Loading...

XML

Word

Printable

Type: Bug
Resolution: Unresolved
Priority: Normal
Fix Version/s: None
Affects Version/s: 4.20
Component/s: kube-apiserver
Labels:
None

Activity Type:
Quality / Stability / Reliability
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Story Points:
None
Severity:
Moderate
Regression:
None

Target Backport Versions:
None
Target Version:

4.20.0
Release Blocker:
None
Sprint:
None

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

Release Note Status:
None
Release Note Type:
None
Release Note Text:
None

Escape Reason:
None
Escape Impact:
None
Corrective Measures:
None
SDLC stage when should've been found:
None

Description of problem:

    1. As the BoundServiceAccountTokenVolume featureGate is enabled in Kubernetes v1.22
    2. with this PR https://github.com/openshift/kubernetes/pull/714, ocp will inject the service-ca.crt into the token
    3. there is no need to bound the kube-root-ca.crt cm into the kube-api-access, the auto-generated kube-api-access-xxx also has the kube-root-ca.crt now

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:

    1.
    2.
    3.

Actual results:

Expected results:

Additional info:

links to

openshift/cluster-kube-apiserver-operator#1896: OCPBUGS-60496: Use BoundServceAccountTokenVolume dy default

Assignee:: Unassigned

Reporter:: 天兰

Need Info From:: None

Contributors:: None

QA Contact:: None

Doc Contact:: None

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Created:: 2025/08/14 5:45 AM

Updated:: 2025/08/14 9:48 AM