Bug 1611823 - Service Serving Certificate Secrets should be recreated when serviceServingCert.signer.certFile is recreated or replaced.
Summary: Service Serving Certificate Secrets should be recreated when serviceServingCe...
Keywords:
Status: CLOSED DUPLICATE of bug 1683061
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: apiserver-auth
Version: 3.9.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 4.1.0
Assignee: Matt Rogers
QA Contact: Chuan Yu
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-08-02 20:15 UTC by Ryan Howe
Modified: 2019-03-12 14:01 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-03-07 14:54:29 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Ryan Howe 2018-08-02 20:15:44 UTC
Description of problem:

When redeploying certs in a cluster, if the service-signer.crt is recreated due to expiring or other reasons, all secrets created based on this are no longer trusted.

Steps to Reproduce:
1.oc adm ca create-signer-cert --cert="/etc/origin/master/service-signer.crt" --key="/etc/origin/master/service-signer.key" --name="/etc/origin/master/openshift-service-serving-signer"   --serial=/etc/origin/master/service-signer.serial.txt --overwrite


Actual results:
OpenShift no longer trusts these certs. 

Expected results:
Either some controller checking and recreating secrets created from this or a `oc adm` command that can be called that would regenerate the secrets. 


Additional info:

Similar bugs via docs or installer that resolve this by manually asking user to recreate all secrets. 

  https://bugzilla.redhat.com/show_bug.cgi?id=1550250
  https://bugzilla.redhat.com/show_bug.cgi?id=1592303

Comment 1 Neelesh Agrawal 2019-03-07 14:54:29 UTC

*** This bug has been marked as a duplicate of bug 1683061 ***


Note You need to log in before you can comment on or make changes to this bug.