Brief Description
-----------------
In DC system, created a new certificate on System controller, but the new certificate does not sync to subcloud.
Severity
--------
Major
Steps to Reproduce
------------------
On System Controller
openssl genrsa -out ca-key.pem 2048
openssl req -x509 -new -nodes -key ca-key.pem -days 1024 -out ca-cert.pem -outform PEM
openssl genrsa -out server-key.pem 2048
openssl req -new -key server-key.pem -out server.csr
openssl x509 -req -in server.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server.pem -days 365
vi extfile.cnf
openssl x509 -req -days 365 -in server.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server.pem -extfile extfile.cnf
cat server-key.pem server.pem > server-with-key.pem
system certificate-install -m docker_registry server-with-key.pem
TC-name:
Expected Behavior
------------------
new certificate sync to all in-sync subcloud
Actual Behavior
----------------
Reproducibility
---------------
Seen once
System Configuration
--------------------
Distributed Cloud system
Lab-name:
Branch/Pull Time/Commit
-----------------------
2019-11-02_08-39-54
Last Pass
---------
Timestamp/Logs
--------------
System Controller:
updated_at | 2019-11-03T02:56:47.674281 |
+-----------------------------+----------------------------+
[sysadmin@controller-0 ~(keystone_admin)]$ dcmanager subcloud list
+----+-----------+------------+--------------+---------------+---------+
| id | name | management | availability | deploy status | sync |
+----+-----------+------------+--------------+---------------+---------+
| 3 | subcloud6 | managed | online | complete | in-sync |
| 4 | subcloud5 | managed | online | complete | in-sync |
| 5 | subcloud1 | managed | online | complete | in-sync |
| 6 | subcloud4 | managed | online | complete | in-sync |
+----+-----------+------------+--------------+---------------+---------+
[sysadmin@controller-0 ~(keystone_admin)]$ fm alarm-list
[sysadmin@controller-0 ~(keystone_admin)]$ system certificate-install -m docker_registry server-with-key.pem
WARNING: For security reasons, the original certificate,
containing the private key, will be removed,
once the private key is processed.
+-------------+--------------------------------------+
| Property | Value |
+-------------+--------------------------------------+
| uuid | e8f82bd5-3271-4a8b-8a92-fd6c12ad1ab9 |
| certtype | docker_registry |
| signature | docker_registry_10786663268586284892 |
| start_date | 2019-11-03 03:13:57+00:00 |
| expiry_date | 2020-11-02 03:13:57+00:00 |
+-------------+--------------------------------------+
[sysadmin@controller-0 ~(keystone_admin)]$ system certificate-list
+--------------------------------------+------------+---------------------------+
| uuid | certtype | expiry_date |
+--------------------------------------+------------+---------------------------+
| 63d88610-3671-4bdd-9a72-40f66b73e4a3 | ssl_ca | 2021-06-05T20:28:20+00:00 |
| e8f82bd5-3271-4a8b-8a92-fd6c12ad1ab9 | docker_reg | 2020-11-02T03:13:57+00:00 |
| | istry | |
| | | |
+--------------------------------------+------------+---------------------------+
Subcloud6:
[sysadmin@controller-0 ~(keystone_admin)]$ system certificate-list
+--------------------------------------+----------+---------------------------+
| uuid | certtype | expiry_date |
+--------------------------------------+----------+---------------------------+
| 51cf6ee8-f161-4bd2-805b-247460bd5871 | ssl_ca | 2021-06-05T20:28:20+00:00 |
+--------------------------------------+----------+---------------------------+
[sysadmin@controller-0 ~(keystone_admin)]$ date
Mon Nov 4 15:03:27 UTC 2019
Test Activity
-------------
Sanity
@Andy, Are these certificates supposed to be sync'd to the subclouds?