Description of problem: Cert validity increases from 1 year to 10 years during rotation. In this instance manually forced rotation by deleting annotations. $ oc get secret kube-apiserver-to-kubelet-signer -o yaml apiVersion: v1 data: [...] kind: Secret metadata: annotations: auth.openshift.io/certificate-issuer: kube-apiserver-to-kubelet-signer auth.openshift.io/certificate-not-after: "2020-07-23T09:09:05Z" auth.openshift.io/certificate-not-before: "2019-07-24T09:09:05Z" creationTimestamp: "2019-07-24T09:22:14Z" name: kube-apiserver-to-kubelet-signer namespace: openshift-kube-apiserver-operator resourceVersion: "254" selfLink: /api/v1/namespaces/openshift-kube-apiserver-operator/secrets/kube-apiserver-to-kubelet-signer uid: 85e31801-adf4-11e9-a73a-0282cb83bab0 type: SecretTypeTLS After deleting annotations: $ oc get secret kube-apiserver-to-kubelet-signer -o yaml apiVersion: v1 data: [...] kind: Secret metadata: annotations: auth.openshift.io/certificate-issuer: openshift-kube-apiserver-operator_kube-apiserver-to-kubelet-signer@1563964343 auth.openshift.io/certificate-not-after: "2029-07-21T10:32:23Z" auth.openshift.io/certificate-not-before: "2019-07-24T10:32:22Z" creationTimestamp: "2019-07-24T09:22:14Z" labels: auth.openshift.io/managed-certificate-type: signer name: kube-apiserver-to-kubelet-signer namespace: openshift-kube-apiserver-operator resourceVersion: "29119" selfLink: /api/v1/namespaces/openshift-kube-apiserver-operator/secrets/kube-apiserver-to-kubelet-signer uid: 85e31801-adf4-11e9-a73a-0282cb83bab0 type: SecretTypeTLS Version-Release number of selected component (if applicable): 4.2.0-0.nightly-2019-07-24-000310
Confirmed with Payload: 4.2.0-0.nightly-2019-07-28-222114, the issue has fixed: [root@dhcp-140-138 ~]# oc get secret kube-apiserver-to-kubelet-signer -o yaml apiVersion: v1 data: [...] kind: Secret metadata: annotations: auth.openshift.io/certificate-issuer: openshift-kube-apiserver-operator_kube-apiserver-to-kubelet-signer@1564451491 auth.openshift.io/certificate-not-after: "2020-07-29T01:51:32Z" auth.openshift.io/certificate-not-before: "2019-07-30T01:51:31Z" creationTimestamp: "2019-07-29T01:22:10Z" labels: auth.openshift.io/managed-certificate-type: signer name: kube-apiserver-to-kubelet-signer namespace: openshift-kube-apiserver-operator resourceVersion: "394495" selfLink: /api/v1/namespaces/openshift-kube-apiserver-operator/secrets/kube-apiserver-to-kubelet-signer uid: 49825ae1-b19f-11e9-86af-0293dfa65d10 type: SecretTypeTLS
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2922