Bug 1538895 - [3.6] Invalid entries in namedCertificates when using openshift_master_named_certificates
Summary: [3.6] Invalid entries in namedCertificates when using openshift_master_named_...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 3.6.0
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
: 3.6.z
Assignee: Russell Teague
QA Contact: Johnny Liu
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-01-26 04:18 UTC by Russell Teague
Modified: 2018-08-06 12:55 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: Alternative names in certificates were not being properly parsed. Consequence: Alternatives with 'email:' were being added as additional hostnames. Fix: Updated the logic to only add alternative names which begin with 'DNS:' Result: Proper parsing and updating of namedCertificates
Clone Of: 1502838
Environment:
Last Closed: 2018-04-12 06:01:18 UTC
Target Upstream Version:
Embargoed:
jupierce: needinfo-


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:1106 0 None None None 2018-04-12 06:01:46 UTC

Comment 3 Johnny Liu 2018-01-30 09:07:27 UTC
Retest this bug with "openshift-ansible-3.6.173.0.101-1.git.0.7c6b77f.el7.noarch, and FAIL.

# cat /etc/origin/master/master-config.yaml
<--snip-->
  namedCertificates:
  - certFile: /etc/origin/master/named_certificates/cloudbeta.rio.gov.br.crt
    keyFile: /etc/origin/master/named_certificates/cloudbeta.rio.gov.br.key
    names:
    - "email:hostmaster.rj.gov.br"
    - "cloudbeta.rio.gov.br"
<--snip-->

Seem like the PR is not landed into the rpm package.

Comment 4 Russell Teague 2018-02-02 16:05:15 UTC
Waiting for 3.6 build

Comment 6 Russell Teague 2018-02-15 20:33:49 UTC
$ git tag --contains 6be727ca13ca1260333ab7b16636c2ab7a449a70
openshift-ansible-3.6.173.0.103-1

Comment 7 Johnny Liu 2018-02-22 08:22:55 UTC
Verified this bug with openshift-ansible-3.6.173.0.104-1.git.0.ee43cc5.el7.noarch, and PASS.

# cat /etc/origin/master/master-config.yaml
<--snip-->
  namedCertificates:
  - certFile: /etc/origin/master/named_certificates/cloudbeta.rio.gov.br.crt
    keyFile: /etc/origin/master/named_certificates/cloudbeta.rio.gov.br.key
    names:
    - "cloudbeta.rio.gov.br"
<--snip-->

Comment 10 errata-xmlrpc 2018-04-12 06:01:18 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1106


Note You need to log in before you can comment on or make changes to this bug.