Bug 2097558

Summary:	Renew ovirt-provider-ovn.cer certificates during engine-setup
Product:	Red Hat Enterprise Virtualization Manager	Reporter:	Marcus West <mwest>
Component:	ovirt-engine	Assignee:	Milan Zamazal <mzamazal>
Status:	CLOSED ERRATA	QA Contact:	msheena
Severity:	high	Docs Contact:
Priority:	high
Version:	4.5.0	CC:	alolivei, didi, emarcus, eraviv, lveyde, mburman, mperina, stirabos
Target Milestone:	ovirt-4.5.2
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ovirt-engine-4.5.2.1	Doc Type:	Bug Fix
Doc Text:	Previously, running engine-setup did not always renew OVN certificates when they were close to expiration or expired. With this release, OVN certificates are always renewed by engine-setup when needed.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-09-08 11:28:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	Network	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Marcus West 2022-06-16 00:58:32 UTC

Description of problem:

ovirt-provider-ovn.cer certificates don't get renewed during engine-setup

Version-Release number of selected component (if applicable):

ovirt-engine-4.5.0.7-0.9.el8ev.noarch

How reproducible:

Always

Steps to Reproduce:

1. Run `engine-setup` when certificates are close to expiring

Actual results:

All certs get renewed, except for ovirt-provider-ovn.cer, ovn-ndb.cer, and ovn-sdb.cer

This prevents ovsdb-server from functioning properly, and spams the logs with failed connection / ssl errors.

Expected results:

Certificates to get renewed when `engine-setup` is run

Additional info:

Warning when certificates are approaching (or reached) expiry date - i'll raise a separate BZ for that.

Comment 6 msheena 2022-08-17 14:56:33 UTC

Verified on
===========
ovirt-engine-4.5.2.3-0.1.el8ev.noarch
ovirt-engine-setup-4.5.2.3-0.1.el8ev.noarch

Comment 8 Yedidyah Bar David 2022-09-05 08:21:49 UTC

I think "always" is too-strong here. They are always _handled_, in that we prompt the user asking what to do, like with other certs. Users that reply 'No', would be asked again on the next run of engine-setup. Current doc text sounds as we do not prompt and always renew.

Comment 11 errata-xmlrpc 2022-09-08 11:28:53 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: RHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:6393