We want short expiry times during development and long expiry times when we ship.
*** Bug 1803704 has been marked as a duplicate of this bug. ***
Using below steps to verify this bug: $ cat scripts/check_secret_expiry.sh FILE="$1" if [ ! -f "$1" ]; then echo "must provide \$1" && exit 0 fi export IFS=$'\n' for i in `cat "$FILE"` do if `echo "$i" | grep "^#" > /dev/null`; then continue fi NS=`echo $i | cut -d ' ' -f 1` SECRET=`echo $i | cut -d ' ' -f 2` rm -f tls.crt; oc extract secret/$SECRET -n $NS --confirm > /dev/null echo "Check cert dates of $SECRET in project $NS:" openssl x509 -noout --dates -in tls.crt; echo done $ cat certs.txt openshift-kube-controller-manager-operator csr-signer-signer openshift-kube-controller-manager-operator csr-signer openshift-kube-controller-manager kube-controller-manager-client-cert-key openshift-kube-apiserver-operator aggregator-client-signer openshift-kube-apiserver aggregator-client openshift-kube-apiserver external-loadbalancer-serving-certkey openshift-kube-apiserver internal-loadbalancer-serving-certkey openshift-kube-apiserver service-network-serving-certkey openshift-config-managed kube-controller-manager-client-cert-key openshift-config-managed kube-scheduler-client-cert-key openshift-kube-scheduler kube-scheduler-client-cert-key Checking the Certs, they are with one day expiry times, this is as expected. $ bash ./check-secret-expiry.sh cert.txt Check cert dates of csr-signer-signer in project openshift-kube-controller-manager-operator: notBefore=Feb 27 02:54:14 2020 GMT notAfter=Feb 28 02:54:14 2020 GMT ... After one day, checking the cert rotation again, $ ./check-secret-expiry.sh ./cert.txt Check cert dates of csr-signer-signer in project openshift-kube-controller-manager-operator: notBefore=Feb 27 22:06:13 2020 GMT notAfter=Apr 27 22:06:14 2020 GMT Check cert dates of csr-signer in project openshift-kube-controller-manager-operator: notBefore=Feb 27 22:09:43 2020 GMT notAfter=Mar 28 22:09:44 2020 GMT ... All certs are as expected expiry time 30 days, except cert of of csr-signer-signer in project openshift-kube-controller-manager-operator with 2 * 30 days, see above , is this as expected? @deads2k : Any comments? CC @xxia
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0581