From 6177d4d88fa4640b21e338504a149701b9878fc5 Mon Sep 17 00:00:00 2001
From: Michael Burke <mburke@redhat.com>
Date: Tue, 13 Feb 2018 17:15:32 -0500
Subject: [PATCH] [enterprise-3-7] Note on using the Administrative Commands

---
 cli_reference/admin_cli_operations.adoc             |  5 +++++
 getting_started/configure_openshift.adoc            |  6 ++++++
 getting_started/install_openshift.adoc              |  2 ++
 .../sssd_for_ldap_failover.adoc                     |  3 +++
 install_config/configuring_authentication.adoc      | 11 ++++++++++-
 install_config/master_node_configuration.adoc       |  7 +++++--
 install_config/redeploying_certificates.adoc        |  3 +++
 .../registry/securing_and_exposing_registry.adoc    |  8 +++++---
 install_config/revhistory_install_config.adoc       | 13 +++++++++++++
 install_config/router/default_haproxy_router.adoc   |  3 +++
 .../administrators/system_configuration.adoc        |  3 +++
 welcome/revhistory_full.adoc                        |  4 ++++
 12 files changed, 62 insertions(+), 6 deletions(-)

diff --git a/cli_reference/admin_cli_operations.adoc b/cli_reference/admin_cli_operations.adoc
index 84159e2b6d02..3bc4d01fe00f 100644
--- a/cli_reference/admin_cli_operations.adoc
+++ b/cli_reference/admin_cli_operations.adoc
@@ -56,6 +56,11 @@ This specifies:
 - An available `<option>` to perform the action on as well as a value for the
 option. Options include `--output`.
 
+[IMPORTANT]
+====
+include::getting_started/configure_openshift.adoc[tag=ocadm-note]
+====
+
 [[basic-admin-cli-operations]]
 
 == Basic CLI Operations
diff --git a/getting_started/configure_openshift.adoc b/getting_started/configure_openshift.adoc
index 6655f4b55fbd..92aa6afc46ff 100644
--- a/getting_started/configure_openshift.adoc
+++ b/getting_started/configure_openshift.adoc
@@ -84,6 +84,12 @@ everything.
 ----
 oc adm policy add-cluster-role-to-user cluster-admin admin
 ----
++
+// tag::ocadm-note[]
+When running `oc adm` commands, you should run them only from 
+the first master listed in the Ansible host inventory file,
+by default *_/etc/ansible/hosts_*.
+// end::ocadm-note[]
 
 . You can use this username/password combination to log in via the web
 console or the command line. To test this, run the following command.
diff --git a/getting_started/install_openshift.adoc b/getting_started/install_openshift.adoc
index abea142d8358..2e76eff2c2e4 100644
--- a/getting_started/install_openshift.adoc
+++ b/getting_started/install_openshift.adoc
@@ -195,6 +195,8 @@ basic authentication, user access, and routes.
 
 * `oc`: for normal project and application management
 * `oc adm`: for administrative tasks
++
+include::getting_started/configure_openshift.adoc[tag=ocadm-note]
 
 Use `oc --help` and `oc adm --help` to view all available options.
 
diff --git a/install_config/advanced_ldap_configuration/sssd_for_ldap_failover.adoc b/install_config/advanced_ldap_configuration/sssd_for_ldap_failover.adoc
index 45770e29deb4..67fa957881a0 100644
--- a/install_config/advanced_ldap_configuration/sssd_for_ldap_failover.adoc
+++ b/install_config/advanced_ldap_configuration/sssd_for_ldap_failover.adoc
@@ -67,6 +67,9 @@ in this topic they are kept separate.
 [[sssd-phase-1-certificate-generation]]
 == Phase 1: Certificate Generation
 
+Perform this procedure on the first master host listed in the Ansible host inventory file,
+by default *_/etc/ansible/hosts_*.
+
 . To ensure that communication between the authenticating proxy and
 {product-title} is trustworthy, create a set of Transport Layer Security (TLS)
 certificates to use during the other phases of this setup. In the
diff --git a/install_config/configuring_authentication.adoc b/install_config/configuring_authentication.adoc
index b12392d88b59..55009bfe2e37 100644
--- a/install_config/configuring_authentication.adoc
+++ b/install_config/configuring_authentication.adoc
@@ -28,7 +28,7 @@ xref:../install_config/install/advanced_install.adoc#configuring-cluster-variabl
 
 [NOTE]
 ====
-{product-title} user names containing `/`, `:`, and `%` are not supported. 
+{product-title} user names containing `/`, `:`, and `%` are not supported.
 ====
 
 If you installed {product-title} using
@@ -865,11 +865,16 @@ xref:requestheader-master-ca-config[master's identity provider configuration].
 ----
 
 [NOTE]
+====
 The `oc adm ca create-signer-cert` command generates a certificate that is valid
 for five years. This can be altered with the `--expire-days` option, but for
 security reasons, it is recommended to not make it greater than this
 value.
 
