Bug 1920567

Summary:	[release-3.11] - ca-bundle.crt(/etc/origin/master/ca-bundle.crt) is missing on the fresh installation process
Product:	OpenShift Container Platform	Reporter:	Gabriel Stein <gferrazs>
Component:	Installer	Assignee:	Russell Teague <rteague>
Installer sub component:	openshift-ansible	QA Contact:	Gaoyun Pei <gpei>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	high
Priority:	medium	CC:	andbartl, bparry, ddo, mstaeble, musman, rteague, vwalek
Version:	3.11.0
Target Milestone:	---
Target Release:	3.11.z
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Cause: openshift_named_certificates role checks the contents of ca-bundle.crt during install Consequence: This check fails on a fresh install because the ca-bundle.crt file has not yet been created. Fix: Skip the ca-bundle.crt check if the file does not exist. Result: Install succeeds on fresh install.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-03-03 12:27:45 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 2 Andy Bartlett 2021-01-27 14:35:33 UTC

Hi Russell,
 This appears to be a duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=1920902, and on that one there is a suggested patch to fix this.

Regards,

Andy

Comment 6 Russell Teague 2021-01-27 20:53:23 UTC

*** Bug 1920902 has been marked as a duplicate of this bug. ***

Comment 8 Vladislav Walek 2021-01-29 17:53:03 UTC

PR: https://github.com/openshift/openshift-ansible/pull/12294

Comment 9 Russell Teague 2021-02-01 21:38:29 UTC

Working to get the proposed PR merged.

Comment 11 Gaoyun Pei 2021-02-07 09:15:49 UTC

Could reproduce this issue with openshift-ansible-3.11.374-1.git.0.92f5956.el7.noarch.rpm.

The installation failed as below:

TASK [openshift_named_certificates : Copy the ca-bundle.crt to temp directory] ***
Sunday 07 February 2021  14:48:47 +0800 (0:00:00.460)       0:06:21.454 ******* 
fatal: [ci-vm-10-0-151-194.hosted.upshift.rdu2.redhat.com]: FAILED! => {"changed": false, "msg": "Source /etc/origin/master/ca-bundle.crt not found"}



Verify this issue with openshift-ansible-3.11.383-1.git.0.ea6dd17.el7.noarch.rpm. 

With 
openshift_master_named_certificates=[{"certfile": "/files/ca/12817_named.crt", "keyfile": "/files/ca/12817_named.key","cafile": "/files/ca/12817_named_ca.pem"}]
set in ansible inventory file, installation passed without error.

Check the cluster, named certificates are configured as expected.

[root@gpei-bz1920567mrre-1 master]# ls named_certificates/
12817_named_ca.pem  12817_named.crt  12817_named.key  docker-registry.pem

[root@gpei-bz1920567mrre-1 master]# cat master-config.yaml 
...
  namedCertificates:
  - certFile: /etc/origin/master/named_certificates/12817_named.crt
    keyFile: /etc/origin/master/named_certificates/12817_named.key
    names:
    - internal-named.example.com
    - master.example.com

The content of the specified ca file "12817_named_ca.pem" was added into ca-bundle.crt.

Comment 16 errata-xmlrpc 2021-03-03 12:27:45 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Container Platform 3.11.394 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:0637