Bug 1571601 - [3.9] Certificate expiry playbook couldn't work
Summary: [3.9] Certificate expiry playbook couldn't work
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 3.9.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 3.9.z
Assignee: Vadim Rutkovsky
QA Contact: Gaoyun Pei
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-25 08:08 UTC by Gaoyun Pei
Modified: 2018-06-27 18:02 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-06-27 18:02:09 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2013 0 normal SHIPPED_LIVE Important: OpenShift Container Platform 3.9 security, bug fix, and enhancement update 2018-06-27 22:01:43 UTC

Description Gaoyun Pei 2018-04-25 08:08:58 UTC
Description of problem:
The latest 3.9 cert expiry checking playbook not working now.


Version-Release number of the following components:
openshift-ansible-3.9.24-1.git.0.d0289ea.el7.noarch


How reproducible:
100%

Steps to Reproduce:
1.Run certificate expiry playbook against an ocp-3.9 cluster
ansible-playbook -i host/39 /usr/share/ansible/openshift-ansible/playbooks/openshift-checks/certificate_expiry/default.yaml -v


Actual results:
PLAY [Check cert expirys] ***************************************************************************************************************************************************

TASK [openshift_certificate_expiry : Check cert expirys on host] ************************************************************************************************************
fatal: [qe-gpei-39-node-registry-router-1.0424-ox2.qe.rhcloud.com]: FAILED! => {"changed": false, "failed": true, "module_stderr": "Shared connection to qe-gpei-39-node-registry-router-1.0424-ox2.qe.rhcloud.com closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n  File \"/tmp/ansible_Koge0f/ansible_module_openshift_cert_expiry.py\", line 805, in <module>\r\n    main()\r\n  File \"/tmp/ansible_Koge0f/ansible_module_openshift_cert_expiry.py\", line 509, in main\r\n    cert_meta['serviceSigner'] = os.path.join(cfg_path, cfg['controllerConfig']['serviceServingCert']['signer']['certFile'])\r\nKeyError: 'controllerConfig'\r\n", "msg": "MODULE FAILURE", "rc": 0}
fatal: [qe-gpei-39-master-etcd-nfs-1.0424-ox2.qe.rhcloud.com]: FAILED! => {"changed": false, "failed": true, "module_stderr": "Shared connection to qe-gpei-39-master-etcd-nfs-1.0424-ox2.qe.rhcloud.com closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n  File \"/tmp/ansible_SGznmu/ansible_module_openshift_cert_expiry.py\", line 805, in <module>\r\n    main()\r\n  File \"/tmp/ansible_SGznmu/ansible_module_openshift_cert_expiry.py\", line 509, in main\r\n    cert_meta['serviceSigner'] = os.path.join(cfg_path, cfg['controllerConfig']['serviceServingCert']['signer']['certFile'])\r\nKeyError: 'controllerConfig'\r\n", "msg": "MODULE FAILURE", "rc": 0}
	to retry, use: --limit @/usr/share/ansible/openshift-ansible/playbooks/openshift-checks/certificate_expiry/default.retry




Expected results:

Additional info:
Please attach logs from ansible-playbook with the -vvv flag

Comment 1 Vadim Rutkovsky 2018-05-02 12:22:27 UTC
https://github.com/openshift/openshift-ansible/pull/8149 should resolve that

Comment 2 Vadim Rutkovsky 2018-05-02 12:23:45 UTC
Fix is available in openshift-ansible-3.9.27-1

Comment 3 Gaoyun Pei 2018-05-04 02:54:09 UTC
Verify this bug with openshift-ansible-3.9.27-1.git.0.52e35b5.el7.noarch.

Tried several cert-check playbooks, easy-mode.yaml/default.yaml/longer_warning_period.yaml, all work well.

Comment 5 errata-xmlrpc 2018-06-27 18:02:09 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:2013


Note You need to log in before you can comment on or make changes to this bug.