Bug 1397958 - [RFE] Improve certificate management tooling
Summary: [RFE] Improve certificate management tooling
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 3.0.0
Hardware: Unspecified
OS: Unspecified
high
urgent
Target Milestone: ---
: ---
Assignee: Andrew Butcher
QA Contact: Gaoyun Pei
URL:
Whiteboard:
: 1419141 (view as bug list)
Depends On: 1275176 1420666 1420667 1421037 1423430 1427067
Blocks: 1267746
TreeView+ depends on / blocked
 
Reported: 2016-11-23 16:31 UTC by Eric Rich
Modified: 2019-09-12 10:03 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
The certificate re-deploy playbooks have been updated to ensure all internal certificates have been updated and when possible the update is done in a rolling manner preventing downtime. Please see https://docs.openshift.com/container-platform/3.5/install_config/redeploying_certificates.html for the latest information on updating certificates.
Clone Of: 1275176
Environment:
Last Closed: 2017-04-12 18:48:31 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 1605473 0 None None None 2017-02-07 12:08:58 UTC
Red Hat Product Errata RHBA-2017:0903 0 normal SHIPPED_LIVE OpenShift Container Platform atomic-openshift-utils bug fix and enhancement 2017-04-12 22:45:42 UTC

Description Eric Rich 2016-11-23 16:31:32 UTC
The certificate tooling that was provided by https://bugzilla.redhat.com/1275648 has some key design issues that need to be addressed. 

Key area's of focus are: 

1: Making the script more modular, so that "section" of the tooling can be run on just the parts you need, one piece at a time. 
2: Checks for "facts" need to be limited, so that one role that requires the collects facts can skip this step if facts were collected by another role (that was already run and has the information).

Comment 4 Dan McPherson 2017-02-03 18:21:45 UTC
*** Bug 1419141 has been marked as a duplicate of this bug. ***

Comment 5 Scott Dodson 2017-02-07 18:02:28 UTC
Certificate redeploy improvements have merged.

Comment 7 Gaoyun Pei 2017-03-14 10:32:29 UTC
Verify this bug with openshift-ansible-3.5.32-1.git.0.42cf266.el7.noarch.rpm

The new cert redeploy playbooks mainly have one playbook for redeploying OpenShift CA certificate and one playbook for redeploying OpenShift Certificates including etcd, master, node, router and registry.
The latter one could be run against individual component separately.


*OpenShift CA

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-openshift-ca.yml

This playbook would generate a new CA certificate and distributing an updated bundle to all components including client kubeconfigs and node CA trust.


*OpenShift Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-certificates.yml

This playbook would redeploys etcd, master, node, router and registry certificates. This playbook does not redeploy the OpenShift CA certificate and uses the current CA certificate to sign new certificates.


*Etcd Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-etcd-certificates.yml

This playbook only redeploys etcd certificates including master client certificates for etcd.


*Master Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-master-certificates.yml

This playbook only redeploys master certificates.


*Node Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-node-certificates.yml

This playbook only redeploys node certificates.


*Registry and Router Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-registry-certificates.yml
#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-router-certificates.yml

These playbooks replace installer created certificates for the router and registry.


All playbooks have been verified for various ocp-3.5 clusters including ha master/non-ha master, ha etcd/embedded etcd, containerized/rpm env. The playbooks are working as expected and the env is working well after each playbook executing.

Comment 9 errata-xmlrpc 2017-04-12 18:48:31 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0903


Note You need to log in before you can comment on or make changes to this bug.