Bug 1416614 - Migrate data associated with etcd prefix errors in v3.4.0.39
Summary: Migrate data associated with etcd prefix errors in v3.4.0.39
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: apiserver-auth
Version: 3.4.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: ---
Assignee: Seth Jennings
QA Contact: ge liu
URL:
Whiteboard:
Depends On: 1418854
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-01-26 02:33 UTC by Scott Dodson
Modified: 2017-02-22 18:11 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
Users who had upgraded to OCP v3.4.0.39 may have had certain data stored in incorrect locations. The script installs on your master at /usr/share/openshift/migration/fix-3.4-paths.sh and can be used to migrate bad data to the correct location. Please see KCS article for more information
Clone Of:
Environment:
Last Closed: 2017-02-22 18:11:30 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0289 0 normal SHIPPED_LIVE OpenShift Container Platform 3.4.1.7, 3.3.1.14, and 3.2.1.26 bug fix update 2017-02-22 23:10:04 UTC

Description Scott Dodson 2017-01-26 02:33:11 UTC
We need a script to migrate bad data created by v3.4.0.40 to the new prefixed keys in etcd as a remediation for clusters that previously ran v3.4.0.39. See https://bugzilla.redhat.com/show_bug.cgi?id=1415570 for additional information. 

Test Scenarios:

    no data that needs migrating (top-level directories don't exist)
    non-conflicting data that needs migrating (dry-run and applying)
    conflicting data that needs migrating (dry-run and applying)

Comment 3 Scott Dodson 2017-01-26 02:42:18 UTC
Comment 0 has a typo, the bad data was created by v3.4.0.39 and v3.4.0.40 fixed the issue but did not migrate data.

Comment 5 ge liu 2017-01-26 05:34:00 UTC
Verification test:

=======3.4.0.39:==========

- # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/
/openshift.io/authorization
/openshift.io/ranges
/openshift.io/images
/openshift.io/routes
/openshift.io/builds
/openshift.io/identities
/openshift.io/oauth
/openshift.io/registry
/openshift.io/imagestreams
/openshift.io/templates
/openshift.io/deploymentconfigs
/openshift.io/buildconfigs
/openshift.io/users

1).- # oc create -f old-object.json 
egressnetworkpolicy "a" created
egressnetworkpolicy "b" created
identity "x:a" created
identity "x:b" created

- # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/identities
/openshift.io/identities/htpasswd_auth:weshi
/openshift.io/identities/x:a
/openshift.io/identities/x:b
- # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/egressnetworkpolicies
/openshift.io/egressnetworkpolicies/default
- # oc get egressnetworkpolicies
NAME
a
b
- # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/registry
/openshift.io/registry/sdnnetworks
/openshift.io/registry/sdnsubnets


- # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/
/openshift.io/deploymentconfigs
/openshift.io/oauth
/openshift.io/registry
/openshift.io/authorization
/openshift.io/builds
/openshift.io/buildconfigs
/openshift.io/users
/openshift.io/imagestreams
/openshift.io/templates
/openshift.io/routes
/openshift.io/identities
/openshift.io/egressnetworkpolicies
/openshift.io/ranges
/openshift.io/images



=============3.4.0.40============

dry-run:

- # ./fix-3.4-paths.sh  -c /etc/origin/master/  https://192.xxx.2.xxx:2379
Running in dry-run mode. Use -a option to apply changes.
Migrating Users
dry-run: copying /openshift.io/identities/htpasswd_auth:weshi to /openshift.io/useridentities/htpasswd_auth:weshi
dry-run: copying /openshift.io/identities/x:a to /openshift.io/useridentities/x:a
dry-run: copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b
Migrating Egress Policies
dry-run: copying /openshift.io/egressnetworkpolicies/default/a to /openshift.io/registry/egressnetworkpolicy/default/a
dry-run: copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b


- # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io
/openshift.io/authorization
/openshift.io/builds
/openshift.io/imagestreams
/openshift.io/templates
/openshift.io/buildconfigs
/openshift.io/users
/openshift.io/egressnetworkpolicies
/openshift.io/ranges
/openshift.io/images
/openshift.io/routes
/openshift.io/identities
/openshift.io/oauth
/openshift.io/registry
/openshift.io/deploymentconfigs

Applying:

- # ./fix-3.4-paths.sh -a -c /etc/origin/master/  https://192.xxx.2.xxx:2379Migrating Users
copying /openshift.io/identities/htpasswd_auth:weshi to /openshift.io/useridentities/htpasswd_auth:weshi
copying /openshift.io/identities/x:a to /openshift.io/useridentities/x:a
copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b
Migrating Egress Policies
copying /openshift.io/egressnetworkpolicies/default/a to /openshift.io/registry/egressnetworkpolicy/default/a
copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b

- # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io
/openshift.io/authorization
/openshift.io/builds
/openshift.io/imagestreams
/openshift.io/templates
/openshift.io/buildconfigs
/openshift.io/users
/openshift.io/ranges
/openshift.io/images
/openshift.io/routes
/openshift.io/identities
/openshift.io/egressnetworkpolicies
/openshift.io/useridentities
/openshift.io/oauth
/openshift.io/registry
/openshift.io/deploymentconfigs



- # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/useridentities
/openshift.io/useridentities/htpasswd_auth:weshi
/openshift.io/useridentities/x:a
/openshift.io/useridentities/x:b


- # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/registry/egressnetworkpolicy/default
/openshift.io/registry/egressnetworkpolicy/default/a
/openshift.io/registry/egressnetworkpolicy/default/b

- # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/identities
/openshift.io/identities/htpasswd_auth:weshi
/openshift.io/identities/x:a
/openshift.io/identities/x:b 

- #.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/egressnetworkpolicies/default
/openshift.io/egressnetworkpolicies/default/b
/openshift.io/egressnetworkpolicies/default/a

Comment 6 ge liu 2017-01-26 13:02:33 UTC
------------------------------------
Test Scenarios: 
     no data that needs migrating (top-level directories don't exist)
----------------------------------

3.4.0.39:

# oc whoami
system:admin
# oc get identity
No resources found.
# oc get egressnetworkpolicy
No resources found.

# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xx:2379 ls /openshift.io
/openshift.io/authorization
/openshift.io/registry
/openshift.io/templates
/openshift.io/routes
/openshift.io/buildconfigs
/openshift.io/oauth
/openshift.io/imagestreams
/openshift.io/images
/openshift.io/deploymentconfigs
/openshift.io/builds
/openshift.io/ranges


# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xx:2379 ls /openshift.io/registry
/openshift.io/registry/sdnnetworks
/openshift.io/registry/sdnsubnets


upgrade to 3.4.0.40:

# ./fix-3.4-paths.sh  -c /etc/origin/master/ https://192.xxx.2.xx:2379
Running in dry-run mode. Use -a option to apply changes.
Migrating Users
Error:  100: Key not found (/openshift.io/identities) [2594]
Migrating Egress Policies
Error:  100: Key not found (/openshift.io/egressnetworkpolicies) [2594]

# ./fix-3.4-paths.sh -a  -c /etc/origin/master/ https://192.xx.2.xx:2379
Migrating Users
Error:  100: Key not found (/openshift.io/identities) [2661]
Migrating Egress Policies
Error:  100: Key not found (/openshift.io/egressnetworkpolicies) [2661]


notes: the migrate script will not be executed as expected, but the error msg looks like not friendly enough, is it possible to improve it? thanks

Comment 7 ge liu 2017-01-26 13:05:33 UTC
-----------------------------
Test Scenarios:
    conflicting data that needs migrating (dry-run and applying)
-------------------------------


3.3.1.11:


# oc create -f old-object.json 
egressnetworkpolicy "a" created
egressnetworkpolicy "b" created
identity "x:a" created
identity "x:b" created
# oc get identity x:b -o yaml|grep source
    source: original
  resourceVersion: "1653"
# oc get egressnetworkpolicy b -o yaml|grep source
    source: original
  resourceVersion: "1651"
# oc get identity x:a -o yaml|grep source
    source: original
  resourceVersion: "1652"



upgrade to 3.4.0.39:

# oc get identity
No resources found.
# oc get egressnetworkpolicies
No resources found.
# oc create -f new-object.json 
egressnetworkpolicy "b" created
egressnetworkpolicy "c" created
identity "x:b" created
identity "x:c" created


# oc get egressnetworkpolicy b -o yaml |grep source
    source: new
  resourceVersion: "2267"
[root@openshift-123 tmp]# oc get identity x:b -o yaml |grep source
    source: new
  resourceVersion: "2269"



upgrade to 3.4.0.40:


# oc get identity
NAME                  IDP NAME        IDP USER NAME   USER NAME   USER UID
htpasswd_auth:geliu   htpasswd_auth   geliu           geliu       33a2a7d5-e3b6-11e6-851f-fa163e53e53d
x:a                   x               a                           
x:b                   x               b                           
# oc get identity x:b -o yaml |grep source
    source: original
  resourceVersion: "1653"
# oc get egressnetworkpolicy b -o yaml |grep source
    source: original
  resourceVersion: "1651"

# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xx:2379 ls /openshift.io
/openshift.io/egressnetworkpolicies
/openshift.io/authorization
/openshift.io/registry
/openshift.io/deploymentconfigs
/openshift.io/routes
/openshift.io/builds
/openshift.io/buildconfigs
/openshift.io/identities
/openshift.io/useridentities
/openshift.io/oauth
/openshift.io/ranges
/openshift.io/imagestreams
/openshift.io/templates
/openshift.io/images
/openshift.io/users


# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xxx:2379 ls /openshift.io/useridentities
/openshift.io/useridentities/x:b
/openshift.io/useridentities/htpasswd_auth:geliu
/openshift.io/useridentities/x:a

# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/registry
/openshift.io/registry/sdnsubnets
/openshift.io/registry/egressnetworkpolicy
/openshift.io/registry/sdnnetworks

# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/registry/egressnetworkpolicy/default
/openshift.io/registry/egressnetworkpolicy/default/a
/openshift.io/registry/egressnetworkpolicy/default/b


Execute migrate script: 

1). dry-run:

# ./fix-3.4-paths.sh -c /etc/origin/master https://192.xxx.2.xxx:2379
Running in dry-run mode. Use -a option to apply changes.
Migrating Users
dry-run: copying /openshift.io/identities/x:c to /openshift.io/useridentities/x:c
dry-run: copying /openshift.io/identities/htpasswd_auth:geliu to /openshift.io/useridentities/htpasswd_auth:geliu
dry-run: overwriting existing key /openshift.io/useridentities/htpasswd_auth:geliu
dry-run: copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b
dry-run: overwriting existing key /openshift.io/useridentities/x:b
Migrating Egress Policies
dry-run: copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b
dry-run: overwriting existing key /openshift.io/registry/egressnetworkpolicy/default/b
dry-run: copying /openshift.io/egressnetworkpolicies/default/c to /openshift.io/registry/egressnetworkpolicy/default/c

# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xx:2379 ls /openshift.io/registry/egressnetworkpolicy/default
/openshift.io/registry/egressnetworkpolicy/default/a
/openshift.io/registry/egressnetworkpolicy/default/b

2). applying:

# ./fix-3.4-paths.sh -a  -c /etc/origin/master https://192.xx.2.xx:2379
Migrating Users
copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b
overwriting existing key /openshift.io/useridentities/x:b
copying /openshift.io/identities/x:c to /openshift.io/useridentities/x:c
copying /openshift.io/identities/htpasswd_auth:geliu to /openshift.io/useridentities/htpasswd_auth:geliu
overwriting existing key /openshift.io/useridentities/htpasswd_auth:geliu
Migrating Egress Policies
copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b
overwriting existing key /openshift.io/registry/egressnetworkpolicy/default/b
copying /openshift.io/egressnetworkpolicies/default/c to /openshift.io/registry/egressnetworkpolicy/default/c

# oc get egressnetworkpolicy a -o yaml|grep source
    source: original
  resourceVersion: "1650"
# oc get egressnetworkpolicy b -o yaml|grep source
    source: new
  resourceVersion: "2880"
# oc get egressnetworkpolicy c -o yaml|grep source
    source: new
  resourceVersion: "2881"

# oc get identity x:a -o yaml|grep source
    source: original
  resourceVersion: "1652"
# oc get identity x:b -o yaml|grep source
    source: new
  resourceVersion: "2877"
# oc get identity x:c -o yaml|grep source
    source: new
  resourceVersion: "2878"


# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xx:2379 ls /openshift.io/registry/egressnetworkpolicy/default
/openshift.io/registry/egressnetworkpolicy/default/a
/openshift.io/registry/egressnetworkpolicy/default/b
/openshift.io/registry/egressnetworkpolicy/default/c


# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xx:2379 ls /openshift.io/useridentities
/openshift.io/useridentities/x:c
/openshift.io/useridentities/htpasswd_auth:geliu
/openshift.io/useridentities/x:a
/openshift.io/useridentities/x:b

Comment 11 Peter Ruan 2017-01-30 21:58:27 UTC
QE verified this bug with the additional tests suggested by Seth.  No issues found.

Comment 13 ge liu 2017-02-06 07:17:10 UTC
Verified the additional test scenarios:
1). backup dir specfifcatioin works well with -d option
2). verify the old key removed from etcd(/openshift.io/identities & /openshift.io/egressnetworkpolicies)
3). verify key with whitespace works well("/openshift.io/useridentities/x:c 1" & "/openshift.io/registry/egressnetworkpolicy/default/c 1")

3.4.0.39:

# oc create -f object.json 
egressnetworkpolicy "b" created
egressnetworkpolicy "c 1" created
identity "x:b" created
identity "x:c 1" created

[root@openshift-203 tmp]# oc get identity
NAME              IDP NAME    IDP USER NAME   USER NAME   USER UID
allow_all:geliu   allow_all   geliu           geliu       bdeba941-ec32-11e6-a145-fa163e0251e6
x:b               x           b                           
x:c 1             x           c 1                         
[root@openshift-203 tmp]# oc get egressnetworkpolicy
NAME
b
c 1


# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx5:2379 ls /openshift.io/useridentities
/openshift.io/useridentities/allow_all:anli
/openshift.io/useridentities/allow_all:anli2
/openshift.io/useridentities/allow_all:anli3

# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/identities
/openshift.io/identities/allow_all:geliu
/openshift.io/identities/x:b
/openshift.io/identities/x:c 1


# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.168.1.195:2379 ls /openshift.io/egressnetworkpolicies/default
/openshift.io/egressnetworkpolicies/default/b
/openshift.io/egressnetworkpolicies/default/c 1

# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.168.1.195:2379 ls /openshift.io/registry
/openshift.io/registry/sdnnetworks
/openshift.io/registry/sdnsubnets
[root@openshift-203 tmp]# 


3.4.0.40:

# oc get  egressnetworkpolicies
No resources found.
[root@openshift-203 tmp]# 
# oc get identity
NAME              IDP NAME    IDP USER NAME   USER NAME   USER UID
allow_all:anli    allow_all   anli            anli        0328f663-ec2a-11e6-af39-fa163e0251e6
allow_all:anli2   allow_all   anli2           anli2       05f847f1-ec2a-11e6-af39-fa163e0251e6
allow_all:anli3   allow_all   anli3           anli3       0918108d-ec2a-11e6-af39-fa163e0251e6

Dry-run:
[root@openshift-203 tmp]# ./fix-3.4-paths.sh  -c /etc/origin/master/ https://192.xx.1.xx:2379 -b /tmp
Running in dry-run mode. Use -a option to apply changes.
dry-run: Migrating Users
dry-run: copying /openshift.io/identities/allow_all:geliu to /openshift.io/useridentities/allow_all:geliu
dry-run: copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b
dry-run: copying /openshift.io/identities/x:c 1 to /openshift.io/useridentities/x:c 1
dry-run: Migrating Egress Policies
dry-run: Project default
dry-run: copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b
dry-run: copying /openshift.io/egressnetworkpolicies/default/c 1 to /openshift.io/registry/egressnetworkpolicy/default/c 1

# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/registry
/openshift.io/registry/sdnnetworks
/openshift.io/registry/sdnsubnets
# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/useridentities
/openshift.io/useridentities/allow_all:anli
/openshift.io/useridentities/allow_all:anli2
/openshift.io/useridentities/allow_all:anli3



Applying:

# ./fix-3.4-paths.sh -a -c /etc/origin/master/ https://192.xx.1.xx:2379 -b /tmp 
Migrating Users
copying /openshift.io/identities/allow_all:geliu to /openshift.io/useridentities/allow_all:geliu
copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b
copying /openshift.io/identities/x:c 1 to /openshift.io/useridentities/x:c 1
Migrating Egress Policies
Project default
copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b
copying /openshift.io/egressnetworkpolicies/default/c 1 to /openshift.io/registry/egressnetworkpolicy/default/c 1
[root@openshift-203 tmp]# 




[root@openshift-203 tmp]# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/identities
[root@openshift-203 tmp]

[root@openshift-203 tmp]# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/egressnetworkpolicies/default
[root@openshift-203 tmp]# 

# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/useridentities
/openshift.io/useridentities/allow_all:anli
/openshift.io/useridentities/allow_all:anli2
/openshift.io/useridentities/allow_all:anli3
/openshift.io/useridentities/allow_all:geliu
/openshift.io/useridentities/x:b
/openshift.io/useridentities/x:c 1


# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/registry/egressnetworkpolicy/default
/openshift.io/registry/egressnetworkpolicy/default/c 1
/openshift.io/registry/egressnetworkpolicy/default/b

Comment 14 ge liu 2017-02-06 10:05:23 UTC
Regard the backup dir: -b, if don't special '-b', the default dir is: /root/openshift-3.4-migration-backup

# tree openshift-3.4-migration-backup
openshift-3.4-migration-backup
└── openshift.io
    ├── egressnetworkpolicies
    │   └── default
    │       ├── b
    │       └── c\ 1
    └── identities
        ├── allow_all:geliu
        ├── x:b
        └── x:c\ 1

4 directories, 5 files

if sepecal the '-b', it works well:

# ./fix-3.4-paths.sh -a -c /etc/origin/master/  -b /tmp https://xx.xx.1.211:2379
Migrating Users
copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b
copying /openshift.io/identities/x:c 1 to /openshift.io/useridentities/x:c 1
Migrating Egress Policies
Project default
copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b
copying /openshift.io/egressnetworkpolicies/default/c 1 to /openshift.io/registry/egressnetworkpolicy/default/c 1

[root@openshift-200 tmp]# tree openshift.io
openshift.io
├── egressnetworkpolicies
│   └── default
│       ├── b
│       └── c\ 1
└── identities
    ├── x:b
    └── x:c\ 1

3 directories, 4 files

Comment 15 ge liu 2017-02-06 10:56:30 UTC
Regrading to script: 'fix-3.4-paths.sh', there is minor problem about the sequence of the parameters, if parameters behind "./fix-3.4-paths.sh" don't follow the giving sequence, then the parameters will be invalid. I filed another bug:https://bugzilla.redhat.com/show_bug.cgi?id=1419496 to trace this issue.

Comment 17 errata-xmlrpc 2017-02-22 18:11:30 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0289


Note You need to log in before you can comment on or make changes to this bug.