Correct the steps for redeploying router certificates #13941

bysnupy · 2019-03-03T15:06:41Z

Fix: "redeploy-router-certificates.yml" makes changes to wrong "service serving certificate secrets" annotation
Version: v3.3 ~ v3.11
Description:
If your router installed initially with router-metrics-tls annotation in the router Service, router-metrics-tls secret should be service serving certificates secret. In contrast, router-certs secret is using as wild card certificates and not service serving certificates secret.

openshift-ci-robot · 2019-03-03T15:06:55Z

Hi @bysnupy. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

vikram-redhat · 2019-03-04T00:22:36Z

/ok-to-test

vikram-redhat · 2019-03-04T00:29:54Z

@stuartchuan - can you PTAL?

@huffmanca - FYI. If QE passes it, we should be ok to merge and CP.

lihongan · 2019-03-04T03:56:37Z

install_config/redeploying_certificates.adoc

... can be triggered to be recreated by removing annotations to the router service, deleting the secret and re-adding annotations to the router service, I think the secret should be deleted after removing the annotation, otherwise it will be recreated immediately.

Line 708: service.alpha.openshift.io/serving-cert-signed-by- this annotation should not be removed.

others LGTM, thanks

Thank you for your review and kind correction @lihongan,

You're right. I changed the sequence of the steps as you mentioned. (removing secret step is after removing annotation step)

And I think it had better to remove service.alpha.openshift.io/serving-cert-signed-by annotation at same time. The annotation also added automatically with the current OpenShift CA signer value, when it is added service.alpha.openshift.io/serving-cert-secret-name again. For example, if new CA is deployed before the router certs deploying work, it can cause not matching CA issue with new CA, because the service.alpha.openshift.io/serving-cert-signed-by's value is old or different with new CA signer value.

That make sense. Thank you @bysnupy

lihongan · 2019-03-04T11:19:18Z

/lgtm

lihongan · 2019-03-11T05:48:31Z

/assign vikram-redhat

vikram-redhat · 2019-03-11T09:10:04Z

@stuartchuan - can you confirm if this is ok from QE's point of view?

@xltian

stuartchuan · 2019-03-11T09:15:14Z

@vikram-redhat ,
@lihongan is the QE owner of this part, seems he had reviewed the changes and added lgtm label already.

vikram-redhat · 2019-03-11T10:15:17Z

Thanks @stuartchuan!

@huffmanca - can you please do a peer review and followup if needed?

bysnupy · 2019-04-03T13:38:12Z

Could you PTAL @lihongan ? "redeploy-router-certificates.yml" makes changes to wrong "service serving certificate secrets" annotation status has already been changed to VERIFIED, if some tasks are required, let me know that. thanks.

huffmanca

I sincerely apologize for the delays in submitting this review. Overall it looks good, just need to tweak two lines so that the numbering isn't broken from the text.

Once these changes are made I will merge and cherry-pick.

install_config/redeploying_certificates.adoc

"router-metrics-tls" secret should be service serving certificates secret. "router-certs" secret is using as wild card certificates and not service serving certificates secret. - Fix: https://bugzilla.redhat.com/show_bug.cgi?id=1672011

bysnupy · 2019-04-11T03:41:18Z

@huffmanca I've complete to fix it as mentioned from you. Could you PTAL again ?

huffmanca · 2019-04-11T14:14:42Z

@bysnupy,

Thanks for making these changes. It looks good to me!

huffmanca · 2019-04-11T14:21:12Z

/cherrypick enterprise-3.11

huffmanca · 2019-04-11T14:21:21Z

/cherrypick enterprise-3.10

openshift-cherrypick-robot · 2019-04-11T14:21:21Z

@huffmanca: new pull request created: #14419

Details

In response to this:

/cherrypick enterprise-3.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

huffmanca · 2019-04-11T14:21:29Z

/cherrypick enterprise-3.9

openshift-cherrypick-robot · 2019-04-11T14:21:30Z

@huffmanca: new pull request created: #14420

Details

In response to this:

