Uploaded image for project: 'OpenShift Etcd'
  1. OpenShift Etcd
  2. ETCD-517

CEO render should reuse library-go rotation CAs, bundles and certs


    • Icon: Story Story
    • Resolution: Done
    • Icon: Normal Normal
    • None
    • None
    • None
    • 2
    • False
    • None
    • False
    • OCPSTRAT-1104 - [etcd] rotation of etcd signer certs when the cluster is still online
    • ETCD Sprint 248, ETCD Sprint 249

      Refactoring in ETCD-512 creates a rotation due to incompatible certificate creation processes. We should update the render [1] the same way the controller manages the certificates. Keep in mind that important information are always stored in annotations, which means we also need to update the manifest template itself (just exchanging file bytes isn't enough).


      • CEO should render the same certificates it would otherwise when the refactored CertSignerController runs
      • test that a fresh installation avoids re-creating certificates after the bootstrap phase

      [1] https://github.com/openshift/cluster-etcd-operator/blob/master/pkg/cmd/render/render.go#L347-L365

            tjungblu@redhat.com Thomas Jungblut
            tjungblu@redhat.com Thomas Jungblut
            0 Vote for this issue
            1 Start watching this issue