show-certs.sh script checks the wrong file for etcd apiserver
client certificate. As a result, from user point of view,
the certificate seems not renewed. For “etcd apiserver client
certificate CERTIFICATE:” show-certs.sh checks
“/etc/etcd/apiserver-etcd-client.crt” which is not correct.
Instead it should check:
“/etc/kubernetes/pki/apiserver-etcd-client.crt”.
Test Plan:
PASS: Run /usr/bin/kube-cert-rotation.sh and check if etcd apiserver
client certificate were renewed.
Closes-Bug: 1986953
Signed-off-by: Karla Felix <email address hidden>
Change-Id: I1152ce3dea709b7f4b82ce4dd80f65a479d8badf
Reviewed: https:/ /review. opendev. org/c/starlingx /utilities/ +/853173 /opendev. org/starlingx/ utilities/ commit/ e64913011168d6b efe295f50924d31 5107af29cd
Committed: https:/
Submitter: "Zuul (22348)"
Branch: master
commit e64913011168d6b efe295f50924d31 5107af29cd
Author: Karla Felix <email address hidden>
Date: Mon Aug 15 11:07:28 2022 -0300
show-certs checks wrong etcd apiserver client certificate
show-certs.sh script checks the wrong file for etcd apiserver etcd/apiserver- etcd-client. crt” which is not correct. kubernetes/ pki/apiserver- etcd-client. crt”.
client certificate. As a result, from user point of view,
the certificate seems not renewed. For “etcd apiserver client
certificate CERTIFICATE:” show-certs.sh checks
“/etc/
Instead it should check:
“/etc/
Test Plan:
PASS: Run /usr/bin/ kube-cert- rotation. sh and check if etcd apiserver
client certificate were renewed.
Closes-Bug: 1986953 7f4b82ce4dd80f6 5a479d8badf
Signed-off-by: Karla Felix <email address hidden>
Change-Id: I1152ce3dea709b