Hello All,

We are Installing MAS on premises, during MAS core Installation we used below ansible to Mirror Container image :-

sudo podman run -tidv /mas/gmarsdev2_setup:/home/local/gmarsdev2_setup --pull always quay.io/ibmmas/cli

Provided all required inputs and got Proceed with these settings [y/N]: entered y as input

Project mas-xxxx-pipelines is created and pipeline mas-install is created but during mas-install pipeline we are getting an error. 

In logs it's showing below error

TASK [ibm.mas_devops.ocp_verify : Extract certificate chain into a variable] ***
fatal: [localhost]: FAILED! =>
  msg: |-
    The task includes an option with an undefined variable. The error was: 'cluster_ingress_tls_crt' is undefined. 'cluster_ingress_tls_crt' is undefined
 
    The error appears to be in '/opt/app-root/lib64/python3.9/site-packages/ansible_collections/ibm/mas_devops/common_tasks/get_signed_ingress_cert.yml': line 99, column 3, but may
    be elsewhere in the file depending on the exact syntax problem.
 
    The offending line appears to be:
 
    # Break up the certificate into an array
    - name: "Extract certificate chain into a variable"
      ^ here

NO MORE HOSTS LEFT *************************************************************

PLAY RECAP *********************************************************************
localhost                  : ok=15   changed=0    unreachable=0    failed=1    skipped=4    rescued=0    ignored=0  

Please find the attached document and log file for better understanding.

Regards,
Biswa

------------------------------
Biswaranjan Mishra
------------------------------

Attachment(s)

MAS Installation.docx   166 KB 1 version

pre-install-check.log   77 KB 1 version

The name of the ingress certificate can be different, especially if you are using an OpenShift Service (like ARO). You can specify the Ingress Certificate to use when using the Ansible Playbook and I think there is an open issue for getting that to work with the pipeline as well.

To find your ingress certificate name using the OpenShift web console:

1. Expand Workloads
2. Click on Secrets
3. Set you Project to openshift-ingress
4. There is a secret that ends with -ingress of the typekebernetes.io/tls. This is the name of the certificate to use.

If you are using the playbook you can set this with export OCP_INGRESS_TLS_SECRET_NAME=nameofcertificate.

I don't think the pipeline supports this option yet, but that may have been fixed.