Bug 1734552 - Master certificate redeploy does not recreate /etc/origin/master/bootstrap.kubeconfig
Summary: Master certificate redeploy does not recreate /etc/origin/master/bootstrap.k...
Keywords:
Status: CLOSED DUPLICATE of bug 1652746
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 3.11.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: 3.11.z
Assignee: Russell Teague
QA Contact: Johnny Liu
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-07-30 20:38 UTC by Ryan Howe
Modified: 2019-08-02 15:58 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-02 15:57:44 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Ryan Howe 2019-07-30 20:38:18 UTC
Description of problem:
 
 Redeploying master certs does not redeploy and create a new /etc/origin/master/bootstrap.kubeconfig  used when scaling up nodes. 


Version-Release number of the following components:
openshift-ansible-3.11.123-1.git.0.db681ba.el7.noarch

How reproducible:
100%

Steps to Reproduce:
1. Redeploy CA 
2. Redeploy master certs
3. Scale up adding new nodes

Actual results:
/etc/origin/master/bootstrap.kubeconfig is copied to new node containing incorrect old CA. Node fails to get added to cluster. 
 
Expected results:
All associated files updated with ca when redeploy of master certs is run

Comment 1 Ryan Howe 2019-08-02 15:57:44 UTC
Fixed in this bug: 

https://bugzilla.redhat.com/show_bug.cgi?id=1652746



roles/openshift_control_plane/tasks/bootstrap.yml 
---
# TODO: create a module for this command.
# oc_serviceaccounts_kubeconfig
- name: create service account kubeconfig with csr rights
  command: >
    {{ openshift_client_binary }} --config={{ openshift.common.config_base }}/master/admin.kubeconfig serviceaccounts create-kubeconfig {{ openshift_master_csr_sa }} -n {{ openshift_master_csr_namespace }}
  register: kubeconfig_out
  until: kubeconfig_out.rc == 0
  retries: 24
  delay: 5

- name: put service account kubeconfig into a file on disk for bootstrap
  copy:
    content: "{{ kubeconfig_out.stdout }}"
    dest: "/etc/origin/master/bootstrap.kubeconfig"

*** This bug has been marked as a duplicate of bug 1652746 ***

Comment 2 Ryan Howe 2019-08-02 15:58:13 UTC
If the OpenShift Container Platform CA was redeployed with the openshift-master/redeploy-openshift-ca.yml playbook you must add -e openshift_redeploy_openshift_ca=true to this command.


Note You need to log in before you can comment on or make changes to this bug.