Bug 1397958 – [RFE] Improve certificate management tooling

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1397958 - [RFE] Improve certificate management tooling

Summary:	[RFE] Improve certificate management tooling

Status:	CLOSED ERRATA

Aliases:	None

Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Installer (Show other bugs)
Sub Component:
Version:	3.0.0
Hardware:	Unspecified Unspecified

Priority	high Severity urgent
Target Milestone:	---
Target Release:	---
Assigned To:	Andrew Butcher
QA Contact:	Gaoyun Pei
Docs Contact:

URL:
Whiteboard:
Keywords:	Performance

Duplicates:	1419141 (view as bug list)
Depends On:	1275176 1420666 1420667 1421037 1423430 1427067
Blocks:	1267746
	Show dependency tree / graph

Reported:	2016-11-23 11:31 EST by Eric Rich
Modified:	2017-07-24 10 EDT (History)
CC List:	13 users (show)

See Also:
Fixed In Version:
Doc Type:	Enhancement
Doc Text:	The certificate re-deploy playbooks have been updated to ensure all internal certificates have been updated and when possible the update is done in a rolling manner preventing downtime. Please see https://docs.openshift.com/container-platform/3.5/install_config/redeploying_certificates.html for the latest information on updating certificates.
Story Points:	---
Clone Of:	1275176
Environment:
Last Closed:	2017-04-12 14:48:31 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Knowledge Base (Solution)	1605473	None	None	None	2017-02-07 07:08 EST
Red Hat Product Errata	RHBA-2017:0903	normal	SHIPPED_LIVE	OpenShift Container Platform atomic-openshift-utils bug fix and enhancement	2017-04-12 18:45:42 EDT

Groups: None (edit)

Description Eric Rich 2016-11-23 11:31:32 EST

The certificate tooling that was provided by https://bugzilla.redhat.com/1275648 has some key design issues that need to be addressed. 

Key area's of focus are: 

1: Making the script more modular, so that "section" of the tooling can be run on just the parts you need, one piece at a time. 
2: Checks for "facts" need to be limited, so that one role that requires the collects facts can skip this step if facts were collected by another role (that was already run and has the information).

Comment 4 Dan McPherson 2017-02-03 13:21:45 EST

*** Bug 1419141 has been marked as a duplicate of this bug. ***

Comment 5 Scott Dodson 2017-02-07 13:02:28 EST

Certificate redeploy improvements have merged.

Comment 7 Gaoyun Pei 2017-03-14 06:32:29 EDT

Verify this bug with openshift-ansible-3.5.32-1.git.0.42cf266.el7.noarch.rpm

The new cert redeploy playbooks mainly have one playbook for redeploying OpenShift CA certificate and one playbook for redeploying OpenShift Certificates including etcd, master, node, router and registry.
The latter one could be run against individual component separately.


*OpenShift CA

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-openshift-ca.yml

This playbook would generate a new CA certificate and distributing an updated bundle to all components including client kubeconfigs and node CA trust.


*OpenShift Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-certificates.yml

This playbook would redeploys etcd, master, node, router and registry certificates. This playbook does not redeploy the OpenShift CA certificate and uses the current CA certificate to sign new certificates.


*Etcd Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-etcd-certificates.yml

This playbook only redeploys etcd certificates including master client certificates for etcd.


*Master Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-master-certificates.yml

This playbook only redeploys master certificates.


*Node Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-node-certificates.yml

This playbook only redeploys node certificates.


*Registry and Router Certificates

#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-registry-certificates.yml
#ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-router-certificates.yml

These playbooks replace installer created certificates for the router and registry.


All playbooks have been verified for various ocp-3.5 clusters including ha master/non-ha master, ha etcd/embedded etcd, containerized/rpm env. The playbooks are working as expected and the env is working well after each playbook executing.

Comment 9 errata-xmlrpc 2017-04-12 14:48:31 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0903

Note You need to log in before you can comment on or make changes to this bug.