Bug 1572763 - Need to validate etcd server certs have proper SAN prior to upgrading to etcd-3.2.15-2.el7
Summary: Need to validate etcd server certs have proper SAN prior to upgrading to etcd...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Cluster Version Operator
Version: 3.7.1
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: ---
: 3.7.z
Assignee: Vadim Rutkovsky
QA Contact: Gaoyun Pei
URL:
Whiteboard:
Depends On: 1565762
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-27 18:57 UTC by Scott Dodson
Modified: 2018-05-07 20:20 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: etcd 3.2.15 is compiled with go 1.9, which tightens the certificate security Consequence: Certificates, created without SAN entry, are now treated as invalid in etcd 3.2.15 Fix: Certificates are re-generated on 3.6 -> 3.7 upgrade so that these would be compatible with new etcd Result: openshift-ansible generates valid certificates for etcd 3.2.15
Clone Of: 1565762
Environment:
Last Closed: 2018-05-07 20:20:14 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:1335 0 None None None 2018-05-07 20:20:26 UTC

Comment 1 Scott Dodson 2018-04-30 12:39:07 UTC 
https://github.com/openshift/openshift-ansible/pull/8158
https://github.com/openshift/openshift-ansible/pull/7914

Fixed in openshift-ansible-3.7.44-1.git.9.684c638.el7
Comment 3 Gaoyun Pei 2018-05-02 10:08:27 UTC 
Verify this bug with openshift-ansible-3.7.44-1.git.9.684c638.el7.noarch

Etcd server.crt issue was fixed during upgrade to 3.7. Detailed steps could be found in https://bugzilla.redhat.com/show_bug.cgi?id=1565762#c7.
Comment 6 errata-xmlrpc 2018-05-07 20:20:14 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1335
Note You need to log in before you can comment on or make changes to this bug.