/cherrypick enterprise-3.10

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-cherrypick-robot · 2019-04-11T14:21:36Z

@huffmanca: new pull request created: #14421

Details

In response to this:

/cherrypick enterprise-3.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

huffmanca · 2019-04-11T14:21:42Z

/cherrypick enterprise-3.7

openshift-cherrypick-robot · 2019-04-11T14:21:51Z

@huffmanca: new pull request created: #14422

Details

In response to this:

/cherrypick enterprise-3.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

huffmanca · 2019-04-11T14:21:52Z

/cherrypick enterprise-3.6

huffmanca · 2019-04-11T14:22:00Z

/cherrypick enterprise-3.5

openshift-cherrypick-robot · 2019-04-11T14:22:01Z

@huffmanca: new pull request created: #14423

Details

In response to this:

/cherrypick enterprise-3.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

huffmanca · 2019-04-11T14:22:06Z

/cherrypick enterprise-3.4

openshift-cherrypick-robot · 2019-04-11T14:22:07Z

@huffmanca: #13941 failed to apply on top of branch "enterprise-3.5":

error: Failed to merge in the changes.
Using index info to reconstruct a base tree...
M	install_config/redeploying_certificates.adoc
Falling back to patching base and 3-way merge...
Auto-merging install_config/redeploying_certificates.adoc
CONFLICT (content): Merge conflict in install_config/redeploying_certificates.adoc
Patch failed at 0001 Correct the steps for redeploying router certificates

Details

In response to this:

/cherrypick enterprise-3.5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

huffmanca · 2019-04-11T14:22:12Z

/cherrypick enterprise-3.3

openshift-cherrypick-robot · 2019-04-11T14:22:26Z

@huffmanca: #13941 failed to apply on top of branch "enterprise-3.4":

error: Failed to merge in the changes.
Using index info to reconstruct a base tree...
M	install_config/redeploying_certificates.adoc
Falling back to patching base and 3-way merge...
Auto-merging install_config/redeploying_certificates.adoc
CONFLICT (content): Merge conflict in install_config/redeploying_certificates.adoc
Patch failed at 0001 Correct the steps for redeploying router certificates

Details

In response to this:

/cherrypick enterprise-3.4

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-cherrypick-robot · 2019-04-11T14:22:32Z

@huffmanca: #13941 failed to apply on top of branch "enterprise-3.3":

error: Failed to merge in the changes.
Using index info to reconstruct a base tree...
M	install_config/redeploying_certificates.adoc
Falling back to patching base and 3-way merge...
Auto-merging install_config/redeploying_certificates.adoc
CONFLICT (content): Merge conflict in install_config/redeploying_certificates.adoc
Patch failed at 0001 Correct the steps for redeploying router certificates

Details

In response to this:

/cherrypick enterprise-3.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

huffmanca · 2019-04-11T17:02:32Z

As the 3.5 through 3.3 cherry-picks failed, these have been manually included under:

#14430
#14431
#14432

openshift-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 3, 2019

openshift-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 4, 2019

vikram-redhat added branch/enterprise-3.3 branch/enterprise-3.4 branch/enterprise-3.5 branch/enterprise-3.6 branch/enterprise-3.7 branch/enterprise-3.9 branch/enterprise-3.10 branch/enterprise-3.11 labels Mar 4, 2019

vikram-redhat added this to the Next Release milestone Mar 4, 2019

lihongan reviewed Mar 4, 2019

View reviewed changes

bysnupy force-pushed the patch-20 branch from 10180a2 to 62a78d7 Compare March 4, 2019 07:11

openshift-ci-robot assigned lihongan Mar 4, 2019

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 4, 2019

openshift-ci-robot assigned vikram-redhat Mar 11, 2019

huffmanca suggested changes Apr 10, 2019

View reviewed changes

install_config/redeploying_certificates.adoc Outdated Show resolved Hide resolved

