CAPO should be able to read the `openshift-config/cloud-provider-config` configmap in order to retrieve the cloud provider CA certificate. This should have been handled in https://github.com/openshift/machine-api-operator/pull/473/, however there was a typo (clustermap vs clustermaps) and the new cloud-provider-config-reader role doesn't allow reading from the config map. Here is the error from the CAPO logs: I0125 17:54:30.807499 1 machineservice.go:189] Not using cloud provider CA cert: failed to get configmap openshift-config/cloud-provider-config/ca-bundle.pem from kubernetes api: configmaps "cloud-provider-config" is forbidden: User "system:serviceaccount:openshift-machine-api:machine-api-controllers" cannot get resource "configmaps" in API group "" in the namespace "openshift-config"
The original PR at https://github.com/openshift/machine-api-operator/pull/480 was superseded by https://github.com/openshift/machine-api-operator/pull/471 which merged already. Moving to ON_QA.
Verified on 4.4.0-0.nightly-2020-01-31-144949
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0581