Red Hat Bugzilla – Bug 1452367
Redeploy CA will try to restart services when certs are expired, causing failure.
Last modified: 2017-12-19 00:36:54 EST
Description of problem: https://docs.openshift.com/container-platform/3.5/install_config/redeploying_certificates.html#redeploying-new-custom-ca $ ansible-playbook -i <inventory_file> \ /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-openshift-ca.yml If the server certs are already expired when we go to restart services the services will fail. How reproducible: 100% Steps to Reproduce: 1. Certs expire and ca expires 2. Redeploy openshift and etcd ca's Actual results: Fails restarting etcd due to invalid certs Expected results: The redeploy to skip the restart service and jump to creating server certs for the expired certs.
Proposed fix https://github.com/openshift/openshift-ansible/pull/4360 Note that I've tested by running a script on a combination etcd/master/node instance which drops an expired certificate for each service. https://gist.github.com/abutcher/b5cfa5451c790185d3a34ca1bc1a820f#file-gen_expired_tls-sh
Verify this bug with openshift-ansible-3.6.98-1.git.0.e651d65.el7.noarch. When openshift certs and CA cert expired, redeploy CA certs firstly: ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-openshift-ca.yml Redeploy CA playbook will skip restart etcd/master/node service since expired cert detected. Redeploy openshift certs next: ansible-playbook -i host /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-certificates.yml This playbook will generate new certs and restart etcd/master/node service. Then all the certs were replaced by new certs, ocp env works well again. This issue should also exist in ocp-3.2/3.3/3.4/3.5 installer, will clone it to 3.2-3.5 to make sure the fix backport to previous installer.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1716