Bug 1628546 - [3.10] Redeploy openshift ca playbook failed
Summary: [3.10] Redeploy openshift ca playbook failed
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 3.10.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 3.10.z
Assignee: Russell Teague
QA Contact: Gaoyun Pei
URL:
Whiteboard:
: 1641538 (view as bug list)
Depends On: 1585978
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-09-13 12:02 UTC by Russell Teague
Modified: 2018-12-12 16:16 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Corrected redeploy-openshift-ca.yml playbook to reference the correct node client certificate file, node/client-ca.crt.
Clone Of: 1585978
Environment:
Last Closed: 2018-11-11 16:39:11 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2709 0 None None None 2018-11-11 16:39:46 UTC

Comment 1 Russell Teague 2018-09-13 12:12:54 UTC 
release-3.10: https://github.com/openshift/openshift-ansible/pull/10048
Comment 2 Russell Teague 2018-09-19 17:51:28 UTC 
openshift-ansible-3.10.48-1
Comment 4 Gaoyun Pei 2018-09-21 02:51:00 UTC 
Checked with openshift-ansible-3.10.50-1.git.0.96a93c5.el7,
we're missing this PR https://github.com/openshift/openshift-ansible/pull/9962
Comment 5 Russell Teague 2018-09-21 14:21:59 UTC 
Opened new backport PR: https://github.com/openshift/openshift-ansible/pull/10191
Comment 7 Gaoyun Pei 2018-09-26 04:22:42 UTC 
Verify this bug with openshift-ansible-3.10.51-1.git.0.44a646c.el7.noarch.rpm

After run openshift CA redeployment playbook
On master:
/etc/origin/master/ca.crt updated to a new self-generated CA cert file, the new CA file also added into ca-bundle.crt and client-ca-bundle.crt, CA data of admin.kubeconfig and openshift-master.kubeconfig got updated with new ca-bundle.crt content. 

On nodes:
New ca-bundle.crt copied to each node as /etc/origin/node/client-ca.crt, CA data of node.kubeconfig got updated with new ca-bundle.crt content.

Master and node service are all running well and app's creation test passed.
Move this bug to verified.
Comment 8 Gaoyun Pei 2018-10-26 06:17:12 UTC 
*** Bug 1641538 has been marked as a duplicate of this bug. ***
Comment 10 errata-xmlrpc 2018-11-11 16:39:11 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:2709
Comment 11 Ryan Howe 2018-12-12 16:16:04 UTC 
CA redeploy is still broken as it will not redistribute node certs.  

https://bugzilla.redhat.com/show_bug.cgi?id=1652746
Note You need to log in before you can comment on or make changes to this bug.