Update Airgap trusted certificate
search cancel

Update Airgap trusted certificate

book

Article ID: 405212

calendar_today

Updated On:

Products

VMware Telco Cloud Automation VMware Telco Cloud Platform

Issue/Introduction

  • The Airgap trusted certificate stored in the v1.24.10 management cluster was recently updated.
  • The kapp controller on the management cluster is not working.

Environment

TCA: 3.2

TCP: 5.0

Cause

TCA 3.2 does not support Airgap trusted certificate updates for the v1.24.10 management cluster.

Resolution

NOTE: Updating the Airgap trusted certificate of the management cluster will trigger a cluster node rolling-update

  1. Update the TCA-DB via the TCA Manager Appliance

    1. Download the update Airgap trusted certificate tarball from update-ca-v3.3.0.1.tar.gz.

    2. Upload it to the TCA-M appliance /home/admin directory utilizing SCP or an alternative method.

    3. Unpack the tarball as the root user:

      # tar vxfz update-ca-v3.3.tar.gz

    4. Update Airgap trusted certificate in TCA-M database:

      # python update_ca.py update-cert-db --fqdn <airgapServerFqdn> --cafile <caCertificateFile>

      NOTE : The FQDN is case sensitive. Please fetch the FQDN from the Partner Systems UI. 

      Following output is an example:

      # python update_ca.py update-cert-db --fqdn <airgapServerFqdn> --cafile <caCertificateFile>
update_ca[INFO]: airgap repo: <airgapServerFqdn> is valid
update_ca[INFO]: ########## Quering <airgapServerFqdn>'s id,val in Postgres ##########
update_ca[INFO]: ########## Updating <airgapServerFqdn>'s val by id in Postgres ##########
update_ca[INFO]: the interfaceInfo is {'fqdn': <airgapServerFqdn>', 'caCert':'<certificateHash>'}
update_ca[INFO]: Successfully update cert db

    5. Check Airgap trusted certificate in TCA-M Infrastructure > Partner Systems UI.

  2. Update the Airgap Certificate for the Management Cluster

    1. Download the update Airgap trusted certificate tarball from update-ca-v3.3.0.1.tar.gz.

    2. Upload it to the TCA-CP appliance /home/admin directory utilizing SCP or an alternative method.

    3. Unpack the tarball as the root user:

      # tar vxfz update-ca-v3.3.tar.gz

    4. Update the Airgap trusted certificate of the specified management cluster:

      # python update_ca.py update-mgmtcluster --cafile <caCertificateFile> --name <managementClusterName>

      Following output is an example:

      # python update_ca.py update-mgmtcluster --cafile <caCertificateFile> --name <managementClusterName>
client[INFO]: Successfully get TkgContext
update_ca[INFO]: airgap repo: <airgapServerFqdn> is valid
client[INFO]: Updated tkgcontext ########-####-####-####-############ with response 
client[INFO]: Successfully get management cluster Kubeconfig
client[INFO]: update cluster kapp-controller-config successfully
client[INFO]: update secret [tkg-pkg-tkg-system-values] in namespace [tkg-system] successfully
client[INFO]: update secret [tkr-source-controller-values] in namespace [tkg-system] successfully
client[INFO]: update secret [tkr-vsphere-resolver-values] in namespace [tkg-system] successfully
client[INFO]: update management cluster tkr-controller-config successfully
client[INFO]: update clusterclass mgmt cluster [<management cluster name>] in namespace tkg-system successfully
update_ca[INFO]: Updated management cluster

    5. Display the status of updating the Airgap trusted certificate of the specified management cluster:

      # python update_ca.py show-state-mgmtcluster --name <managementClusterName>

      Following output is an example:

      # python update_ca.py show-state-mgmtcluster --name <managementClusterName>
client[INFO]: Successfully get TkgContext
update_ca[INFO]: airgap repo: <airgapServerFqdn> is valid
client[INFO]: Successfully get management cluster Kubeconfig
client[INFO]: nodeConfig [update-airgap-certs] is updated successuflly
client[INFO]: configmap kapp-controller-config/tkg-system: up to date
client[INFO]: secret tkg-pkg-tkg-system-values/tkg-system: up to date
client[INFO]: secret [tkr-source-controller-values] in namespace [tkg-system]: up to date
client[INFO]: caCerts doesn't exist in secret [tkr-vsphere-resolver-values] in namespace [tkg-system]
client[INFO]: configmap tkr-controller-config: up to date
client[INFO]: cluster [<management cluster name>] in namespace tkg-system: up to date
client[INFO]: cluster nodes: up to date

  3. Update the Airgap Certificate for the Workload Cluster

    1. Download the update Airgap trusted certificate tarball from update-ca-v3.3.0.1.tar.gz.

    2. Upload it to the TCA-CP appliance /home/admin directory utilizing  SCP or an alternative method.

    3. Unpack the tarball as the root user:

      # tar vxfz update-ca-v3.3.tar.gz

    4. Update the Airgap trusted certificate of the specified workload cluster:

      Note: Management cluster should have latest Airgap certificates before running below for workload cluster.

      # python update_ca.py update-workloadcluster --mc managementClusterName --name workloadClusterName

      Note: If the workload cluster is a legacy cluster, restart the tca-kubecluster-operator pod:

      # kubectl rollout restart deployment -n tca-system tca-kubecluster-operator

    5. Display the status of the Airgap certificate relevant to workload cluster that is being renewed:

      # python update_ca.py show-state-workloadcluster --mc <managementClusterName> --name <workloadClusterName>

       



Powered by Wolken Software