+Run `oc adm` commands only from the first master listed in the Ansible host inventory file,
+by default *_/etc/ansible/hosts_*.
+====
+
 Generate a client certificate for the proxy. This can be done using any x509
 certificate tooling. For convenience, the `oc adm` CLI can be used:
 
@@ -902,10 +907,14 @@ that is specified for `*SSLCertificateFile*`. If a new certificate needs to be
 created, the `oc adm ca create-server-cert` command can be used.
 
 [NOTE]
+====
 The `oc adm create-api-client-config` command generates a certificate that is
 valid for two years. This can be altered with the `--expire-days` option, but
 for security reasons, it is recommended to not make it greater than
 this value.
+Run `oc adm` commands only from the first master listed in the Ansible host inventory file,
+by default *_/etc/ansible/hosts_*.
+====
 
 *Configuring Apache*
 
diff --git a/install_config/master_node_configuration.adoc b/install_config/master_node_configuration.adoc
index 401d3490706c..6a306726cc62 100644
--- a/install_config/master_node_configuration.adoc
+++ b/install_config/master_node_configuration.adoc
@@ -1116,6 +1116,9 @@ $ oc adm ca encrypt --genkey=bindPassword.key --out=bindPassword.encrypted
 > Data to encrypt: B1ndPass0rd!
 ----
 
+Run `oc adm` commands only from the first master listed in the Ansible host inventory file,
+by default *_/etc/ansible/hosts_*.
+
 [WARNING]
 ====
 Encrypted data is only as secure as the decrypting key. Care should be taken
@@ -1282,7 +1285,7 @@ The following examples are excerpts from a master *journald* log at various log
 4897 plugins.go:77] Registered admission plugin "NamespaceLifecycle"
 4897 start_master.go:290] Warning: assetConfig.loggingPublicURL: Invalid value: "": required to view aggregated container logs in the console, master start will continue.
 4897 start_master.go:290] Warning: assetConfig.metricsPublicURL: Invalid value: "": required to view cluster metrics in the console, master start will continue.
-4897 start_master.go:290] Warning: aggregatorConfig.proxyClientInfo: Invalid value: "": if no client certificate is specified, the aggregator will be unable to proxy to remote servers, 
+4897 start_master.go:290] Warning: aggregatorConfig.proxyClientInfo: Invalid value: "": if no client certificate is specified, the aggregator will be unable to proxy to remote servers,
 4897 start_master.go:412] Starting controllers on 0.0.0.0:8444 (v3.7.14)
 4897 start_master.go:416] Using images from "openshift3/ose-<component>:v3.7.14"
 4897 standalone_apiserver.go:106] Started health checks at 0.0.0.0:8444
@@ -1292,7 +1295,7 @@ The following examples are excerpts from a master *journald* log at various log
 4897 leaderelection.go:179] attempting to acquire leader lease...
 systemd[1]: Started Atomic OpenShift Master Controllers.
 4897 leaderelection.go:189] successfully acquired lease kube-system/openshift-master-controllers
-4897 event.go:218] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"kube-system", Name:"openshift-master-controllers", UID:"aca86731-ffbe-11e7-8d33-525400c845a8", APIVersion:"v1", 
+4897 event.go:218] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"kube-system", Name:"openshift-master-controllers", UID:"aca86731-ffbe-11e7-8d33-525400c845a8", APIVersion:"v1",
 4897 start_master.go:627] Started serviceaccount-token controller
 4897 factory.go:351] Creating scheduler from configuration: {{ } [{NoVolumeZoneConflict <nil>} {MaxEBSVolumeCount <nil>} {MaxGCEPDVolumeCount <nil>} {MaxAzureDiskVolumeCount <nil>} {Mat
 4897 factory.go:360] Registering predicate: NoVolumeZoneConflict
diff --git a/install_config/redeploying_certificates.adoc b/install_config/redeploying_certificates.adoc
index 22a5e46105af..2d99e6d8fde4 100644
--- a/install_config/redeploying_certificates.adoc
+++ b/install_config/redeploying_certificates.adoc
@@ -538,6 +538,9 @@ $ oc adm ca create-server-cert \
     --key=/etc/origin/master/registry.key \
     --signer-serial=/etc/origin/master/ca.serial.txt
 ----
++
+Run `oc adm` commands only from the first master listed in the Ansible host inventory file,
+by default *_/etc/ansible/hosts_*.
 
 . Update the `registry-certificates` secret with the new registry certificates:
 +
diff --git a/install_config/registry/securing_and_exposing_registry.adoc b/install_config/registry/securing_and_exposing_registry.adoc
index 429810c744ef..27b63bcb8622 100644
--- a/install_config/registry/securing_and_exposing_registry.adoc
+++ b/install_config/registry/securing_and_exposing_registry.adoc
@@ -50,7 +50,9 @@ docker-registry   docker-registry=default                   docker-registry=defa
 . You can use an existing server certificate, or create a key and server
 certificate valid for specified IPs and host names, signed by a specified CA. To
 create a server certificate for the registry service IP and the
-*docker-registry.default.svc.cluster.local* host name:
+*docker-registry.default.svc.cluster.local* host name,
+run the following command from the first master listed in the Ansible host inventory file,
+by default *_/etc/ansible/hosts_*:
 +
 ----
 $ oc adm ca create-server-cert \
@@ -105,7 +107,7 @@ to `false` (the default setting) in the master configuration file, linking
 secrets to a service is not required.
 ====
 +
-. Pause the `docker-registry` service: 
+. Pause the `docker-registry` service:
 +
 ----
 $ oc rollout pause dc/docker-registry
@@ -156,7 +158,7 @@ $ oc patch dc/docker-registry -p '{"spec": {"template": {"spec": {"containers":[
   }]}}}}'
 ----
 +
-. Resume the `docker-registry` service: 
+. Resume the `docker-registry` service:
 +
 ----
 $ oc rollout resume dc/docker-registry
diff --git a/install_config/revhistory_install_config.adoc b/install_config/revhistory_install_config.adoc
index ccc7e8409972..b2d440df58f5 100644
--- a/install_config/revhistory_install_config.adoc
+++ b/install_config/revhistory_install_config.adoc
@@ -8,6 +8,19 @@
 
 // do-release: revhist-tables
 
+== Mon Feb 26 2018
+
+// tag::install_config_mon_feb_26_2018[]
+[cols="1,3",options="header"]
+|===
+
+|Affected Topic |Description of Change
+//Mon Feb 26 2018
+|xref:../install_config/index.adoc#install-config-index[Installation and Configuration]
+|Added information in multiple locations to use `oc adm ca` commands from the first master only.
+
+|===
+
 == Fri Feb 23 2018
 
 // tag::install_config_fri_feb_23_2018[]
diff --git a/install_config/router/default_haproxy_router.adoc b/install_config/router/default_haproxy_router.adoc
index 79f348071e24..cfd5554c98e1 100644
--- a/install_config/router/default_haproxy_router.adoc
+++ b/install_config/router/default_haproxy_router.adoc
@@ -954,6 +954,9 @@ $ oc adm ca create-server-cert --signer-cert=$CA/ca.crt \
 The `oc adm ca create-server-cert` command generates a certificate that is valid
 for two years. This can be altered with the `--expire-days` option, but for
 security reasons, it is recommended to not make it greater than this value.
+
+Run `oc adm` commands only from the first master listed in the Ansible host inventory file,
+by default *_/etc/ansible/hosts_*.
 ====
 
 The router expects the certificate and key to be in PEM format in a single
diff --git a/registry_quickstart/administrators/system_configuration.adoc b/registry_quickstart/administrators/system_configuration.adoc
index ae389d487141..e927389645c4 100644
--- a/registry_quickstart/administrators/system_configuration.adoc
+++ b/registry_quickstart/administrators/system_configuration.adoc
@@ -118,6 +118,9 @@ Here we create a self-signed certificate so docker clients can connect using
 TLS. While other tools like openssl may be used to create certificates, the
 master API provides a tool that may also be used.
 
+Execute the following commands from the first master listed in the Ansible host inventory file,
+by default *_/etc/ansible/hosts_*:
+
 . Exec into the atomic-registry-master container to access the CLI and change directory
 +
 ----
diff --git a/welcome/revhistory_full.adoc b/welcome/revhistory_full.adoc
index 3e39cd4f5ff0..2932f15e0133 100644
--- a/welcome/revhistory_full.adoc
+++ b/welcome/revhistory_full.adoc
@@ -11,6 +11,10 @@ date.
 
 // do-release: revhist-tables
 
+== Mon Feb 26 2018
+.Installation and Configuration
+include::install_config/revhistory_install_config.adoc[tag=install_config_mon_feb_26_2018]
+
 == Fri Feb 23 2018
 .Installation and Configuration
 include::install_config/revhistory_install_config.adoc[tag=install_config_fri_feb_23_2018]