Repository: openshift/openshift-ansible

Issue:
Add all resolveable DNS names to api server cert
Include all the DNS names that can resolve to the OpenShift/Kubernetes services:

{openshift,kubernetes}[.default[.svc[.cluster.local]]]

See https://github.com/openshift/origin/pull/3985 for the origin change



Discussion:
We also need to document in our upgrade notes that various parts of the infrastructure now expect these to work and existing installs likely need updated master server certs to include the added names. Even better if there's an ansible upgrade process that can do this for you; but that can only work if we have access to the CA key -- any customers that supplied their own certs would still need to know to do this.

@sosiouxme that is kind of easy since we do not document that for users yet...  So any users that have supplied their own certificates have already been through the painful process of creating the certs manually, distributing them and then updating the necessary configs.

@sdodson I think @sosiouxme hit on a good point that we should handle upgrading these certs for users as part of the upgrade.  We'll most likely want to check the cert (probably by calling out to openssl) to see if it is signed by the CA cert on the first master...  If it is, then we can most likely safely regenerate it for them using the all_hostnames fact from openshift_facts (which will need to be augmented with the above names).

I think it's only the master cert that needs updating, so there wouldn't be any config changes and the only distribution would be to any other masters. For those who self-created certs, I think it would be enough to note this in the release notes. For those using the default OpenShift CA, would be nice to do it for them.

For this, yes, just the master serving cert. for the related nodeIP addition, it's the node serving certs as well

@liggitt Just so I'm clear, `{openshift,kubernetes}[.default[.svc[.cluster.local]]]` would mean all of the following need to be added to the master's cert?
- openshift.default
- openshift.default.svc
- openshift.default.svc.cluster.local
- kubernetes.default
- kubernetes.default.svc
- kubernetes.default.svc.cluster.local

Related #586 

Along with just `openshift` and `kubernetes`

Does ansible allow configuring the cluster suffix? (.cluster.local?)

Not currently, though it looks like it'd be pretty easy to get that in place, though in which scenarios do you think people would change that? If `.cluster.local` were a conflict with their existing DNS infrastructure?


Resolving patch:
diff --git a/roles/openshift_facts/library/openshift_facts.py b/roles/openshift_facts/library/openshift_facts.py
--- a/roles/openshift_facts/library/openshift_facts.py
+++ b/roles/openshift_facts/library/openshift_facts.py
@@ -22,6 +22,7 @@
 import os
 from distutils.util import strtobool
 from distutils.version import LooseVersion
+from netaddr import IPNetwork
 
 
 def hostname_valid(hostname):
@@ -486,12 +487,21 @@ def set_aggregate_facts(facts):
     if 'common' in facts:
         all_hostnames.add(facts['common']['hostname'])
         all_hostnames.add(facts['common']['public_hostname'])
+        all_hostnames.add(facts['common']['ip'])
+        all_hostnames.add(facts['common']['public_ip'])
 
         if 'master' in facts:
+            # FIXME: not sure why but facts['dns']['domain'] fails
+            cluster_domain = 'cluster.local'
             if 'cluster_hostname' in facts['master']:
                 all_hostnames.add(facts['master']['cluster_hostname'])
             if 'cluster_public_hostname' in facts['master']:
                 all_hostnames.add(facts['master']['cluster_public_hostname'])
+            all_hostnames.update(['openshift', 'openshift.default', 'openshift.default.svc',
+                                  'openshift.default.svc.' + cluster_domain, 'kubernetes', 'kubernetes.default',
+                                  'kubernetes.default.svc', 'kubernetes.default.svc.' + cluster_domain])
+            first_svc_ip = str(IPNetwork(facts['master']['portal_net'])[1])
+            all_hostnames.add(first_svc_ip)
 
         facts['common']['all_hostnames'] = list(all_hostnames)
 


Test patch: