Bug 1821683 - On recovery flow the csr-controller-ca isn't propagated to openshift-config-managed namespace
Summary: On recovery flow the csr-controller-ca isn't propagated to openshift-config-m...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: kube-controller-manager
Version: 4.4
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.4.0
Assignee: Tomáš Nožička
QA Contact: zhou ying
URL:
Whiteboard:
: 1817997 (view as bug list)
Depends On: 1818420 1821680
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-04-07 12:09 UTC by Tomáš Nožička
Modified: 2020-05-05 07:02 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of: 1821680
Environment:
Last Closed: 2020-05-04 11:48:34 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github openshift cluster-kube-controller-manager-operator pull 393 None closed [release-4.4] Bug 1821683: Sync csr-controller-ca to openshift-config-managed namespace 2020-10-12 10:27:03 UTC
Red Hat Product Errata RHBA-2020:0581 None None None 2020-05-04 11:49:00 UTC

Description Tomáš Nožička 2020-04-07 12:09:51 UTC
+++ This bug was initially created as a clone of Bug #1821680 +++

When recovering from expired certificates, the refreshed csr-controller-ca configmap needs to be propagated to openshift-config-managed namespace to be consumed by CKAO to trust the new client certs.

Comment 3 zhou ying 2020-04-17 01:16:13 UTC
Confirmed with payload: 4.4.0-0.nightly-2020-04-15-095927, after stop more than 24hours , the issue can't reproduce now:

[root@dhcp-140-138 ~]# oc get clusterversion 
NAME      VERSION                             AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.4.0-0.nightly-2020-04-15-095927   True        False         35h     Cluster version is 4.4.0-0.nightly-2020-04-15-095927


[root@dhcp-140-138 ~]# oc get secrets csr-signer  -n openshift-kube-controller-manager  -o json |jq -r '.data."tls.crt"'   |base64 -d |openssl x509 -in - --text 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5204450091857526175 (0x4839ebc8c06abd9f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = openshift-kube-controller-manager-operator_csr-signer-signer@1587082310
        Validity
            Not Before: Apr 17 00:11:50 2020 GMT
            Not After : May 17 00:11:51 2020 GMT

[root@dhcp-140-138 ~]# oc get configmap csr-controller-ca -n openshift-config-managed  -o json |jq -r '.data."ca-bundle.crt"'  |openssl x509 -in - --text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5204450091857526175 (0x4839ebc8c06abd9f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = openshift-kube-controller-manager-operator_csr-signer-signer@1587082310
        Validity
            Not Before: Apr 17 00:11:50 2020 GMT
            Not After : May 17 00:11:51 2020 GMT

Comment 5 errata-xmlrpc 2020-05-04 11:48:34 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0581

Comment 6 Tomáš Nožička 2020-05-04 14:51:41 UTC
*** Bug 1817997 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.