane certificates" procedure.
Story Points: ---
Clone Of: 1821720 Environment:
Last Closed: 2020-06-17 22:26:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1821720    
Bug Blocks: 1843488    

Comment 5 David Sanz 2020-06-08 10:21:38 UTC
Verified on 4.4.0-0.nightly-2020-06-08-032819

Comment 7 errata-xmlrpc 2020-06-17 22:26:05 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2445