Description of problem: Version-Release number of selected component (if applicable): 4.10.0-0.nightly-2022-01-05-181126 How reproducible: Always Steps to Reproduce: 1. due to limitation reported in bug https://bugzilla.redhat.com/show_bug.cgi?id=2037635, we can only configure custom certificate for default console route in console.operator $ oc --namespace openshift-config create secret tls custom-console-component --cert=apps.crt --key=apps.key $ oc edit console.operator cluster $ oc get console.operator cluster -o json | jq .spec { "logLevel": "Normal", "managementState": "Managed", "operatorLogLevel": "Normal", "route": { "secret": { "name": "custom-console-component" } } } 2. open default console route URL in browser and check certificates Actual results: 2. default console route still use default certificates Expected results: 2. default console route should use customized certificates Additional info: reference bug https://bugzilla.redhat.com/show_bug.cgi?id=1870514
when we ONLY configure customized certs for default console route, we don't need specify hostname in console.operator/cluster, also console pods will not be restarted
part of console-operator logs I0106 07:27:10.450430 1 status_controller.go:211] clusteroperator/console diff {"status":{"conditions":[{"lastTransitionTime":"2022-01-06T07:23:37Z","message":"RouteHealthDegraded: console route is not admitted","reason":"RouteHealth_RouteNotAdmitted","status":"True","type":"Degraded"},{"lastTransitionTime":"2022-01-05T23:56:50Z","message":"All is well","reason":"AsExpected","status":"False","type":"Progressing"},{"lastTransitionTime":"2022-01-06T07:21:49Z","message":"RouteHealthAvailable: console route is not admitted","reason":"RouteHealth_RouteNotAdmitted","status":"False","type":"Available"},{"lastTransitionTime":"2022-01-05T23:48:57Z","message":"All is well","reason":"AsExpected","status":"True","type":"Upgradeable"}]}} I0106 07:27:10.565145 1 event.go:285] Event(v1.ObjectReference{Kind:"Deployment", Namespace:"openshift-console-operator", Name:"console-operator", UID:"dbbe6b36-d958-46c6-b172-a9c73cd5b3cc", APIVersion:"apps/v1", ResourceVersion:"", FieldPath:""}): type: 'Normal' reason: 'OperatorStatusChanged' Status for clusteroperator/console changed: Degraded message changed from "RouteHealthDegraded: console route is not admitted\nSyncLoopRefreshDegraded: routes.route.openshift.io \"console-custom\" not found" to "RouteHealthDegraded: console route is not admitted" I0106 07:27:11.555545 1 request.go:665] Waited for 1.002835359s due to client-side throttling, not priority and fairness, request: GET:https://172.30.0.1:443/apis/config.openshift.io/v1/ingresses/cluster W0106 07:27:11.580988 1 controller.go:142] Deprecated: custom domain is being configured on console-operator config for the 'console' route. Please remove that entry from console-operator config and instead configure ingress config spec with following custom domain entry for 'console' route: ---- spec: componentRoutes: - name: console namespace: openshift-console servingCertKeyPairSecret: name: console-specificcert
This bug shall be fixed as part of https://bugzilla.redhat.com/show_bug.cgi?id=2037635
1. set customized certs for default console route either in ingress.config(bug 2037635) or console.operator $ oc get console.operator cluster -o json | jq .spec { "logLevel": "Normal", "managementState": "Managed", "operatorLogLevel": "Normal", "route": { "hostname": "console-openshift-console.apps.ci-ln-x09q8r2-72292.origin-ci-int-gce.dev.rhcloud.com", "secret": { "name": "custom-console-component" } } } 2. no errors in console-operator logs, and default console route certs is updated accordingly oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.10.0-0.nightly-2022-01-12-033357 True False 21m Cluster version is 4.10.0-0.nightly-2022-01-12-033357
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:0056