-
Bug
-
Resolution: Unresolved
-
Major
-
ACM 2.11.0, ACM 2.12.0
-
1
-
GRC Sprint 2025-16
-
Moderate
-
None
Description of problem:
CertificatePolicy execution in a namespace(s) with a great amount of secrets (8000+ in the observed environment) produces a lot of "Skipping this secret" logs that can clogs storage.
As per documentation, "The certificate policy controller automatically looks for a certificate in a secret in only the tls.crt key", having a lot of messages that states that a secret have been skipped since it does not have a certificate in it can cause a lot of not that useful noise.
Version-Release number of selected component (if applicable):
ACM 2.11
ACM 2.12
How reproducible:
Always reproducible
Steps to Reproduce:
- Install ACM
- Create a Policy using policy template "Certificate management expiration"
- Apply policy to any cluster (local-cluster or managed)
- Use namespaceSelector.include to include namespace you desire
- Check logs from pod cert-policy-controller in open-cluster-management-agent-addon namespace
Actual results:
Secret in targeted namespaces are checked and if dose not contains tls.crt in it they are skipped and produce an entry like "Skipping this secret" in pod cert-policy-controller-xyz
Expected results:
Messages like "Skipping this secret" are expected but if there are many secrets, logs are putting storage to a risk.
Additional info:
- is cloned by
-
ACM-23248 [2.14] CertificatePolicy execution in a namespace with a great amount of secrets produces a lot of "Skipping this secret" logs that can clog up PVs
-
- Closed
-