Bug 1797601 - rotate certificates quickly
Summary: rotate certificates quickly
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: kube-controller-manager
Version: 4.4
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: ---
: 4.4.0
Assignee: Maciej Szulik
QA Contact: zhou ying
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-02-03 13:45 UTC by David Eads
Modified: 2020-02-27 02:47 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1803704 (view as bug list)
Environment:
Last Closed: 2020-02-27 02:47:39 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github openshift cluster-kube-apiserver-operator pull 748 None closed bug 1797601: force cert rotation every couple days for development 2020-09-28 09:15:24 UTC
Github openshift cluster-kube-apiserver-operator pull 767 None closed Bug 1797601: force cert rotation every couple days for development: aggregator-client-signer 2020-09-28 09:15:18 UTC

Description David Eads 2020-02-03 13:45:09 UTC
During development, we want to exercise the rotation code paths, so we go from 30 days down to 12 hours of validity.

Comment 2 Xingxing Xia 2020-02-17 09:41:04 UTC
Referencing bug 1688610, using below steps to verify this bug:
$ cat scripts/check_secret_expiry.sh
FILE="$1"
if [ ! -f "$1" ]; then
  echo "must provide \$1" && exit 0
fi
export IFS=$'\n'
for i in `cat "$FILE"`
do
  if `echo "$i" | grep "^#" > /dev/null`; then
    continue
  fi
  NS=`echo $i | cut -d ' ' -f 1`
  SECRET=`echo $i | cut -d ' ' -f 2`
  rm -f tls.crt; oc extract secret/$SECRET -n $NS --confirm > /dev/null
  echo "Check cert dates of $SECRET in project $NS:"
  openssl x509 -noout --dates -in tls.crt; echo
done

$ cat certs.txt
openshift-kube-controller-manager-operator csr-signer-signer
openshift-kube-controller-manager-operator csr-signer
openshift-kube-controller-manager kube-controller-manager-client-cert-key
openshift-kube-apiserver-operator aggregator-client-signer
openshift-kube-apiserver aggregator-client
openshift-kube-apiserver external-loadbalancer-serving-certkey
openshift-kube-apiserver internal-loadbalancer-serving-certkey
openshift-kube-apiserver service-network-serving-certkey
openshift-config-managed kube-controller-manager-client-cert-key
openshift-config-managed kube-scheduler-client-cert-key
openshift-kube-scheduler kube-scheduler-client-cert-key

In a fresh latest 4.4.0-0.nightly-2020-02-16-221315 env, run
$ scripts/check_secret_expiry.sh certs.txt # got:
Check cert dates of csr-signer-signer in project openshift-kube-controller-manager-operator:
notBefore=Feb 17 02:31:12 2020 GMT
notAfter=Feb 18 02:31:12 2020 GMT

Check cert dates of csr-signer in project openshift-kube-controller-manager-operator:
notBefore=Feb 17 02:48:18 2020 GMT
notAfter=Feb 18 02:31:12 2020 GMT

Check cert dates of kube-controller-manager-client-cert-key in project openshift-kube-controller-manager:
notBefore=Feb 17 02:48:22 2020 GMT
notAfter=Feb 17 14:48:23 2020 GMT

Check cert dates of aggregator-client-signer in project openshift-kube-apiserver-operator:
notBefore=Feb 17 02:31:06 2020 GMT
notAfter=Feb 18 02:31:06 2020 GMT
...

Like bug 1688610#c4, most of these certs have above PR's (30 days / 60) = 12 hours validity, except csr-signer-signer, csr-signer and aggregator-client-signer.

Comment 3 Xingxing Xia 2020-02-17 09:42:02 UTC
Then, check like bug 1688610#c5 , even in a longer running cluster (e.g. another 4.4 env running 1 day), still got csr-signer-signer, csr-signer and aggregator-client-signer validity != 12 hours:
$ scripts/check_secret_expiry.sh certs.txt
Check cert dates of csr-signer-signer in project openshift-kube-controller-manager-operator:
notBefore=Feb 17 03:05:57 2020 GMT
notAfter=Apr 17 03:05:58 2020 GMT

Check cert dates of csr-signer in project openshift-kube-controller-manager-operator:
notBefore=Feb 17 03:09:27 2020 GMT
notAfter=Mar 18 03:09:28 2020 GMT

Check cert dates of kube-controller-manager-client-cert-key in project openshift-kube-controller-manager:
notBefore=Feb 17 02:11:13 2020 GMT
notAfter=Feb 17 14:11:14 2020 GMT

Check cert dates of aggregator-client-signer in project openshift-kube-apiserver-operator:
notBefore=Feb 17 03:06:04 2020 GMT
notAfter=Mar 18 03:06:05 2020 GMT
...

So assigning back for csr-signer-signer, csr-signer and aggregator-client-signer

Comment 11 Maciej Szulik 2020-02-24 12:11:38 UTC
kcm bits are good, they were not shortened as were kas-o. Since kas-o short interval is tracked already in https://bugzilla.redhat.com/show_bug.cgi?id=1797593
I'm moving this back to qa.

Comment 14 zhou ying 2020-02-25 06:06:20 UTC
Refer https://bugzilla.redhat.com/show_bug.cgi?id=1797601#c11, will move to verified.


Note You need to log in before you can comment on or make changes to this bug.