Bug 1710424 - There is no separate playbook to just perform logging cert rotation
Summary: There is no separate playbook to just perform logging cert rotation
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging
Version: 3.11.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: 3.11.z
Assignee: ewolinet
QA Contact: Anping Li
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-05-15 14:07 UTC by ewolinet
Modified: 2021-03-01 08:32 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
Feature: Perform cert rotation for cluster logging without needing to run the install/upgrade playbook and make manual changes on the first master node. Reason: To prevent the chance of using incorrect inventory settings based on a prior installation of cluster logging just to regenerate certificates, and removing need to perform a required manual step -- done by the playbook instead. Result: Cluster logging certificates are regenerated, secrets are updated, and components that are required to be restarted to read in the updated certificates are.
Clone Of:
Environment:
Last Closed: 2019-06-26 09:08:11 UTC
Target Upstream Version:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift openshift-ansible pull 11613 0 'None' closed Bug 1710424 - Creating logging playbook to do cert rotation 2020-08-17 13:09:30 UTC
Red Hat Product Errata RHBA-2019:1605 0 None None None 2019-06-26 09:08:20 UTC

Description ewolinet 2019-05-15 14:07:49 UTC 
Description of problem:
Currently if we need to perform logging cert rotation it is a manual process.
The first master needs to have its logging cert directory deleted and then run the logging installation playbook.

Version-Release number of selected component (if applicable):
3.11

How reproducible:
Always

Actual results:


Expected results:


Additional info:
Comment 2 Anping Li 2019-06-12 15:49:35 UTC 
The secret prometheus-tls were't refreshed. Could you confirm if this secret should be redeployed?
Comment 3 ewolinet 2019-06-14 14:17:50 UTC 
This is only concerned with refreshing the EFK genereated certificates and secrets. Prometheus-tls is managed by the cert signing service https://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_logging_elasticsearch/tasks/main.yaml#L362
Comment 5 Michael Burke 2019-06-25 00:26:29 UTC 
Added to docs via https://github.com/openshift/openshift-docs/pull/15526
Comment 7 errata-xmlrpc 2019-06-26 09:08:11 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:1605
Note You need to log in before you can comment on or make changes to this bug.