Details
-
Bug
-
Resolution: Done
-
Critical
-
None
-
4.11.z
-
None
-
Important
-
2
-
Sprint 228, Sprint 229
-
2
-
Rejected
-
False
-
Description
This is a clone of issue OCPBUGS-3049. The following is the description of the original issue:
—
This is a copy of Bugzilla bug 2117524 for backport to 4.11.z
Original Text:
Description of problem:
On routers configured with mTLS and CRL defined in the CA with a CDP ; new CRL is downloaded only when restarting the ingress-operator.
2022-07-20T23:36:26.943Z INFO operator.clientca_configmap_controller controller/controller.go:298 reconciling {"request": "openshift-ingress-operator/service-bdrc"}
2022-07-20T23:36:26.943Z INFO operator.crl crl/crl_configmap.go:69 certificate revocation list has expired {"subject key identifier": "6aa909992e9890457b2a8de5659a44cab8e867a8"}
2022-07-20T23:36:26.943Z INFO operator.crl crl/crl_configmap.go:69 retrieving certificate revocation list {"subject key identifier": "6aa909992e9890457b2a8de5659a44cab8e867a8"}
2022-07-20T23:36:26.943Z INFO operator.crl crl/crl_configmap.go:169 retrieving CRL distribution point {"distribution point": "http://crl.domain.com/der/CN=XXXX,OU=XXX,O=XXX,C=XXX"}
Version-Release number of selected component (if applicable):
4.9.33
How reproducible:
Enable mTLS with a CRL
Actual results:
CRL is not download when expired
Clients get "SSL client certificate not trusted" errors while accessing resources
Expected results:
ingress-operator triggers CRL download when approaching expiration date so that the configmap is updated without manual action
Attachments
Issue Links
- blocks
-
-
- Closed
-
- clones
-
-
- Closed
-
- is blocked by
-
-
- Closed
-
- is cloned by
-
-
- Closed
-
- links to