Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-42431

Hypershift is managing kubeconfigs for DNS and Ingress operators

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Normal Normal
    • 4.16.z
    • 4.15
    • HyperShift
    • Moderate
    • None
    • False
    • Hide

      None

      Show
      None
    • Hide
      * Previously, the Ingress and DNS operators failed to start correctly because of rotating root certificates. With this release, the Ingress and DNS operator Kubeconfigs are conditionally managed by using the annotation that defines when the PKI requires management and the issue is resolved.. (link:https://issues.redhat.com/browse/OCPBUGS-42431[*OCPBUGS-42431*])
      -------
      Cause - Rotating root certificates.
      Consequence - The Ingress and DNS operators will fail to start correctly during the rotation process.
      Fix - Conditionally manage the Ingress and DNS operator Kubeconfigs based on the annotation defining when to manage PKI.
      Result - The Ingress and DNS operators will start correctly during the rotation process.
      Show
      * Previously, the Ingress and DNS operators failed to start correctly because of rotating root certificates. With this release, the Ingress and DNS operator Kubeconfigs are conditionally managed by using the annotation that defines when the PKI requires management and the issue is resolved.. (link: https://issues.redhat.com/browse/OCPBUGS-42431 [* OCPBUGS-42431 *]) ------- Cause - Rotating root certificates. Consequence - The Ingress and DNS operators will fail to start correctly during the rotation process. Fix - Conditionally manage the Ingress and DNS operator Kubeconfigs based on the annotation defining when to manage PKI. Result - The Ingress and DNS operators will start correctly during the rotation process.
    • Bug Fix
    • In Progress

      This is a clone of issue OCPBUGS-41824. The following is the description of the original issue:
      —
      Description of problem:

          The kubeconfigs for the DNS Operator and the Ingress Operator are managed by Hypershift and they should only be managed by the cloud service provider. This can lead to the kubeconfig/certificate being invalid in the cases where the cloud service provider further manages the kubeconfig (for example ca-rotation).

      Version-Release number of selected component (if applicable):

      How reproducible:

      Steps to Reproduce:

          1.
    2.
    3.

      Actual results:

      Expected results:

      Additional info:

            rcradick Ryan Cradick
            openshift-crt-jira-prow OpenShift Prow Bot
            Jie Zhao Jie Zhao
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: