Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1427429

Summary: [3.4] Certificate redeploy playbook shouldn't remove CA certificate by default
Product: OpenShift Container Platform Reporter: Gaoyun Pei <gpei>
Component: InstallerAssignee: Andrew Butcher <abutcher>
Status: CLOSED ERRATA QA Contact: Gaoyun Pei <gpei>
Severity: high Docs Contact:
Priority: high    
Version: 3.4.1CC: aos-bugs, bleanhar, dlbewley, jokerman, mmccomas, sdodson, stwalter, tkimura
Target Milestone: ---Keywords: Regression
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1433068 (view as bug list) Environment:
Last Closed: 2017-04-25 17:42:23 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1433068    

Description Gaoyun Pei 2017-02-28 08:19:09 UTC 
Description of problem:
When running certificate redeploy playbook without setting openshift_certificates_redeploy_ca=true, the playbook would mistakenly remove CA cert files, then re-create ca.crt/ca.key when creating the master certificates.

Version-Release number of selected component (if applicable):
openshift-ansible-3.4.67-1.git.0.14a0b4d.el7.noarch.rpm

How reproducible:
Always

Steps to Reproduce:
1. Run cert redeploy playbook against an ocp-3.4 cluster 

ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-certificates.yml


Actual results:
...

TASK [Remove generated certificates] *******************************************
changed: [qe-gpei-34master-1.0228-m9j.qe.rhcloud.com] => (item=ca.crt)
changed: [qe-gpei-34master-1.0228-m9j.qe.rhcloud.com] => (item=ca.key)
changed: [qe-gpei-34master-1.0228-m9j.qe.rhcloud.com] => (item=admin.crt)
changed: [qe-gpei-34master-1.0228-m9j.qe.rhcloud.com] => (item=admin.key)
changed: [qe-gpei-34master-1.0228-m9j.qe.rhcloud.com] => (item=admin.kubeconfig)
changed: [qe-gpei-34master-1.0228-m9j.qe.rhcloud.com] => (item=master.kubelet-client.crt)
changed: [qe-gpei-34master-1.0228-m9j.qe.rhcloud.com] => (item=master.kubelet-client.key)
...

TASK [Remove CA certificate] ***************************************************
skipping: [qe-gpei-34master-1.0228-m9j.qe.rhcloud.com] => (item=ca.key) 
skipping: [qe-gpei-34master-1.0228-m9j.qe.rhcloud.com] => (item=ca.crt) 
skipping: [qe-gpei-34master-1.0228-m9j.qe.rhcloud.com] => (item=ca-bundle.crt) 
skipping: [qe-gpei-34master-1.0228-m9j.qe.rhcloud.com] => (item=ca.serial.txt) 


Expected results:
The playbook should retain old ca.crt and ca.key files by default 

Additional info:
Shoule be a regression issue of https://github.com/openshift/openshift-ansible/commit/e6554069e948cc44ffcf3b132df81e8b8995a0e7, noticed ca.crt and ca.key were added into cert list in certificates_to_synchronize function.
Comment 2 Takayoshi Kimura 2017-03-01 07:49:58 UTC 
Also we need to check and backport this to 3.3 and 3.2. We already got a customer hitting this issue in 3.3.
Comment 3 Takayoshi Kimura 2017-03-01 08:23:09 UTC 
Just checked changelog for 3.2 and 3.3 and likely they are affected too.

$ rpm -q --changelog openshift-ansible | grep 'Create individual serving cert and loopback'
- Create individual serving cert and loopback kubeconfig for additional
Comment 4 Takayoshi Kimura 2017-03-02 02:52:52 UTC 
For workaround, you can specify openshift_master_ca_certificate parameter. The files should be readable with ansible user.

openshift_master_ca_certificate={'certfile': '/tmp/ca.crt', 'keyfile': '/tmp/ca.key'}
Comment 6 Andrew Butcher 2017-03-16 19:50:10 UTC 
https://github.com/openshift/openshift-ansible/pull/3684
Comment 9 Gaoyun Pei 2017-04-13 06:44:41 UTC 
Test this with openshift-ansible-3.4.77-1.git.0.1edad2c.el7.noarch.

Redeploy certificates(master, etcd, node, registry, and router certificates) using the current CA certificate.
 
ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-certificates.yml

After certificates redeployment, CA certificates were not updated, ocp-3.4 cluster was working well.


The CA certificate could be replaced when running the specialized redeploy-openshift-ca.yml playbook, it could redeploy the CA certificate by generating a new CA certificate and distributing an updated bundle to all components.

ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-openshift-ca.yml

Will move this bug to verified after openshift-ansible-3.4.77-1 attached to advisory 27716.
Comment 10 Gaoyun Pei 2017-04-19 05:35:34 UTC 
Verify this bug with openshift-ansible-3.4.79-1.git.0.6faa668.el7.noarch, redeploy certificates playbook and redeploy CA certificate playbook are working as expected. And openshift-ansible-3.4.79-1.git.0.6faa668.el7.noarch was attached to advisory 27716, move this bug to verified.
Comment 12 errata-xmlrpc 2017-04-25 17:42:23 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1140