install_config/redeploying_certificates.adoc Outdated Show resolved Hide resolved

bysnupy force-pushed the patch-20 branch from 62a78d7 to 3590591 Compare April 11, 2019 03:33

openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label Apr 11, 2019

bysnupy force-pushed the patch-20 branch from 3590591 to 30c25d0 Compare April 11, 2019 03:35

huffmanca approved these changes Apr 11, 2019

View reviewed changes

huffmanca added the peer-review-done Signifies that the peer review team has reviewed this PR label Apr 11, 2019

huffmanca merged commit 4b15329 into openshift:master Apr 11, 2019

openshift-cherrypick-robot mentioned this pull request Apr 11, 2019

[enterprise-3.11] Correct the steps for redeploying router certificates #14419

Merged

openshift-cherrypick-robot mentioned this pull request Apr 11, 2019

[enterprise-3.10] Correct the steps for redeploying router certificates #14420

Merged

openshift-cherrypick-robot mentioned this pull request Apr 11, 2019

[enterprise-3.9] Correct the steps for redeploying router certificates #14421

Merged

openshift-cherrypick-robot mentioned this pull request Apr 11, 2019

[enterprise-3.7] Correct the steps for redeploying router certificates #14422

Merged

openshift-cherrypick-robot mentioned this pull request Apr 11, 2019

[enterprise-3.6] Correct the steps for redeploying router certificates #14423

Merged

huffmanca mentioned this pull request Apr 11, 2019

Correct the steps for redeploying router certificates #14430

Merged

Correct the steps for redeploying router certificates #13941

Correct the steps for redeploying router certificates #13941

Uh oh!

Conversation

bysnupy commented Mar 3, 2019

Uh oh!

openshift-ci-robot commented Mar 3, 2019

Uh oh!

vikram-redhat commented Mar 4, 2019

Uh oh!

vikram-redhat commented Mar 4, 2019

Uh oh!

lihongan Mar 4, 2019

Choose a reason for hiding this comment

Uh oh!

lihongan Mar 4, 2019

Choose a reason for hiding this comment

Uh oh!

lihongan Mar 4, 2019

Choose a reason for hiding this comment

Uh oh!

bysnupy Mar 4, 2019

Choose a reason for hiding this comment

Uh oh!

lihongan Mar 4, 2019

Choose a reason for hiding this comment

Uh oh!

lihongan commented Mar 4, 2019

Uh oh!

lihongan commented Mar 11, 2019

Uh oh!

vikram-redhat commented Mar 11, 2019

Uh oh!

stuartchuan commented Mar 11, 2019

Uh oh!

vikram-redhat commented Mar 11, 2019

Uh oh!

bysnupy commented Apr 3, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

huffmanca left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bysnupy commented Apr 11, 2019

Uh oh!

huffmanca commented Apr 11, 2019

Uh oh!

huffmanca commented Apr 11, 2019

Uh oh!

huffmanca commented Apr 11, 2019

Uh oh!

openshift-cherrypick-robot commented Apr 11, 2019

Uh oh!

huffmanca commented Apr 11, 2019

Uh oh!

openshift-cherrypick-robot commented Apr 11, 2019

Uh oh!

openshift-cherrypick-robot commented Apr 11, 2019

Uh oh!

huffmanca commented Apr 11, 2019

Uh oh!

openshift-cherrypick-robot commented Apr 11, 2019

Uh oh!

huffmanca commented Apr 11, 2019

Uh oh!

huffmanca commented Apr 11, 2019

Uh oh!

openshift-cherrypick-robot commented Apr 11, 2019

Uh oh!

huffmanca commented Apr 11, 2019

Uh oh!

openshift-cherrypick-robot commented Apr 11, 2019

Uh oh!

huffmanca commented Apr 11, 2019

Uh oh!

openshift-cherrypick-robot commented Apr 11, 2019

Uh oh!

openshift-cherrypick-robot commented Apr 11, 2019

bysnupy commented Apr 3, 2019 •

edited

Loading