Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1571601 - [3.9] Certificate expiry playbook couldn't work
[3.9] Certificate expiry playbook couldn't work
Status: CLOSED ERRATA
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer (Show other bugs)
3.9.0
Unspecified Unspecified
high Severity high
: ---
: 3.9.z
Assigned To: Vadim Rutkovsky
Gaoyun Pei
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2018-04-25 04:08 EDT by Gaoyun Pei
Modified: 2018-06-27 14:02 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-06-27 14:02:09 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2013 normal SHIPPED_LIVE Important: OpenShift Container Platform 3.9 security, bug fix, and enhancement update 2018-06-27 18:01:43 EDT

  None (edit)
Description Gaoyun Pei 2018-04-25 04:08:58 EDT
Description of problem:
The latest 3.9 cert expiry checking playbook not working now.


Version-Release number of the following components:
openshift-ansible-3.9.24-1.git.0.d0289ea.el7.noarch


How reproducible:
100%

Steps to Reproduce:
1.Run certificate expiry playbook against an ocp-3.9 cluster
ansible-playbook -i host/39 /usr/share/ansible/openshift-ansible/playbooks/openshift-checks/certificate_expiry/default.yaml -v


Actual results:
PLAY [Check cert expirys] ***************************************************************************************************************************************************

TASK [openshift_certificate_expiry : Check cert expirys on host] ************************************************************************************************************
fatal: [qe-gpei-39-node-registry-router-1.0424-ox2.qe.rhcloud.com]: FAILED! => {"changed": false, "failed": true, "module_stderr": "Shared connection to qe-gpei-39-node-registry-router-1.0424-ox2.qe.rhcloud.com closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n  File \"/tmp/ansible_Koge0f/ansible_module_openshift_cert_expiry.py\", line 805, in <module>\r\n    main()\r\n  File \"/tmp/ansible_Koge0f/ansible_module_openshift_cert_expiry.py\", line 509, in main\r\n    cert_meta['serviceSigner'] = os.path.join(cfg_path, cfg['controllerConfig']['serviceServingCert']['signer']['certFile'])\r\nKeyError: 'controllerConfig'\r\n", "msg": "MODULE FAILURE", "rc": 0}
fatal: [qe-gpei-39-master-etcd-nfs-1.0424-ox2.qe.rhcloud.com]: FAILED! => {"changed": false, "failed": true, "module_stderr": "Shared connection to qe-gpei-39-master-etcd-nfs-1.0424-ox2.qe.rhcloud.com closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n  File \"/tmp/ansible_SGznmu/ansible_module_openshift_cert_expiry.py\", line 805, in <module>\r\n    main()\r\n  File \"/tmp/ansible_SGznmu/ansible_module_openshift_cert_expiry.py\", line 509, in main\r\n    cert_meta['serviceSigner'] = os.path.join(cfg_path, cfg['controllerConfig']['serviceServingCert']['signer']['certFile'])\r\nKeyError: 'controllerConfig'\r\n", "msg": "MODULE FAILURE", "rc": 0}
	to retry, use: --limit @/usr/share/ansible/openshift-ansible/playbooks/openshift-checks/certificate_expiry/default.retry




Expected results:

Additional info:
Please attach logs from ansible-playbook with the -vvv flag
Comment 1 Vadim Rutkovsky 2018-05-02 08:22:27 EDT
https://github.com/openshift/openshift-ansible/pull/8149 should resolve that
Comment 2 Vadim Rutkovsky 2018-05-02 08:23:45 EDT
Fix is available in openshift-ansible-3.9.27-1
Comment 3 Gaoyun Pei 2018-05-03 22:54:09 EDT
Verify this bug with openshift-ansible-3.9.27-1.git.0.52e35b5.el7.noarch.

Tried several cert-check playbooks, easy-mode.yaml/default.yaml/longer_warning_period.yaml, all work well.
Comment 5 errata-xmlrpc 2018-06-27 14:02:09 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:2013

Note You need to log in before you can comment on or make changes to this bug.