Uploaded image for project: 'OpenShift API Server'
  1. OpenShift API Server
  2. API-1603

Fallback (Protocol) for Emergency Certificate Rotation

XMLWordPrintable

    • Icon: Epic Epic
    • Resolution: Unresolved
    • Icon: Critical Critical
    • None
    • openshift-4.13
    • kube-apiserver
    • Fallback (Protocol) for Emergency Certificate Rotation
    • False
    • None
    • False
    • Not Selected
    • To Do
    • 50
    • 50% 50%

      https://docs.google.com/document/d/198C4xwi5td_V-yS6w-VtwJtudHONq0tbEmjknfccyR0/edit#heading=h.oynu7bkhz613

       

      Goal:

      • recover the cluster when certs expire while a node is down
      • should work for OpenShift (both HA and Single)
      • Ideally, if possible, we want to make it an automated repair process. 
      • cover both rebooted node and suspended node
      • Evaluate (during the research) effort to provide a mechanism to the admin so he/she can trigger a cert regeneration

       

      Non Goal:

      • change host name / node identity
      • make rotation faster
      • any existing cert we have today should not have modified expiration period

       

      Acceptance Criteria:

      • documentation with findings
      • OpenShift KEP 

        1.
        		 ETCD: Automatic renewal of peer, serving and serving-metrics certificates in case of their expiration Sub-task New Critical Haseeb Tariq
        2.
        		 ETCD: Recover the etcd cluster when certificates expire. Sub-task New Undefined Unassigned
        3.
        		 Add e2e Test Sub-task In Progress Undefined Vadim Rutkovsky
        4.
        		 Automatic CSR approval for master node/kubelet Sub-task Closed Undefined Vadim Rutkovsky
        5.
        		 [spike] kube-apiserver automatic reloading of certs Sub-task New Undefined Unassigned
        6.
        		 [spike] investigate certificate renewal/recovery for components Sub-task New Undefined Vadim Rutkovsky
        7.
        		 [spike] investigate KCM’s SA signer, rotation might not work but expiry must Sub-task New Undefined Vu Dinh
        8.
        		 [spike] kubelet dependency on external cloud provider Sub-task New Undefined Damien Grisonnet
        9.
        		 [spike] investigate kubeconfig renewal Sub-task New Undefined Unassigned
        10.
        		 [spike] investigate client-go: doesn’t auto-reload (bounded)tokens and CAs Sub-task New Undefined Unassigned
        11.
        		 design and implement auto approver for kubelet CSRs for worker nodes Sub-task New Undefined Unassigned
        12.
        		 Implement `workflow-test` for cluster-bot Sub-task Closed Undefined Vadim Rutkovsky

            dgrisonn@redhat.com Damien Grisonnet
            dgrisonn@redhat.com Damien Grisonnet
            Votes:
            0 Vote for this issue
            Watchers:
            18 Start watching this issue

              Created:
              Updated: