Bug 1906542
| Summary: | RHACM 2.1.0 Custom CA/Cert not working with observability component | ||
|---|---|---|---|
| Product: | Red Hat Advanced Cluster Management for Kubernetes | Reporter: | Benjamin Schmaus <bschmaus> |
| Component: | Core Services / Observability | Assignee: | Chunlin Yang <chuyang> |
| Status: | CLOSED ERRATA | QA Contact: | Xiang Yin <xiyin> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rhacm-2.1 | CC: | acervesa, cdawson, cmarango, cqu, ecai, gekis, gghezzo, hgeaydem, nmanos, sberens |
| Target Milestone: | --- | Flags: | cqu:
qe_test_coverage+
gghezzo: rhacm-2.1.z+ |
| Target Release: | rhacm-2.1.3 | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | rhacm-2.1.3 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-02-17 18:19:07 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Benjamin Schmaus
2020-12-10 18:31:36 UTC
Thanks @bschmaus for trying the observability feature in ACM 2.1. We are working on fixing this issue ASAP.
Here are steps to workaround this issue:
1. Pause the multiclusterobservability operator
```
oc edit mco observability
```
to add `mco-pause: "true"`. it looks like:
```
apiVersion: observability.open-cluster-management.io/v1beta1
kind: MultiClusterObservability
metadata:
annotations:
mco-pause: "true"
```
2. Modify manifestwork `endpoint-observability-work` in managed cluster namespace. for example: local-cluster.
a. save `kubeconfig` to modify
`oc get manifestwork -n local-cluster -oyaml endpoint-observability-work | grep kubeconfig: | awk '{print $2}' | base64 -d > kubeconfig`
b. update `certificate-authority-data` with the customized one. the value is `cat ca-bundle.crt | base64 -w0 ; echo` as mentioned in https://two-oes.medium.com/openshift-4-custom-certificate-for-the-cluster-api-bf2565f60bb9
c. replace the value of `kubeconfig:` in `endpoint-observability-work` with `cat kubeconfig | base64 -w0; echo`
3. `oc delete secret hub-kube-config -n open-cluster-management-addon-observability` and wait for new hub-kube-config secret created.
Then restart `endpoint-observability-operator`.
Let me know if it works in your environment or not. Thank you !
We have applied the workaround ad is working with multiple managed clusters. Take into consideration that is easier to start with the local-cluster only( no managed clusters already add ) and repeat all the steps for every managed cluster add from the hub, we suggest in our experience to add and patch one-by-one. regards Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: Red Hat Advanced Cluster Management 2.1.3 security and bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:0607 |