openshift / openshift-ansible / 8644

51%

push

travis-ci

Merge pull request #5495 from abutcher/ca-redeploy-expired-etcd

Automatic merge from submit-queue

Improve CA redeploy restart logic

Expired etcd certificates require special casing around restarts in the certificate redeploy playbooks. When etcd certificates are expired we can't restart masters or nodes. We also can't simply restart etcd because peers also had expired certificates so we must start/stop etcd when we detect expired etcd certificates.

`openshift-ca.yml`:
* No longer restart master services when etcd certificates were previously expired.
* No longer restart node services when master or etcd certificates were previously expired.

`etcd-ca.yml`:
* No longer restart master services when etcd certificates were previously expired.

Tested using [gen_expired_tls.sh](https://gist.github.com/abutcher/bdd20b9d582675d89fb22658689c49e4) on one of my master/etcd hosts to ensure that restart logic changes caused us to skip the right restarts and do a full start/stop of etcd in the `redeploy-certificates.yml` and `redeploy-etcd-certificates.yml` playbooks.

Note: When this happens with a cluster and you want to replace all certificates, you can run: `redeploy-etcd-ca.yml`, `redeploy-openshift-ca.yml` (which will both skip restarts) and then run `redeploy-certificates.yml` which will now be able to full/stop start etcd.

2302 of 5806 branches covered (39.65%)

7342 of 13401 relevant lines covered (54.79%)

1.09 hits per line