+++ This bug was initially created as a clone of Bug #1733109 +++ Description of problem: Cert validity increases from 1 year to 10 years during rotation. In this instance manually forced rotation by deleting annotations. $ oc get secret kube-apiserver-to-kubelet-signer -o yaml apiVersion: v1 data: [...] kind: Secret metadata: annotations: auth.openshift.io/certificate-issuer: kube-apiserver-to-kubelet-signer auth.openshift.io/certificate-not-after: "2020-07-23T09:09:05Z" auth.openshift.io/certificate-not-before: "2019-07-24T09:09:05Z" creationTimestamp: "2019-07-24T09:22:14Z" name: kube-apiserver-to-kubelet-signer namespace: openshift-kube-apiserver-operator resourceVersion: "254" selfLink: /api/v1/namespaces/openshift-kube-apiserver-operator/secrets/kube-apiserver-to-kubelet-signer uid: 85e31801-adf4-11e9-a73a-0282cb83bab0 type: SecretTypeTLS After deleting annotations: $ oc get secret kube-apiserver-to-kubelet-signer -o yaml apiVersion: v1 data: [...] kind: Secret metadata: annotations: auth.openshift.io/certificate-issuer: openshift-kube-apiserver-operator_kube-apiserver-to-kubelet-signer@1563964343 auth.openshift.io/certificate-not-after: "2029-07-21T10:32:23Z" auth.openshift.io/certificate-not-before: "2019-07-24T10:32:22Z" creationTimestamp: "2019-07-24T09:22:14Z" labels: auth.openshift.io/managed-certificate-type: signer name: kube-apiserver-to-kubelet-signer namespace: openshift-kube-apiserver-operator resourceVersion: "29119" selfLink: /api/v1/namespaces/openshift-kube-apiserver-operator/secrets/kube-apiserver-to-kubelet-signer uid: 85e31801-adf4-11e9-a73a-0282cb83bab0 type: SecretTypeTLS Version-Release number of selected component (if applicable): 4.2.0-0.nightly-2019-07-24-000310
Verified in 4.1.0-0.nightly-2019-08-13-204925, the validity is 1 year during above steps.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2547