[multiple] Accept CA certificate if expired when CRC is used#3720
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
danpawlik
force-pushed
the
fix-molecule-reproducer
branch
from
6e845ff to
0ed017c
Compare
danpawlik
changed the title
danpawlik
force-pushed
the
fix-molecule-reproducer
branch
from
0ed017c to
b68f767
Compare
|
It seems all images are outdated. Waiting for infra team to replace images. |
|
recheck |
danpawlik
force-pushed
the
fix-molecule-reproducer
branch
2 times, most recently
from
8631fae to
d0c55c1
Compare
danpawlik
force-pushed
the
fix-molecule-reproducer
branch
2 times, most recently
from
466ec7e to
289154a
Compare
| ignore_errors: true # noqa: ignore-errors | ||
|
|
||
| - name: Login to the OpenShift when certificate is expired | ||
| when: "'Kubelet serving certificate has expired' in _crc_output.stderr" |
There was a problem hiding this comment.
(non-blocking) suggestion: I'd go by creating an above task that checks the previous _crc_output to fail with message:
msg: >-
CRC start failed with an unexpected error:
{{ _crc_output.stderr }}
if: _crc_output.rc != 0 AND "'Kubelet serving certificate has expired' not in _crc_output.stderr"
So if there's an error unrelated to certificates, this would fail with a clear message.
If the error is related to certificates the fail task wouldn't execute and then we go to the certificate recovery path.
There was a problem hiding this comment.
Its printing already
There was a problem hiding this comment.
If the crc start fails for some reason other than the cert issue we're expecting here, we still ignore whatever error that was because of ignore_errors in the above task, right? Is it safe to assume we can continue on to other tasks without manually failing like Enrique is suggesting? Or are we certain that this task (Login to the OpenShift when certificate is expired) will fail? If so, it could still save some time to manually fail early and avoid all of the retries, right?
There was a problem hiding this comment.
is this printing if the error is not related with expired certificate?
danpawlik
force-pushed
the
fix-molecule-reproducer
branch
from
289154a to
4a595fb
Compare
|
New changes are detected. LGTM label has been removed. |
It can happen that the image used by the CRC has expired certificate,
so it require to approve new generated certificate before making test.
The CRC log shows a log message:
level=info msg="Kubelet serving certificate has expired, waiting for automatic renewal... [will take up to 5 minutes]"
Failed to renew TLS certificates: please check if a newer CRC release is available:
Temporary error: certificate /var/lib/kubelet/pki/kubelet-server-current.pem still expired (x59)
Wait for the cluster to be stable when CA cert is expired.
Also move all crc command to single playbook, for easier
maintenance.
Signed-off-by: Daniel Pawlik <dpawlik@redhat.com>
danpawlik
force-pushed
the
fix-molecule-reproducer
branch
from
4a595fb to
252e5f5
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/551e59eab468480fa8193bba79402152 ❌ openstack-k8s-operators-content-provider FAILURE in 4m 56s |
|
recheck |
1 similar comment
|
recheck |
|
recheck |
|
recheck |
4 participants
It can happen that the image used by the CRC has expired certificate,
so it require to approve new generated certificate before making test.
The CRC log shows a log message:
Wait for the cluster to be stable when CA cert is expired.
Also move all crc command to single playbook, for easier
maintenance.