-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
None
-
Quality / Stability / Reliability
-
False
-
-
False
-
CLOSED
-
If Release Note Needed, Set a Value
-
Set a Value
-
Moderate
-
None
Description of problem:
When KNO (k8s-nmstate operator) is installed, the selfSignedCertificatesConfiguration should be taken from HCO and applied on k8s-nmstate components - but it's not.
Version-Release number of selected component (if applicable):
CNV 4.10.1
nmstate-1.2.1-1.el8.x86_64
How reproducible:
Always
Steps to Reproduce:
1. In a cluster, with either OCP 4.10 or OCP 4.11, and CNV 4.10.1, change the selfSignedCertificatesConfiguration setting in CNV HCO:
$ oc edit hyperconverged -n openshift-cnv kubevirt-hyperconverged
Add (under `spec`):
certConfig:
ca:
duration: 96h0m0s
renewBefore: 72h0m0s
server:
duration: 72h0m0s
renewBefore: 48h0m0s
2. Install standalone k8s-nmstate (I used CNV QE DevOps repo - link in the next, private comment).
3. After installation is completed - check the configuration in k8s-nmstate
$ oc get pod -n openshift-nmstate nmstate-cert-manager-857f69f5c8-sx6g6 -o yaml | less
Look for the vales of
CA_ROTATE_INTERVAL
CA_OVERLAP_INTERVAL
CERT_ROTATE_INTERVAL
CERT_OVERLAP_INTERVAL
Actual results:
Default values
- name: CA_ROTATE_INTERVAL
value: 8760h0m0s - name: CA_OVERLAP_INTERVAL
value: 24h0m0s - name: CERT_ROTATE_INTERVAL
value: 4380h0m0s - name: CERT_OVERLAP_INTERVAL
value: 24h0m0s
Expected results:
The ones that you configured:
- name: CA_ROTATE_INTERVAL
value: 96h0m0s - name: CA_OVERLAP_INTERVAL
value: 72h0m0s - name: CERT_ROTATE_INTERVAL
value: 72h0m0s - name: CERT_OVERLAP_INTERVAL
value: 48h0m0s
- external trackers