Bug 1526150 - service-catalog fails to install with OCP3.7 due to improperly signed certificate
Summary: service-catalog fails to install with OCP3.7 due to improperly signed certifi...
Keywords:
Status: CLOSED DUPLICATE of bug 1523625
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Service Broker
Version: 3.7.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: ---
Assignee: Jeff Peeler
QA Contact: Jian Zhang
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-12-14 20:40 UTC by Bill DeCoste
Modified: 2018-01-10 20:43 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-01-10 20:43:00 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Bill DeCoste 2017-12-14 20:40:05 UTC
Description of problem:

Version-Release number of the following components:
rpm -q openshift-ansible
rpm -q ansible
ansible --version

How reproducible:
100%

Steps to Reproduce:
1. Start with clean RHEL7.4 VM and follow OCP install directions
2.
3.

Actual results:

The step to install the service-catalog hangs and eventually fails with the below error:

F1214 16:49:05.104842       1 controller_manager.go:198] error running controllers: failed to get supported resources from server: unable to retrieve the complete list of server APIs: servicecatalog.k8s.io/v1beta1: an error on the server ("Error: 'x509: certificate signed by unknown authority (possibly because of \"crypto/rsa: verification error\" while trying to verify candidate authority certificate \"service-catalog-signer\")'\nTrying to reach: 'https://172.30.248.218:443/apis/servicecatalog.k8s.io/v1beta1'") has prevented the request from succeeding

I've got a new VM and I am trying to install OCP3.7 and running into a problem (see below). I ran into so many problems trying to upgrade from 3.6 that I gave up and am starting fresh. Looks like the certificate for the service-catalog isn't signed properly and the install check is failing. If I hit that URL via the browser, I am getting the same error for an invalid certificate (if I add a exception in the browser I get the correct results so the pod is running). This is preventing the install from succeeding.

Expected results:
Install succeeds

Additional info:
Please attach logs from ansible-playbook with the -vvv flag

Comment 1 lvdevelop 2017-12-21 09:43:10 UTC
Any progress here?

I am facing the same problem after Upgrading OpenShift Origin from v3.6 to v3.7 .

Comment 4 Jeff Peeler 2018-01-09 15:29:32 UTC
Any chance either of you could try redeploying with the following line deleted:

https://github.com/openshift/openshift-ansible/blob/0c5f70ad87e25f26a074613ad4576d5bcd759054/roles/openshift_service_catalog/tasks/generate_certs.yml#L89

I'm having difficulty getting my test environment going currently.

Comment 5 Jeff Peeler 2018-01-10 20:43:00 UTC
I do believe this is a duplicate of bz 1523625, so I'm closing this one.

*** This bug has been marked as a duplicate of bug 1523625 ***


Note You need to log in before you can comment on or make changes to this bug.