Document URL: 

https://docs.openshift.com/container-platform/3.7/install_config/redeploying_certificates.html#redeploying-master-certificates

Section Number and Name: 

"Installation and Configuration" > "Redeploying Certificates" > "Redeploying Master Certificates Only"

Describe the issue: 

When following "Redeploying Master Certificates Only" documentation [1] there is no indication service-signer.crt and service-signer.key (used for "Service Serving Certificates" [2]) will be purged and regenerated. This is the CA cert responsible for signing any services with annotation "service.alpha.openshift.io/serving-cert-secret-name." It's not obvious this will happen without examining function certificates_to_synchronize [3]. Following execution of redeploy-master-certificates.yml the certificates previously signed by the original service-signer.crt are invalid.

[1]: https://docs.openshift.com/container-platform/3.7/install_config/redeploying_certificates.html#redeploying-master-certificates
[2]: https://docs.openshift.com/container-platform/3.7/dev_guide/secrets.html#service-serving-certificate-secrets
[3]: https://github.com/openshift/openshift-ansible/blob/master/roles/lib_utils/filter_plugins/openshift_master.py#L495-L496

Suggestions for improvement: 

Until redeploy of service-signer.crt and service-signer.key (used for "Service Serving Certificates" [2]) is split-off from redeploy-master-certificates.yml there should be a warning or informational disclaimer noting "Service Signing Certificates" will need to be regenerated after playbook execution (by deleting existing secrets containing service serving certificates or removing/re-adding annotations to appropriate services).

Additional information: 

Due to recreation of service-signer.crt & service-signer.key implicit trusts required for proper routing will break. Router pods will stop trusting old certificates (signed by the original service-signer.crt) still referenced in running pod secrets and as a result HAProxy may mark the backends as down due to "Layer6 invalid response, info: SSL handshake failure"