Loading...

XML

Word

Printable

Type: Story
Resolution: Done
Priority: Major
Fix Version/s: openshift 4.15
Affects Version/s: None
Component/s: None
Labels:
None

Blocked:
False
Blocked Reason:
None
Ready:
False
Epic Link:
Hypershift issues cluster-admin kubeconfig usable by the customer
Feature Link:
OCPSTRAT-956 - Enable Break Glass access Mechanism for Cloud Services (ROSA as MVP)
Intelligence Requested:
Market:

Sprint:
Hypershift Sprint 249
Cost of Delay:
0
WSJF:
0
Risk Score:
0

SFDC Cases Links:
SFDC Cases Counter:
SFDC Cases Open:

Customers need to be able to request the revocation of the signer cert for their break-glass credentials and know when it's been done. See design here: https://docs.google.com/document/d/19l48HB7-4_8p96b2kvlpYFpbZXCh5eXN_tEmM8QhaIc/edit#heading=h.1a08yt9sno82 and diagram here: https://miro.com/app/board/uXjVNUPFcQA=/

clones

HOSTEDCP-1257 Create controller for approving and issuing signed customer certs

Closed

is blocked by

HOSTEDCP-1256 Create a short lived signer with rotation for signing customer certs

Closed

links to

openshift/hypershift#3326: HOSTEDCP-1344: use library-go crypto where we can

openshift/hypershift#3339: OCPBUGS-29088,HOSTEDCP-1344: control-plane-pki-operator: add a revocation controller

openshift/hypershift#3448: HOSTEDCP-1344: api: move CSRA to a new group

openshift/hypershift#3460: TRT-1456: Revert #3448 "HOSTEDCP-1344: api: move CSRA to a new group"

openshift/hypershift#3463: HOSTEDCP-1344: re-revert api stuff

openshift/library-go#1639: HOSTEDCP-1344: pkg/crypto: expose an unsafe self-signed cert generator

(3 links to)

Assignee:: Steve Kuznetsov

Reporter:: Seth Jennings

QA Contact:: Jie Zhao

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Created:: 2023/12/08 3:23 PM

Updated:: 2024/02/19 3:27 AM

Resolved:: 2024/02/19 3:27 AM