Hide Forgot
Currently, monitoring must skip TLS verification to scrape controller manager/scheduler secure endpoints (10257/10259) because they are served using temporary self signed installer certificates. Example certs served from the kube scheduler endpoint: $ kubectl \ -n openshift-kube-scheduler \ port-forward \ pod/openshift-kube-scheduler-ip-10-0-135-193.ec2.internal 10259 $ openssl crl2pkcs7 -nocrl -certfile \ <(echo 'QUIT' | openssl s_client -showcerts -connect localhost:10259) \ | openssl pkcs7 -print_certs -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) Signature Algorithm: sha256WithRSAEncryption Issuer: CN=localhost-ca@1555061666 Validity Not Before: Apr 12 08:34:26 2019 GMT Not After : Apr 11 08:34:26 2020 GMT Subject: CN=localhost@1555061667 Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: ... Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Alternative Name: DNS:localhost, DNS:localhost, IP Address:127.0.0.1 Signature Algorithm: sha256WithRSAEncryption ... Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: CN=localhost-ca@1555061666 Validity Not Before: Apr 12 08:34:26 2019 GMT Not After : Apr 11 08:34:26 2020 GMT Subject: CN=localhost-ca@1555061666 Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: ... Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment, Certificate Sign X509v3 Basic Constraints: critical CA:TRUE Signature Algorithm: sha256WithRSAEncryption ...
PR: https://github.com/openshift/cluster-kube-controller-manager-operator/pull/221
@michael: what about the scheduler operator?
(In reply to Sergiusz Urbaniak from comment #2) > @michael: what about the scheduler operator? Stefan is going to port it to scheduler now.
This also depends on https://github.com/openshift/installer/pull/1576/ to work with metrics.
https://github.com/openshift/cluster-kube-scheduler-operator/pull/97 is the scheduler PR to wire the right serving certs.
Both PR's merged and we should be now serving securely. As a follow up, monitoring team should switch their scraping to use the secure ports, but that should be tracked outside this BZ.
Confirmed with latest ocp 4.1 , the issue has fixed: Payload: 4.1.0-0.nightly-2019-04-18-210657 kube-controller-manager certinfo: [zhouying@dhcp-140-138 tmp]$ openssl x509 -in contls2.crt --text Certificate: Data: Version: 3 (0x2) Serial Number: 6244008379750077698 (0x56a72c8a0990d502) Signature Algorithm: sha256WithRSAEncryption Issuer: CN = openshift-service-serving-signer@1555643835 Validity Not Before: Apr 19 03:17:38 2019 GMT Not After : Apr 18 03:17:39 2021 GMT Subject: CN = kube-controller-manager.openshift-kube-controller-manager.svc .... kube-scheduler cert info: [zhouying@dhcp-140-138 tmp]$ openssl x509 -in schedulerctls.crt --text Certificate: Data: Version: 3 (0x2) Serial Number: 3938385304973640660 (0x36a7f491839283d4) Signature Algorithm: sha256WithRSAEncryption Issuer: CN = openshift-service-serving-signer@1555643835 Validity Not Before: Apr 19 03:17:37 2019 GMT Not After : Apr 18 03:17:38 2021 GMT Subject: CN = scheduler.openshift-kube-scheduler.svc
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:0758