GCE client certificates need to include the hostname

Question

After changes in #3225, masters can't contact nodes (this is via exec from the test suite)

    [91mExpected error:
        : {
            s: "host command failed: error running &{/data/src/github.com/openshift/origin/_output/local/bin/linux/amd64/kubectl [kubectl --server=https://internal-api.pr79.origin-ci-int-gce.dev.rhcloud.com:8443 --kubeconfig=/tmp/cluster-admin.kubeconfig exec --namespace=extended-test-scoped-router-3f3wx-f762m execpod -- /bin/sh -c \n\t\tset -e\n\t\tfor i in $(seq 1 180); do\n\t\t\tcode=$( curl -s -o /dev/null -w '%{http_code}\\n' --header 'Host: 172.16.2.54' \"http://172.16.2.54:1936/healthz\" )\n\t\t\techo $code\n\t\t\tif [[ $code -eq 200 ]]; then\n\t\t\t\texit 0\n\t\t\tfi\n\t\t\tif [[ $code -ne 503 ]]; then\n\t\t\t\texit 1\n\t\t\tfi\n\t\t\tsleep 1\n\t\tdone\n\t\t] []  <nil>  Error from server: error dialing backend: x509: certificate is valid for ci-pr79-ig-n-72h9.c.openshift-gce-devel-ci.internal, 10.128.0.3, 104.198.163.129, not ci-pr79-ig-n-72h9\n [] <nil> 0xc8216a4000 exit status 1 <nil> true [0xc8200325d0 0xc820032680 0xc820032728] [0xc8200325d0 0xc820032680 0xc820032728] [0xc820032678 0xc820032718] [0xaf79e0 0xaf79e0] 0xc820626ea0}:\nCommand stdout:\n\nstderr:\nError from server: error dialing backend: x509: certificate is valid for ci-pr79-ig-n-72h9.c.openshift-gce-devel-ci.internal, 10.128.0.3, 104.198.163.129, not ci-pr79-ig-n-72h9\n\nerror:\nexit status 1\n\n",
        }
        host command failed: error running &{/data/src/github.com/openshift/origin/_output/local/bin/linux/amd64/kubectl [kubectl --server=https://internal-api.pr79.origin-ci-int-gce.dev.rhcloud.com:8443 --kubeconfig=/tmp/cluster-admin.kubeconfig exec --namespace=extended-test-scoped-router-3f3wx-f762m execpod -- /bin/sh -c 
                set -e
                for i in $(seq 1 180); do
                    code=$( curl -s -o /dev/null -w '%{http_code}\n' --header 'Host: 172.16.2.54' "http://172.16.2.54:1936/healthz" )
                    echo $code
                    if [[ $code -eq 200 ]]; then
                        exit 0
                    fi
                    if [[ $code -ne 503 ]]; then
                        exit 1
                    fi
                    sleep 1
                done
                ] []  <nil>  Error from server: error dialing backend: x509: certificate is valid for ci-pr79-ig-n-72h9.c.openshift-gce-devel-ci.internal, 10.128.0.3, 104.198.163.129, not ci-pr79-ig-n-72h9
         [] <nil> 0xc8216a4000 exit status 1 <nil> true [0xc8200325d0 0xc820032680 0xc820032728] [0xc8200325d0 0xc820032680 0xc820032728] [0xc820032678 0xc820032718] [0xaf79e0 0xaf79e0] 0xc820626ea0}:
        Command stdout:

        stderr:
        Error from server: error dialing backend: x509: certificate is valid for ci-pr79-ig-n-72h9.c.openshift-gce-devel-ci.internal, 10.128.0.3, 104.198.163.129, not ci-pr79-ig-n-72h9

        error:
        exit status 1


    not to have occurred[0m
</nil></nil></nil></nil></nil></nil>

That means cert generation for masters is wrong as well.

该提问来源于开源项目：openshift/openshift-ansible

Answer 1