Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1432978

Summary:	[DOCS] Need to explain process for running oadm commands
Product:	OpenShift Container Platform	Reporter:	Eric Rich <erich>
Component:	Documentation	Assignee:	Michael Burke <mburke>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Wang Haoran <haowang>
Severity:	urgent	Docs Contact:	Vikram Goyal <vigoyal>
Priority:	high
Version:	3.5.0	CC:	aos-bugs, dmoessne, erich, jokerman, mmccomas, sdodson, xxia
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-03-19 15:25:03 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Eric Rich 2017-03-16 13:48:20 UTC

Document URL: No URL

Section Number and Name: No Section

Describe the issue: When running oadm commands you should run them from the first master (only).

Suggestions for improvement: We need a docs note or section that explains this. 

Additional information: 

For instance if you run ca commands, and create a certificate on 1 master, and run the same (or similar) command on a 2nd master we can't guarantee that the serial numbers will be unique (because we use a flat file for the serial).

Due to situations like this, we should be limited (or documenting the limitations) to running oadm commands on 1 master (locally), as well as not running the commands remotely.

Comment 2 Michael Burke 2018-02-13 22:19:11 UTC

https://github.com/openshift/openshift-docs/pull/7781

Comment 3 Eric Rich 2018-02-16 16:29:44 UTC

The key issue here is that these commands can/will need to interact with certificates this remains true! I believe, scott do we know what use-cases fall under this?

Comment 4 Scott Dodson 2018-02-20 22:22:48 UTC

Yes you should run all CA related commands on the first master which is your CA host.

Comment 5 Scott Dodson 2018-02-20 22:24:54 UTC

If you attempt to run these commands on the non CA host they'll just fail, there's no risk of creating problems that I'm aware of.

Comment 6 Eric Rich 2018-02-22 17:23:43 UTC

(In reply to Scott Dodson from comment #5)
> If you attempt to run these commands on the non CA host they'll just fail,
> there's no risk of creating problems that I'm aware of.

If we implement https://bugzilla.redhat.com/show_bug.cgi?id=1529532 there would be! So we need to be aware of this.

Comment 7 Michael Burke 2018-02-22 20:20:38 UTC

Created attachment 1399532 [details]
Email thread with Scott D's suggestions

Comment 9 daniel 2018-02-23 05:32:18 UTC

(In reply to Eric Rich from comment #6)
> (In reply to Scott Dodson from comment #5)
> > If you attempt to run these commands on the non CA host they'll just fail,
> > there's no risk of creating problems that I'm aware of.
> 
> If we implement https://bugzilla.redhat.com/show_bug.cgi?id=1529532 there
> would be! So we need to be aware of this.

well, looking at what I wrote under 'Additional info' `/usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-etcd-ca.yml` to redeploy certs already does that today (copy over all files to other masters, so I think 

(In reply to Scott Dodson from comment #5)
> If you attempt to run these commands on the non CA host they'll just fail,
> there's no risk of creating problems that I'm aware of.

is then also not valid any more as those files needed are avail no all master, no ?

Comment 10 Wang Haoran 2018-02-26 06:08:52 UTC

The docs update LGTM, will verify the bug once it's merged.

Comment 12 Michael Burke 2018-03-19 15:25:03 UTC

Changes are live. For example:
https://docs.openshift.com/container-platform/3.7/getting_started/install_openshift.html#interact-with-openshift