show-certs.sh checks wrong etcd apiserver client certificate
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
StarlingX |
Fix Released
|
Medium
|
Karla Felix |
Bug Description
Brief Description
show-certs.sh script check wrong certification. As a result, from user point of view, certification seem not renewed.
For “etcd apiserver client certificate CERTIFICATE:” show-certs.sh checks “/etc/etcd/
Intead of this it should check “/etc/kubernete
Because certificaiton renewal script /usr/bin/
As a result even “etcd apiserver client certificate CERTIFICATE:” was renewed, user cannot check its renewal.
Severity
<Major: System/Feature is usable but degraded>
Issue itself is harmless, but user cannot get correct information.
Steps to Reproduce
1: Follow the steps and create certificate for “etcd apiserver client certificate CERTIFICATE:" which will expire soon.
2: Run show-certs.sh then check certification will be expired soon.
etcd apiserver client certificate CERTIFICATE:
-------
Renewal : Manual
Filename : /etc/etcd/
Subject : /CN=apiserver-
Issuer : /CN=etcd
Issue Date : Aug 5 15:00:00 2021 GMT
Expiry Date : Aug 5 15:00:00 2022 GMT
Residual Time : 1d
2: Run /usr/bin/
3: Run show-certs.sh again. But /etc/etcd/
Expected Behavior
show-certs.sh checks /etc/kubernetes
Actual Behavior
show-certs.sh checks /etc/etcd/
Reproducibility
Reproducible
System Configuration
Any
Load info (eg: 2022-03-
N/A
Last Pass
N/A
Timestamp/Logs
N/A
Alarms
No alarms
Test Activity
N/A
Workaround
Modify show-certs.sh as attached or check /etc/kubernetes
Changed in starlingx: | |
assignee: | nobody → Karla Felix (kkarolin) |
Changed in starlingx: | |
status: | New → In Progress |
Changed in starlingx: | |
importance: | Undecided → Medium |
tags: | added: stx.8.0 stx.security |
Reviewed: https:/ /review. opendev. org/c/starlingx /utilities/ +/853173 /opendev. org/starlingx/ utilities/ commit/ e64913011168d6b efe295f50924d31 5107af29cd
Committed: https:/
Submitter: "Zuul (22348)"
Branch: master
commit e64913011168d6b efe295f50924d31 5107af29cd
Author: Karla Felix <email address hidden>
Date: Mon Aug 15 11:07:28 2022 -0300
show-certs checks wrong etcd apiserver client certificate
show-certs.sh script checks the wrong file for etcd apiserver etcd/apiserver- etcd-client. crt” which is not correct. kubernetes/ pki/apiserver- etcd-client. crt”.
client certificate. As a result, from user point of view,
the certificate seems not renewed. For “etcd apiserver client
certificate CERTIFICATE:” show-certs.sh checks
“/etc/
Instead it should check:
“/etc/
Test Plan:
PASS: Run /usr/bin/ kube-cert- rotation. sh and check if etcd apiserver
client certificate were renewed.
Closes-Bug: 1986953 7f4b82ce4dd80f6 5a479d8badf
Signed-off-by: Karla Felix <email address hidden>
Change-Id: I1152ce3dea709b