[Airship-discuss] Incorrect (default) certificates in genesis bundle for custom site

[Roman Gorshunov]

Hilbert,

Did you succeed to get proper documents rendered?

Ryan,

It's documented as one of the forst steps when starting to write new
site definition.
https://airship-treasuremap.readthedocs.io/en/latest/authoring_and_deployment.html#preparing-deployment-documents

Best regards,
--
Roman Gorshunov

On Sun, Oct 6, 2019 at 9:30 AM Ryan van Wyk <ryanvanwyk at gmail.com> wrote:
>
> Should we add answers to questions like this to a Q&A not the wiki?
>
> Ryan van Wyk
>
> Cell: 312-860-0966
> Email: ryanvanwyk at gmail.com
>
> On Oct 4, 2019, at 8:43 PM, SKELS, KASPARS <ks3019 at att.com> wrote:
>
> 
> Hi Hilbert,
>
> perhaps not well documented item for the process.
>
> Make sure you delete the old certificates.yaml from site manifests. In other words, there should be no certificates.yaml file before you start installation.
>
> Once you run the promenade gen-certs you will have a new certificates.yaml file which at that point you can place where the original file was. E.g. input is the PKI.
>
> Let me know if this works!
> /Kaspars
>
>
>
> ________________________________
> From: Hilbert Mixelplix [mixelplix at ineffectual.org]
> Sent: Thursday, September 12, 2019 10:52 AM
> To: airship-discuss at lists.airshipit.org
> Subject: [Airship-discuss] Incorrect (default) certificates in genesis bundle for custom site
>
> I have been working on a custom Airship site definition (starting from the Airsloop reference), and am running into an issue during the creation of the genesis.sh script where the certificates included in the bundle still have the default names (airsloop-control-1, etc) and default IP addresses instead of those specified in my pki-catalog.yaml file.
>
> After running `sudo tools/airship promenade generate-certs \
>   -o /target/${NEW_SITE}_certs /target/${NEW_SITE}_collected/*.yaml` and manually inspecting the file by extracting the cert data and doing an openssl read, I see that the certificates and SANs are correct. Similarly when I inspect the collected yaml document after running the pegleg collect process, I find that the certificates are correct.
>
> Despite this, when running `sudo tools/airship promenade build-all --validators -o /target/${NEW_SITE}_bundle /target/${NEW_SITE}_collected/*.yaml` I can see the log line outputs where the certificates are added to the bundle, and the corresponding md5sums match those of the default certificates. When I execute the genesis script it is these default certificates that are extracted to /etc/genesis/ and as a result the etcd containers are unable to join a cluster together, failing with an error of:
> "2019-09-12 06:39:15.264601 W | rafthttp: health check for peer b9e987dd1344ab69 could not connect: x509: certificate is valid for 10.22.72.21, 127.0.0.1, 10.96.0.2, not 10.9.22.21".
>
> I've looked everywhere I can think of to try to identify where these certificates are being re-introduced (having carefully removed all copies of them before I execute the build-all process), but am unable to track them down. Has anyone run into this issue before or know what may be happening?
>
> -Hilbert
> _______________________________________________
> Airship-discuss mailing list
> Airship-discuss at lists.airshipit.org
> http://lists.airshipit.org/cgi-bin/mailman/listinfo/airship-discuss
>
> _______________________________________________
> Airship-discuss mailing list
> Airship-discuss at lists.airshipit.org
> http://lists.airshipit.org/cgi-bin/mailman/listinfo/airship-discuss