-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
ACM 2.14.0
-
None
-
Moderate
-
None
Description of problem:
ACM gitops addon uses `kube-apiserver-lb-signer` instead of `ManagedCluster.spec.managedClusterClientConfigs[].caBundle` when generating the argoCD cluster secrets, resulting in incorrect `caData` in the kubeconfig.
Version-Release number of selected component (if applicable):
RHACM 2.14
gitops 3.1
How reproducible:
customer environment
Steps to Reproduce:
- configure a cabundle for the managedcluster
- make the acm argocd plugin generate the arcocd cluster secrets
- ...
Actual results:
kubeconfigs generated with incorrect cadata causing argocd to fail all tls valiadation for acm-managed clusters with a `x509 certificate signed by unknown authority`
Expected results:
kubeconfigs generate with the data from `ManagedCluster.spec.managedClusterClientConfigs[].caBundle` instead of `kube-apiserver-lb-signer` when set.
Additional info:
managedserviceaccount is enabled
gitops addon is enagled (gitopscluster + placement)