The certificate tooling that was provided by https://bugzilla.redhat.com/1275648 has some key design issues that need to be addressed. Key area's of focus are: 1: Making the script more modular, so that "section" of the tooling can be run on just the parts you need, one piece at a time. 2: Checks for "facts" need to be limited, so that one role that requires the collects facts can skip this step if facts were collected by another role (that was already run and has the information).
*** Bug 1419141 has been marked as a duplicate of this bug. ***
Certificate redeploy improvements have merged.
Verify this bug with openshift-ansible-3.5.32-1.git.0.42cf266.el7.noarch.rpm The new cert redeploy playbooks mainly have one playbook for redeploying OpenShift CA certificate and one playbook for redeploying OpenShift Certificates including etcd, master, node, router and registry. The latter one could be run against individual component separately. *OpenShift CA #ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-openshift-ca.yml This playbook would generate a new CA certificate and distributing an updated bundle to all components including client kubeconfigs and node CA trust. *OpenShift Certificates #ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-certificates.yml This playbook would redeploys etcd, master, node, router and registry certificates. This playbook does not redeploy the OpenShift CA certificate and uses the current CA certificate to sign new certificates. *Etcd Certificates #ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-etcd-certificates.yml This playbook only redeploys etcd certificates including master client certificates for etcd. *Master Certificates #ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-master-certificates.yml This playbook only redeploys master certificates. *Node Certificates #ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-node-certificates.yml This playbook only redeploys node certificates. *Registry and Router Certificates #ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-registry-certificates.yml #ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-router-certificates.yml These playbooks replace installer created certificates for the router and registry. All playbooks have been verified for various ocp-3.5 clusters including ha master/non-ha master, ha etcd/embedded etcd, containerized/rpm env. The playbooks are working as expected and the env is working well after each playbook executing.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:0903