Uploaded image for project: 'OpenShift Virtualization'
  1. OpenShift Virtualization
  2. CNV-21750

[2081308] selfSignedCertificatesConfiguration from CNV HCO not propagated to standalone k8s-nmstate

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • None
    • None
    • CNV Network
    • Moderate
    • None

      Description of problem:
      When KNO (k8s-nmstate operator) is installed, the selfSignedCertificatesConfiguration should be taken from HCO and applied on k8s-nmstate components - but it's not.

      Version-Release number of selected component (if applicable):
      CNV 4.10.1
      nmstate-1.2.1-1.el8.x86_64

      How reproducible:
      Always

      Steps to Reproduce:
      1. In a cluster, with either OCP 4.10 or OCP 4.11, and CNV 4.10.1, change the selfSignedCertificatesConfiguration setting in CNV HCO:
      $ oc edit hyperconverged -n openshift-cnv kubevirt-hyperconverged

      Add (under `spec`):
      certConfig:
      ca:
      duration: 96h0m0s
      renewBefore: 72h0m0s
      server:
      duration: 72h0m0s
      renewBefore: 48h0m0s

      2. Install standalone k8s-nmstate (I used CNV QE DevOps repo - link in the next, private comment).

      3. After installation is completed - check the configuration in k8s-nmstate
      $ oc get pod -n openshift-nmstate nmstate-cert-manager-857f69f5c8-sx6g6 -o yaml | less
      Look for the vales of
      CA_ROTATE_INTERVAL
      CA_OVERLAP_INTERVAL
      CERT_ROTATE_INTERVAL
      CERT_OVERLAP_INTERVAL

      Actual results:
      Default values

      • name: CA_ROTATE_INTERVAL
        value: 8760h0m0s
      • name: CA_OVERLAP_INTERVAL
        value: 24h0m0s
      • name: CERT_ROTATE_INTERVAL
        value: 4380h0m0s
      • name: CERT_OVERLAP_INTERVAL
        value: 24h0m0s

      Expected results:
      The ones that you configured:

      • name: CA_ROTATE_INTERVAL
        value: 96h0m0s
      • name: CA_OVERLAP_INTERVAL
        value: 72h0m0s
      • name: CERT_ROTATE_INTERVAL
        value: 72h0m0s
      • name: CERT_OVERLAP_INTERVAL
        value: 48h0m0s

              Unassigned Unassigned
              ysegev@redhat.com Yossi Segev
              Yossi Segev Yossi Segev
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: