Bug 1463772 – [3.5] The installer should allow for redeploy of etcd CA only.

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1463772 - [3.5] The installer should allow for redeploy of etcd CA only.

Summary:	[3.5] The installer should allow for redeploy of etcd CA only.

Status:	CLOSED ERRATA

Aliases:	None

Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Installer (Show other bugs)
Sub Component:
Version:	3.5.0
Hardware:	Unspecified Unspecified

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Andrew Butcher
QA Contact:	Gaoyun Pei
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:	1451927 1463773 1463774 1463775
Blocks:
	Show dependency tree / graph

Reported:	2017-06-21 13:55 EDT by Andrew Butcher
Modified:	2017-08-16 15 EDT (History)
CC List:	6 users (show)

See Also:
Fixed In Version:
Doc Type:	Enhancement
Doc Text:	Feature: Etcd CA redeployment playbook. Reason: Previously, it was only possible to redeploy the etcd CA certificate by also redeploying the OpenShift CA certificate which was unnecessary maintenance. Result: The etcd CA certificate may now be replaced independent of the OpenShift CA certificate using the etcd CA certificate redeployment playbook (playbooks/byo/openshift-cluster/redeploy-etcd-ca.yml). Note that the OpenShift CA redeployment playbook (playbooks/byo/openshift-cluster/redeploy-openshift-ca.yml) now only replaces the OpenShift CA certificate. Similarly, the etcd CA redeployment playbook only redeploys the etcd CA certificate.
Story Points:	---
Clone Of:	1451927
Environment:
Last Closed:	2017-06-29 09:34:41 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2017:1666	normal	SHIPPED_LIVE	OpenShift Container Platform atomic-openshift-utils bug fix and enhancement	2017-06-29 13:32:39 EDT

Groups: None (edit)

Comment 1 Andrew Butcher 2017-06-21 13:56:07 EDT

https://github.com/openshift/openshift-ansible/pull/4480

Comment 3 Gaoyun Pei 2017-06-27 05:29:45 EDT

Verify this bug with openshift-ansible-3.5.88-1.git.0.9901d92.el7.noarch

For Etcd CA cert redeployment, we could use playbook /usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-etcd-ca.yml

This playbook will only create new etcd CA certificate, then distribute etcd CA to etcd hosts and masters, restart etcd and master services.


For openshift CA cert redeployment, we could use playbook
/usr/share/ansible/openshift-ansible/playbooks/byo/openshift-cluster/redeploy-openshift-ca.yml

This playbook will only create new OpenShift CA certificate, then distribute new CA cert to masters and nodes, restart master and node services.

Comment 5 errata-xmlrpc 2017-06-29 09:34:41 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1666

Note You need to log in before you can comment on or make changes to this bug.