Bug 1729393 - OpenShift CA is not copied to system CA trust when a new node is deployed
Summary: OpenShift CA is not copied to system CA trust when a new node is deployed
Keywords:
Status: CLOSED DUPLICATE of bug 1713333
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 3.11.0
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
: 3.11.z
Assignee: Russell Teague
QA Contact: Johnny Liu
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-07-12 07:46 UTC by Victor Hernando
Modified: 2019-08-14 20:22 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-14 20:22:01 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Victor Hernando 2019-07-12 07:46:47 UTC
Description of problem:

Every time a new node is deployed in OCP 3.11 the OpenShift CA is not copied to the system CA.
This process is included in the redeploy-openshift-ca playbook, but missing from the scaleup playbook.
The piece of code I'm referring to:

https://github.com/openshift/openshift-ansible/blob/release-3.11/playbooks/openshift-master/private/redeploy-openshift-ca.yml#L238-L257

Version-Release number of the following components:
# grep ansible installed-rpms |awk '{print $1}'
ansible-2.6.14-1.el7ae.noarch
openshift-ansible-3.11.82-3.git.0.9718d0a.el7.noarch
openshift-ansible-docs-3.11.82-3.git.0.9718d0a.el7.noarch
openshift-ansible-playbooks-3.11.82-3.git.0.9718d0a.el7.noarch
openshift-ansible-roles-3.11.82-3.git.0.9718d0a.el7.noarch


How reproducible:
Deploy a new node using scaleup.yml playbook.
Check the content of the following directory, openshift-client-ca.crt is missing:

$ ls -l /etc/pki/ca-trust/source/anchors/


Actual results:
/etc/pki/ca-trust/source/anchors/openshift-client-ca.crt is missing after adding a new node in the cluster, to have the file in place the customer needs to execute the openshift-redeploy-ca.yml playbook.

Expected results:
To have the following file "/etc/pki/ca-trust/source/anchors/openshift-client-ca.crt" in place after deploying a new node into the cluster.

Additional info:
As far as I see the steps required to accomplish this are the following:
https://github.com/openshift/openshift-ansible/blob/release-3.11/playbooks/openshift-master/private/redeploy-openshift-ca.yml#L238-L257

If this was not included in the scaleup process because some reason and is not planned to be included, please let me know to provide further explanations to my customer.


Note You need to log in before you can comment on or make changes to this bug.