Loading...

XML

Word

Printable

Type: Epic
Resolution: Done
Priority: Undefined
Fix Version/s: None
Affects Version/s: None
Component/s: None
Labels:
None

Epic Name:
Migrate secrets of "SecretTypeTLS" type
Work Type:
Strategic Product Work
Blocked:
False
Blocked Reason:
None
Ready:
False
Color Status:
Not Selected
Epic Status:
To Do
Feature Link:
OCPSTRAT-709 - [internal] All OCP internal certificate chains must have clear ownership
Size:
L
Target Version:

openshift-4.16

SFDC Cases Links:
SFDC Cases Counter:
SFDC Cases Open:

Intelligence Requested:
Market:

TBD

Known affected components:

etcd-o ( [1] )

kcm-o ( [2], [3])

[1] https://github.com/openshift/cluster-etcd-operator/blob/eeef8033eb058b0f9899c7b16aead237d5b84462/manifests/0000_20_etcd-operator_03_secret.yaml#L3

[2] https://github.com/openshift/cluster-kube-controller-manager-operator/blob/351c1193c7eebb49054a289a17fc25dfc0e0cd73/bindata/bootkube/manifests/secret-csr-signer-signer.yaml#L10
[3] https://github.com/openshift/cluster-etcd-operator/pull/1234

incorporates

OCPSTRAT-1395 Automated control-plane recovery from expired certificates (hibernation)

Release Pending

is depended on by

OCPSTRAT-1364 Support TLS v1.3: Improve validation of TLS Modern Profile for Control-Plane components

In Progress

OCPSTRAT-1395 Automated control-plane recovery from expired certificates (hibernation)

Release Pending

links to

openshift/cluster-etcd-operator#1234: use RotatedSigningCASecret and RotatedSelfSignedCertKeySecret only in update mode

openshift/cluster-etcd-operator#1247: API-1800: manifests: convert SecretTypeTLS secrets to kubernetes.io/tls

openshift/cluster-kube-apiserver-operator#1659: OCPBUGS-31384: use RotatedSigningCASecret controller in update only mode

openshift/cluster-kube-apiserver-operator#1662: OCPBUGS-31807: Use RotatedSigningCASecret in update only mode

openshift/cluster-kube-controller-manager-operator#800: OCPBUGS-31384: use RotatedSigningCASecret and RotatedSelfSignedCertKeySecret only in update mode

openshift/cluster-kube-controller-manager-operator#801: OCPBUGS-31807: use RotatedSigningCASecret and RotatedSelfSignedCertKeySecret only in update mode

openshift/cluster-kube-controller-manager-operator#804: API-1800: bindata: convert SecretTypeTLS secrets

openshift/kubernetes#1924: OCPBUGS-31384: UPSTREAM: <carry>: allow type mutation for specific secrets

openshift/library-go#1773: OCPBUGS-38335: Revert "use update only secret-apply for cert rotation logic"

(7 links to)

Assignee:: Vadim Rutkovsky

Reporter:: Abu H Kashem

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Created:: 2024/04/01 5:04 PM

Updated:: 2024/11/23 12:26 AM

Resolved:: 2024/05/22 8:33 PM