Bug 1840857 - openshift-apiserver doesn't live reload extension-apiserver-authentication trust
Summary: openshift-apiserver doesn't live reload extension-apiserver-authentication trust
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: openshift-apiserver
Version: 4.4
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.4.z
Assignee: Lukasz Szaszkiewicz
QA Contact: Xingxing Xia
URL:
Whiteboard:
Depends On: 1840856
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-05-27 17:42 UTC by Tomáš Nožička
Modified: 2020-06-17 22:27 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of: 1840856
Environment:
Last Closed: 2020-06-17 22:26:36 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github openshift cluster-openshift-apiserver-operator pull 366 None closed Bug 1840857: openshift-apiserver doesn't live reload extension-apiserver-authentication trust 2020-09-29 12:24:42 UTC
Github openshift openshift-apiserver pull 103 None closed Bug 1840857: openshift-apiserver doesn't live reload extension-apiserver-authentication trust 2020-09-29 12:24:42 UTC
Red Hat Product Errata RHBA-2020:2445 None None None 2020-06-17 22:27:01 UTC

Description Tomáš Nožička 2020-05-27 17:42:42 UTC
+++ This bug was initially created as a clone of Bug #1840856 +++

openshift-apiserver doesn't live reload extension-apiserver-authentication trust 

openssl verify -CAfile <( oc -n kube-system get cm extension-apiserver-authentication --template='{{index .data "requestheader-client-ca-file"}}' ) <( oc get secret -n openshift-kube-apiserver aggregator-client --template='{{index .data "tls.crt"}}' | base64 -d )
/proc/self/fd/12: OK

but kube-apiserver still can't connect to discovery

oc get apiservices v1.apps.openshift.io -o yaml
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1.apps.openshift.io
status:
  conditions:
  - lastTransitionTime: "2020-05-26T15:08:10Z"
    message: 'failing or missing response from https://10.130.0.18:8443/apis/apps.openshift.io/v1:
      bad status from https://10.130.0.18:8443/apis/apps.openshift.io/v1: 401'
    reason: FailedDiscoveryCheck
    status: "False"
    type: Available

Hit on recovery flow when the trust is rotated.

Comment 6 errata-xmlrpc 2020-06-17 22:26:36 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2445


Note You need to log in before you can comment on or make changes to this bug.