Description of problem: In passthrough mode the CCO copies the root credentials secret (kube-system/aws-creds etc) to all CredentialsRequests. When this root secret is updated, CCO is not presently immediately updating all those secrets as it incorrectly assumes if we've synced within last 2 hours, we should wait until a sync is due. Version-Release number of selected component (if applicable): 4.6 How reproducible: Very Steps to Reproduce: 1. Deploy CCO in passthrough mode on AWS or any other cloud desired. 2. Update the root secret in kube-system/aws-creds 3. Observe any of the target Secrets specified in the CredentialsRequests in openshift-cloud-credential-operator namespace. Actual results: Change will not immediately flow out to the dependent secrets, potentially taking 2 hours. Expected results: Immediately update all dependent secrets. Additional info: Fixed in 4.7 already, but needs a backport to 4.6 and 4.5. Once in 4.6 we will cherry pick again to 4.5.
Fixed in 4.7: https://github.com/openshift/cloud-credential-operator/pull/242
After discussion with PM, we don't think there's any requirement today to backport this work to 4.6. Closing for now.
Turns out somebody does need this. :) Reopening.
Is this needed in 4.5 too?
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:5633