Bug 1920567 - [release-3.11] - ca-bundle.crt(/etc/origin/master/ca-bundle.crt) is missing on the fresh installation process
Summary: [release-3.11] - ca-bundle.crt(/etc/origin/master/ca-bundle.crt) is missing o...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 3.11.0
Hardware: All
OS: Linux
medium
high
Target Milestone: ---
: 3.11.z
Assignee: Russell Teague
QA Contact: Gaoyun Pei
URL:
Whiteboard:
: 1920902 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-01-26 15:47 UTC by Gabriel Stein
Modified: 2024-06-14 00:02 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: openshift_named_certificates role checks the contents of ca-bundle.crt during install Consequence: This check fails on a fresh install because the ca-bundle.crt file has not yet been created. Fix: Skip the ca-bundle.crt check if the file does not exist. Result: Install succeeds on fresh install.
Clone Of:
Environment:
Last Closed: 2021-03-03 12:27:45 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift openshift-ansible pull 12294 0 None closed Bug 1920567: patch to check if the ca-bundle.crt exists 2021-02-22 00:14:59 UTC
Red Hat Knowledge Base (Solution) 5749651 0 None None None 2021-01-28 01:50:50 UTC
Red Hat Product Errata RHSA-2021:0637 0 None None None 2021-03-03 12:29:08 UTC

Comment 2 Andy Bartlett 2021-01-27 14:35:33 UTC 
Hi Russell,
 This appears to be a duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=1920902, and on that one there is a suggested patch to fix this.

Regards,

Andy
Comment 6 Russell Teague 2021-01-27 20:53:23 UTC 
*** Bug 1920902 has been marked as a duplicate of this bug. ***
Comment 8 Vladislav Walek 2021-01-29 17:53:03 UTC 
PR: https://github.com/openshift/openshift-ansible/pull/12294
Comment 9 Russell Teague 2021-02-01 21:38:29 UTC 
Working to get the proposed PR merged.
Comment 11 Gaoyun Pei 2021-02-07 09:15:49 UTC 
Could reproduce this issue with openshift-ansible-3.11.374-1.git.0.92f5956.el7.noarch.rpm.

The installation failed as below:

TASK [openshift_named_certificates : Copy the ca-bundle.crt to temp directory] ***
Sunday 07 February 2021  14:48:47 +0800 (0:00:00.460)       0:06:21.454 ******* 
fatal: [ci-vm-10-0-151-194.hosted.upshift.rdu2.redhat.com]: FAILED! => {"changed": false, "msg": "Source /etc/origin/master/ca-bundle.crt not found"}



Verify this issue with openshift-ansible-3.11.383-1.git.0.ea6dd17.el7.noarch.rpm. 

With 
openshift_master_named_certificates=[{"certfile": "/files/ca/12817_named.crt", "keyfile": "/files/ca/12817_named.key","cafile": "/files/ca/12817_named_ca.pem"}]
set in ansible inventory file, installation passed without error.

Check the cluster, named certificates are configured as expected.

[root@gpei-bz1920567mrre-1 master]# ls named_certificates/
12817_named_ca.pem  12817_named.crt  12817_named.key  docker-registry.pem

[root@gpei-bz1920567mrre-1 master]# cat master-config.yaml 
...
  namedCertificates:
  - certFile: /etc/origin/master/named_certificates/12817_named.crt
    keyFile: /etc/origin/master/named_certificates/12817_named.key
    names:
    - internal-named.example.com
    - master.example.com

The content of the specified ca file "12817_named_ca.pem" was added into ca-bundle.crt.
Comment 16 errata-xmlrpc 2021-03-03 12:27:45 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Container Platform 3.11.394 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:0637
Note You need to log in before you can comment on or make changes to this bug.