This bugzilla is a next step of https://bugzilla.redhat.com/show_bug.cgi?id=2151002 The minimum key size for rhel-9 for rsa is 2048, we need to implement a method to enable replace the keys of all the node. Currently, the method used ssh_key_rotation.yaml [1] it works when there is only one stack. The current process allows to switch between key with the following command: ansible-playbook -i tripleo-stack-inventory.yaml ssh_key_rotation.yaml On the multi-cell environment, there are several inventory files so the playbook is launched for all the inventory files. However the playbook creates a new ssh key pair for every execution, so the connectivity with the first inventory is lost when the second one is executed. [1] https://github.com/openstack/tripleo-ansible/blob/stable/wallaby/tripleo_ansible/playbooks/ssh_key_rotation.yaml
As a workaround previous to the Undercloud Operative System upgrade: # This aims to keep the ssh connection from the undercloud to the hypervisor (CI - vbmc issue) if [ ! -f ~/.ssh/old/id_rsa ]; then mkdir ~/.ssh/old/ cp -a ~/.ssh/id_rsa ~/.ssh/old/ cp -a ~/.ssh/id_rsa.pub ~/.ssh/old/ cat <<'EOF' >> ~/.ssh/config Host 172.16.0.1 StrictHostKeyChecking no UserKnownHostsFile=/dev/null HostName 172.16.0.1 User root IdentityFile /home/stack/.ssh/old/id_rsa EOF fi # This creates one inventory with all the inventory files and use that inventory to do the ssh key rotation # this only works for overcloud with less than 10 stacks if [ ! -f all_inventory ]; then # Create local files for modifiactions touch all_inventory cp /usr/share/ansible/tripleo-playbooks/ssh_key_rotation.yaml /home/stack/ssh_key_rotation.yaml # Create one big single inventory file STACKS="" for i in `ls ~/overcloud-deploy/ | grep -v undercloud`; do STACKS="${STACKS},${i}_allovercloud" sed -e "s|id00|${i}_id00|g" -e "s|Undercloud|${i}Undercloud|g" -e "s|^allovercloud|${i}allovercloud|g" ~/overcloud-deploy/$i/tripleo-ansible-inventory.yaml >> all_inventory done # Modify the playbook to update all nodes on all overcloud stacks REPLACEMENT=`echo $STACKS | cut -c2-` sed -i -e "s|allovercloud|${REPLACEMENT}|g" /home/stack/ssh_key_rotation.yaml ansible-playbook -i all_inventory /home/stack/ssh_key_rotation.yaml fi
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days