diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2018-02-06 07:40:55 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-02-06 07:40:55 -0800 |
| commit | d512d781be3530997522fb38ba29ee7f33eae5c8 (patch) | |
| tree | 6156269eceba0af6d9b434737cbb63940dd9b0af /playbooks/common/openshift-cluster | |
| parent | f048e7dec959cd3a0d10d007d1afaa62864172e0 (diff) | |
| parent | 43138470ca05806403bd9ad1b99e0e581307b191 (diff) | |
| download | openshift-d512d781be3530997522fb38ba29ee7f33eae5c8.tar.gz openshift-d512d781be3530997522fb38ba29ee7f33eae5c8.tar.bz2 openshift-d512d781be3530997522fb38ba29ee7f33eae5c8.tar.xz openshift-d512d781be3530997522fb38ba29ee7f33eae5c8.zip | |
Merge pull request #7018 from mtnbikenc/refactor-cert-SAN
Automatic merge from submit-queue.
Move cert SAN update logic to openshift-etcd
Recent additions for checking certificate SAN validation were added to the upgrade playbooks and should be moved to the openshift-etcd playbooks to ensure this check is performed when the openshift-etcd upgrade playbook is run directly, vice only when running a full control plane upgrade. Additionally, the formerly included playbook for redeploying certificates called the main entry point playbook which caused the initialization playbooks to be called twice.
Diffstat (limited to 'playbooks/common/openshift-cluster')
| -rw-r--r-- | playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml | 23 |
1 files changed, 0 insertions, 23 deletions
diff --git a/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml b/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml index 9b5ba3482..baec057f9 100644 --- a/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml +++ b/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml @@ -3,29 +3,6 @@ # Upgrade Masters ############################################################################### -# Prior to 3.6, openshift-ansible created etcd serving certificates -# without a SubjectAlternativeName entry for the system hostname. The -# SAN list in Go 1.8 is now (correctly) authoritative and since -# openshift-ansible configures masters to talk to etcd hostnames -# rather than IP addresses, we must correct etcd certificates. -# -# This play examines the etcd serving certificate SANs on each etcd -# host and records whether or not the system hostname is missing. -- name: Examine etcd serving certificate SAN - hosts: oo_etcd_to_config - tasks: - - slurp: - src: /etc/etcd/server.crt - register: etcd_serving_cert - - set_fact: - __etcd_cert_lacks_hostname: "{{ (openshift.common.hostname not in (etcd_serving_cert.content | b64decode | lib_utils_oo_parse_certificate_san)) | bool }}" - -# Redeploy etcd certificates when hostnames were missing from etcd -# serving certificate SANs. -- import_playbook: ../../../openshift-etcd/redeploy-certificates.yml - when: - - true in hostvars | lib_utils_oo_select_keys(groups['oo_etcd_to_config']) | lib_utils_oo_collect('__etcd_cert_lacks_hostname') | default([false]) - - name: Backup and upgrade etcd import_playbook: ../../../openshift-etcd/private/upgrade_main.yml |