Uploaded image for project: 'OpenShift Hosted Control Plane'
  1. OpenShift Hosted Control Plane
  2. HOSTEDCP-1231

management cluster network access for external OIDC

XMLWordPrintable

    • Icon: Epic Epic
    • Resolution: Done
    • Icon: Undefined Undefined
    • openshift-4.15
    • None
    • None
    • None
    • management-network-access-oidc
    • Product / Portfolio Work
    • OCPSTRAT-933Hypershift guest cluster can use external OIDC token issuer
    • False
    • Hide

      None

      Show
      None
    • False
    • Not Selected
    • None
    • None
    • None
    • 0

      Goal

      • The kube-apiserver must have access to the configured token issuer URL in order to verify a particular token.
      • The well-known for issuer provides additional URLs that are contacted and trusted.  at least the jwksURL, not sure if others are the userInfo URL and token URL are used by kube.

      Why is this important?

      • without this access, the kube-apiserver unable to validate the token signatures

      Scenarios

      1. ...

      Acceptance Criteria

      • Dev - Has a valid enhancement if necessary
      • CI - MUST be running successfully with tests automated
      • QE - covered in Polarion test plan and tests implemented
      • Release Technical Enablement - Must have TE slides
      • ...

      Dependencies (internal and external)

      1. ...

      Previous Work (Optional):

      Open questions:

      Done Checklist

      • CI - CI is running, tests are automated and merged.
      • Release Technical Enablement <link to Feature Enablement Presentation>
      • DEV - Upstream documentation merged: <link to meaningful PR or GitHub Issue>
      • DEV - Enhancement merged: <link to meaningful PR or GitHub Issue>
      • QE - Test plans in Polarion: <link or reference to Polarion>
      • QE - Automated tests merged: <link or reference to automated tests>
      • DOC - Downstream documentation merged: <link to meaningful PR>

              Unassigned Unassigned
              deads@redhat.com David Eads
              None
              None
              None
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: