Bug 1954121 - [ceo] [release-4.7] Operator goes degraded when a second internal node ip is added after install
Summary: [ceo] [release-4.7] Operator goes degraded when a second internal node ip is ...
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Etcd
Version: 4.7
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.7.z
Assignee: Maru Newby
QA Contact: ge liu
Depends On: 1954129
Blocks: 1965535 2007698
TreeView+ depends on / blocked
Reported: 2021-04-27 15:47 UTC by Maru Newby
Modified: 2022-08-08 00:25 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: A second internal ip address is added to one or more control plane nodes. Consequence: The Etcd Operator goes degraded due to detecting the ip address change as a potential etcd membership change and does not regenerate etcd serving certificates for the node. Fix: The Etcd Operator differentiates between an ip address change for an existing node and for a new node. The operator will regenerate serving certificates for changes to an existing node. Result: Adding an ip address to a control plane node no longer results in the operator going degraded.
Clone Of:
: 1954129 1965535 2007698 (view as bug list)
Last Closed: 2021-06-15 09:27:08 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift cluster-etcd-operator issues 575 0 None closed EtcdCertSignerController_Error due to secondary interface (added later) 2021-04-27 15:47:21 UTC
Github openshift cluster-etcd-operator pull 577 0 None open Bug 1954121: [release-4.7] Improve cert controller detection and correction of invalid certs 2021-05-06 19:55:06 UTC
Red Hat Product Errata RHSA-2021:2286 0 None None None 2021-06-15 09:27:55 UTC

Description Maru Newby 2021-04-27 15:47:21 UTC
A change in the set of internal ip addresses for a node causes the operator to go degraded. The operator is unable to detect node changes, so any discrepancy between node internal addresses and the SANs of certificates for that node is presumed to represent a potential membership change requiring manual intervention.

Comment 3 Lucas López Montero 2021-05-25 13:24:57 UTC
KCS solution https://access.redhat.com/solutions/6021331 updated with information related to this bug.

Comment 7 Siddharth Sharma 2021-06-04 18:38:59 UTC
This bug will be shipped as part of next z-stream release 4.7.15 on June 14th, as 4.7.14 was dropped due to a regression https://bugzilla.redhat.com/show_bug.cgi?id=1967614

Comment 11 errata-xmlrpc 2021-06-15 09:27:08 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.16 security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.