Uploaded image for project: 'Red Hat Advanced Cluster Management'
  1. Red Hat Advanced Cluster Management
  2. ACM-23000

CertificatePolicy execution in a namespace with a great amount of secrets produces a lot of "Skipping this secret" logs that can clog up PVs

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • ACM 2.15.0
    • ACM 2.11.0, ACM 2.12.0
    • GRC
    • 1
    • GRC Sprint 2025-16
    • Moderate
    • None

      Description of problem:

      CertificatePolicy execution in a namespace(s) with a great amount of secrets (8000+ in the observed environment) produces a lot of "Skipping this secret" logs that can clogs storage.

      As per documentation, "The certificate policy controller automatically looks for a certificate in a secret in only the tls.crt key", having a lot of messages that states that a secret have been skipped since it does not have a certificate in it can cause a lot of not that useful noise.

      Version-Release number of selected component (if applicable):

      ACM 2.11

      ACM 2.12

      How reproducible:

      Always reproducible

      Steps to Reproduce:

      1. Install ACM
      2. Create a Policy using policy template "Certificate management expiration"
      3. Apply policy to any cluster (local-cluster or managed)
      4. Use namespaceSelector.include to include namespace you desire
      5. Check logs from pod cert-policy-controller in open-cluster-management-agent-addon namespace

      Actual results:

      Secret in targeted namespaces are checked and if dose not contains tls.crt in it they are skipped and produce an entry like "Skipping this secret" in pod cert-policy-controller-xyz

      Expected results:

      Messages like "Skipping this secret" are expected but if there are many secrets, logs are putting storage to a risk.

      Additional info:

              jkulikau@redhat.com Justin Kulikauskas
              rhn-support-mbrigida Marco Brigida
              Derek Ho Derek Ho
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: