append kube-ca to root-ca for mco config

[mrogers950]

For openshift/installer#1179 it's necessary to include the now self-signed kube-ca in the /etc/kubernetes/ca.crt file for kubelets, since the PR makes root-ca no longer a valid trust anchor for the API server certs. I think this is the correct spot to modify to change /etc/kubernetes/ca.crt, and I'm opting to append it rather than replace the root CA for now to make sure nothing else breaks. (There might be a different configmap that it would be better to grab kube-ca from.)
/cc @abhinavdahiya @deads2k @openshift/sig-auth

[abhinavdahiya]

You need to make sure that the operator/bootstrap.go does the same thing

[mrogers950]

@abhinavdahiya thanks, updated.

[mrogers950]

Got level=fatal msg="failed to initialize the cluster: Cluster operator machine-config is reporting a failure: Failed when progressing towards 3.11.0-623-gddfed948-dirty because: error syncing: timed out waiting for the condition during syncRequiredMachineConfigPools: error pool master is not ready. status: (total: 3, updated: 0, unavailable: 1)"
/retest

[cgwalters]

Got level=fatal msg="failed to initialize the cluster: Cluster operator machine-config is reporting a failure: Failed when progressing towards 3.11.0-623-gddfed948-dirty because: error syncing: timed out waiting for the condition during syncRequiredMachineConfigPools: error pool master is not ready. status: (total: 3, updated: 0, unavailable: 1)"

To debug that you usually want to look at the MCO logs from the pods. In this case looking at the MCC:

I0213 17:56:21.316874       1 render_controller.go:456] Generated machineconfig worker-f294327daacaedeea90cc9974bfc4f49 from 1 configs: [{MachineConfig  00-worker  machineconfiguration.openshift.io/v1  }]
I0213 17:56:21.317364       1 node_controller.go:345] Error syncing machineconfigpool worker: Empty Current MachineConfig
I0213 17:56:22.016392       1 node_controller.go:345] Error syncing machineconfigpool master: Empty Current MachineConfig
I0213 17:56:22.016553       1 render_controller.go:456] Generated machineconfig master-5243f3f3e45c6b04c0aa66b1c7f8ef32 from 2 configs: [{MachineConfig  00-master  machineconfiguration.openshift.io/v1  } {MachineConfig  00-master-ssh  machineconfiguration.openshift.io/v1  }]
I0213 17:56:26.517010       1 render_controller.go:456] Generated machineconfig worker-03ca778b37ae53fefac69033297cf86e from 3 configs: [{MachineConfig  00-worker  machineconfiguration.openshift.io/v1  } {MachineConfig  00-worker-ssh  machineconfiguration.openshift.io/v1  } {MachineConfig  01-worker-kubelet  machineconfiguration.openshift.io/v1  }]
I0213 17:56:27.016572       1 render_controller.go:456] Generated machineconfig master-52aab5b37d42ba01e94273a35d68c09b from 3 configs: [{MachineConfig  00-master  machineconfiguration.openshift.io/v1  } {MachineConfig  00-master-ssh  machineconfiguration.openshift.io/v1  } {MachineConfig  01-master-kubelet  machineconfiguration.openshift.io/v1  }]

Looks like this hit #338

[ashcrow]

/retest

[runcom]

needs a rebase

[mrogers950]

/retest

[cgwalters]

TESTING: set kube-ca default to current kube-ca path

Yes, that's what you need to do for now. Squash that into the previous commit, then land this - then you can update the installer to pass it as an argument, and then finally remove the default here.

We've done this multiple times now for MCO/installer interlocking issues.

[mrogers950]

@cgwalters I've squashed the commits, and testing looks good. PTAL.

[cgwalters]

/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cgwalters, mrogers950

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [cgwalters]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[runcom]

/retest

[openshift-bot]

/retest

Please review the full test history for this PR and help us cut down flakes.

[openshift-bot]

/retest

Please review the full test history for this PR and help us cut down flakes.