Repository: openshift/openshift-ansible

Issue:
router cert is invalid for the openshift_master_default_subdomain
#### Description
The router cert is created with
```
subject=/CN=router.default.svc
```
This means it is invalid for any reasonable use. I would expect it to have

##### Version
```
ansible-2.2.0.0-1.el7.noarch
atomic-openshift-utils-3.4.44-1.git.0.efa61c6.el7.noarch
openshift-ansible-3.4.44-1.git.0.efa61c6.el7.noarch
```

##### Steps To Reproduce


##### Expected Results
I would expect the cert to be generated for
```
subject=/CN=*.{{ openshift_master_default_subdomain }}
```

##### Additional Information
* Your inventory file (especially any non-standard configuration parameters)

```
[OSEv3:children]
masters
nodes

[OSEv3:vars]
deployment_type=openshift-enterprise
ansible_ssh_user=cloud-user
ansible_sudo=true
ansible_sudo_user=root
openshift_use_manageiq=True
#use_cluster_metrics=true


# Metrics
openshift_hosted_metrics_deploy=true
openshift_hosted_metrics_deployer_prefix=brew-pulp-docker01.somwhere.at.redhat.com:8888/openshift3/
openshift_master_default_subdomain=apps.09b07.somewhere.at.redhat.com

openshift_additional_repos=[{'id': 'ose', 'name': 'ose', 'baseurl': 'http://download-node-02.somewhere.at.redhat.com/rcm-guest/puddles/RHAOS/AtomicOpenShift-signed/3.4/latest/RH7-RHAOS-3.4/x86_64/os', 'enabled': 1, 'gpgcheck': 0, 'skip_if_unavailable': 1}, {'id':'rhel-extras-candidate','name':'rhel-extras-candidate','baseurl':'http://download-node-02.somewhere.at.redhat.com/brewroot/repos/extras-rhel-7.4-container-build/latest/x86_64/', 'enabled': 1, 'gpgcheck': 0, 'skip_if_unavailable': 1}]
openshift_docker_additional_registries=brew-pulp-docker01.somewhere.at.redhat.com:8888
openshift_docker_insecure_registries=brew-pulp-docker01.somewhere.at.redhat.com:8888

# htpasswd auth
openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true', 'challenge': 'true', 'kind': 'HTPasswdPasswordIdentityProvider', 'filename': '/etc/origin/master/htpasswd'}]
# Defining htpasswd users
openshift_master_htpasswd_users={'cluster-admin': 'CENSORED'}

# Logging
openshift_hosted_logging_deploy=true
openshift_hosted_logging_elasticsearch_cluster_size=1
openshift_hosted_logging_hostname=kibana.apps.09b07.somewhere.at.redhat.com
openshift_hosted_logging_enable_ops_cluster=True
openshift_hosted_logging_deployer_prefix=brew-pulp-docker01.somewhere.at.redhat.com:8888/openshift3/
openshift_hosted_logging_deployer_version=3.3.0

[ose_deployer]
# Workaround  Start and enable iptables service hanging
# https://github.com/openshift/openshift-ansible/issues/747
# 
# This template is gonna be rendered on one of the masters and the
# ansible-playbook with the result will be started on it. We want to set
# the ansible connection to local on such host.
ose3-master-09b07.09b07.somewhere.at.redhat.com ansible_connection=local

[masters]
ose3-master-09b07.09b07.somewhere.at.redhat.com openshift_node_labels="{'region':'infra','zone':'default'}" openshift_hostname=ose3-master-09b07.09b07.somewhere.at.redhat.com openshift_public_hostname=ose3-master-09b07.09b07.somewhere.at.redhat.com openshift_scheduleable=True

[nodes]
ose3-master-09b07.09b07.somewhere.at.redhat.com openshift_node_labels="{'region':'infra','zone':'default'}" openshift_hostname=ose3-master-09b07.09b07.somewhere.at.redhat.com openshift_public_hostname=ose3-master-09b07.09b07.somewhere.at.redhat.com

ose3-node0-09b07.09b07.somewhere.at.redhat.com openshift_node_labels="{'region':'primary','zone':'east'}" openshift_hostname=ose3-node0-09b07.09b07.somewhere.at.redhat.com openshift_public_hostname=ose3-node0-09b07.09b07.somewhere.at.redhat.com
```



Discussion:

Resolving patch:
diff --git a/roles/lib_openshift/library/oc_adm_ca_server_cert.py b/roles/lib_openshift/library/oc_adm_ca_server_cert.py
--- a/roles/lib_openshift/library/oc_adm_ca_server_cert.py
+++ b/roles/lib_openshift/library/oc_adm_ca_server_cert.py
@@ -1462,6 +1462,9 @@ def exists(self):
         if proc.returncode == 0:
             regex = re.compile(r"^\s*X509v3 Subject Alternative Name:\s*?\n\s*(.*)\s*\n", re.MULTILINE)
             match = regex.search(x509output)  # E501
+            if not match:
+                return False
+
             for entry in re.split(r", *", match.group(1)):
                 if entry.startswith('DNS') or entry.startswith('IP Address'):
                     cert_names.append(entry.split(':')[1])
diff --git a/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py b/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py
--- a/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py
+++ b/roles/lib_openshift/src/class/oc_adm_ca_server_cert.py
@@ -78,6 +78,9 @@ def exists(self):
         if proc.returncode == 0:
             regex = re.compile(r"^\s*X509v3 Subject Alternative Name:\s*?\n\s*(.*)\s*\n", re.MULTILINE)
             match = regex.search(x509output)  # E501
+            if not match:
+                return False
+
             for entry in re.split(r", *", match.group(1)):
                 if entry.startswith('DNS') or entry.startswith('IP Address'):
                     cert_names.append(entry.split(':')[1])


Test patch: