Uploaded image for project: 'AMQ Streams'
  1. AMQ Streams
  2. ENTMQST-3601

Certificates of internal components are not renewed after executing force-renew

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • 2.0.0.GA
    • 1.8.0.GA
    • cluster-operator
    • None
    • False
    • False
    • Hide
      • Manually delete the associated certificate (the deleted certificate will be automatically recreated by the cluster operator).
        # entity-operator  
        oc get secret $CLUSTER_NAME-entity-operator-certs -o yaml > $CLUSTER_NAME-entity-operator-certs.yaml
        oc delete secret $CLUSTER_NAME-entity-operator-certs
        oc delete $(oc get pods -o name | grep my-cluster-entity-operator)
        
        # kafka
        oc get secret $CLUSTER_NAME-kafka-brokers -o yaml > $CLUSTER_NAME-kafka-brokers.yaml
        oc delete secret $CLUSTER_NAME-kafka-brokers
        oc delete pods -l strimzi.io/name=$CLUSTER_NAME-kafka
        
        # zookeeper
        oc get secret $CLUSTER_NAME-zookeeper-nodes -o yaml > $CLUSTER_NAME-zookeeper-nodes.yaml
        oc delete secret $CLUSTER_NAME-zookeeper-nodes
        oc delete pods -l strimzi.io/name=$CLUSTER_NAME-zookeeper
        
        # kafka exporter
        oc get secret $CLUSTER_NAME-kafka-exporter-certs   -o yaml > $CLUSTER_NAME-kafka-exporter-certs.yaml
        oc delete secret $CLUSTER_NAME-kafka-exporter-certs
        oc delete pods -l strimzi.io/name=$CLUSTER_NAME-kafka-exporter
        
      Show
      Manually delete the associated certificate (the deleted certificate will be automatically recreated by the cluster operator). # entity- operator oc get secret $CLUSTER_NAME-entity- operator -certs -o yaml > $CLUSTER_NAME-entity- operator -certs.yaml oc delete secret $CLUSTER_NAME-entity- operator -certs oc delete $(oc get pods -o name | grep my-cluster-entity- operator ) # kafka oc get secret $CLUSTER_NAME-kafka-brokers -o yaml > $CLUSTER_NAME-kafka-brokers.yaml oc delete secret $CLUSTER_NAME-kafka-brokers oc delete pods -l strimzi.io/name=$CLUSTER_NAME-kafka # zookeeper oc get secret $CLUSTER_NAME-zookeeper-nodes -o yaml > $CLUSTER_NAME-zookeeper-nodes.yaml oc delete secret $CLUSTER_NAME-zookeeper-nodes oc delete pods -l strimzi.io/name=$CLUSTER_NAME-zookeeper # kafka exporter oc get secret $CLUSTER_NAME-kafka-exporter-certs -o yaml > $CLUSTER_NAME-kafka-exporter-certs.yaml oc delete secret $CLUSTER_NAME-kafka-exporter-certs oc delete pods -l strimzi.io/name=$CLUSTER_NAME-kafka-exporter
    • Hide
      1. start a Kafka cluster with Kafka Exporter
      2. oc annotate secret my-cluster-cluster-ca strimzi.io/force-replace=true
      • => the only following secrets will be renewed:
        • my-cluster-cluster-ca
          my-cluster-cluster-ca-cert 
          my-cluster-cluster-ca
          my-cluster-cluster-operator-certs
      • => After that Zookeeper, Kafka, Entity Operator, Kafka Exporter Pods will be restart, however, their certificates will not be renewed, and Kafka brokers cannot communicate with each other with "Failed authentication (SSL handshake failed)".
      Show
      start a Kafka cluster with Kafka Exporter oc annotate secret my-cluster-cluster-ca strimzi.io/force-replace=true => the only following secrets will be renewed: my-cluster-cluster-ca my-cluster-cluster-ca-cert my-cluster-cluster-ca my-cluster-cluster- operator -certs => After that Zookeeper, Kafka, Entity Operator, Kafka Exporter Pods will be restart, however, their certificates will not be renewed, and Kafka brokers cannot communicate with each other with "Failed authentication (SSL handshake failed)".

    Description

      • Certificates of internal components are not renewed after executing force-renew
      • => the only following secrets are renewed:
        • my-cluster-cluster-ca
          my-cluster-cluster-ca-cert 
          my-cluster-cluster-ca
          my-cluster-cluster-operator-certs
      • => Then Zookeeper, Kafka, Entity Operator, Kafka Exporter Pods will be restart, however, their certificates will not be renewed such as:
        • my-cluster-zookeeper-nodes
          my-cluster-kafka-brokers
          my-cluster-entity-operator-certs 
          my-cluster-kafka-exporter-certs  
      • => After that AMQ Streams will be down, because Kafka brokers cannot communicate with each other with "Failed authentication (SSL handshake failed)".
      • Attached file "cluster-operator-debug.log" : cluster operator debug log during the problem

      Attachments

        Activity

          People

            Unassigned Unassigned
            rhn-support-tyamashi Tomonari Yamashita
            Lukas Kral Lukas Kral
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: