Crc: Retrigger certificate rotation/generation for internal cluster communication

[gbraad]

Blocked by; https://github.com/openshift/api/pull/199

At the moment, this renders the cluster install useless for distribution, as the expired certificates prevent communication.

[gbraad]

The development/test window of 2h Validness/Refresh has been changed to a new default with https://github.com/openshift/cluster-kube-apiserver-operator/pull/338. Still waiting for more information about reprovisioning of certificates when the API server is unreachable/certificates are expired.

[gbraad]

According to feedback on https://bugzilla.redhat.com/show_bug.cgi?id=1694079 work can be tracked in the folloiwng PR: https://github.com/openshift/cluster-kube-apiserver-operator/pull/444

[anjannath]

As mentioned by @sspeiche in the mail thread, now there's a proposal to automate the steps of certificate recovery: https://github.com/openshift/enhancements/pull/1

[gbraad]

Interesting comment in the proposal:
https://github.com/openshift/enhancements/pull/1/files#diff-0c95263e1bf132f7346ccef277aec7fcR122

This process can be run by a laborious and error prone manual process that three existent teams have already had trouble with.

[gbraad]

@derekwaynecarr suggested to describe our requirements as part of the OpenShift enhancement process.

[gbraad]

A new issue has been created for the issue with 4.2 as a single node cluster: https://bugzilla.redhat.com/show_bug.cgi?id=1760181

[cfergeau]

Since OpenShift 4.1.16, this should be working. It's documented at https://docs.openshift.com/container-platform/latest/backup_and_restore/disaster_recovery/scenario-3-expired-certs.html and https://github.com/openshift/openshift-docs/blob/master/modules/dr-recover-expired-control-plane-certs.adoc
I've had success with a 4.2.0.rc bundle, and https://gist.github.com/cfergeau/fc4ac5379a120dad1381e8ba1fc4789d
Now this needs to be integrated in crc...

[gbraad]

@cfergeau can this be tested and verified by others?

[cfergeau]

@cfergeau can this be tested and verified by others?

The script is linux-only (hardcoded IP), but apart from this, yes, hopefully this should work on other people's machines.

[morningspace]

@cfergeau @gbraad Just noticed this issue has been closed, does it mean the cert expiration issue happened w/ CRC has gone? If that's the case, does it mean we can stay at a certain OpenShift version, instead of keeping upgrading CRC monthly?

[gbraad]

This will only work with the latest releases.