Loading...

XML

Word

Printable

Type: Bug
Resolution: Unresolved
Priority: Major
Fix Version/s: 4.20.0
Affects Version/s: 4.14, 4.15, 4.16, 4.17, 4.18, 4.19
Component/s: Installer / Agent based installation
Labels:
- triaged

Activity Type:
Quality / Stability / Reliability
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Story Points:
None
Severity:
Important
Regression:
None

Target Backport Versions:
None
Target Version:

4.20
Release Blocker:
Rejected
Sprint:
Agent Sprint 273
sprint_count:
1

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

PX Impact Score:

Release Note Status:
Done
Release Note Type:
Bug Fix
Release Note Text:

Hide
* Before this update, after an installation was completed, the `kubeconfig` file generated by the Agent-based Installer did not contain the ingress router certificate authority (CA). With this release, the `kubeconfig file contains the ingress router CA upon the completion of a cluster installation. (link:https://issues.redhat.com/browse/OCPBUGS-45256[OCPBUGS-45256])

Show
* Before this update, after an installation was completed, the `kubeconfig` file generated by the Agent-based Installer did not contain the ingress router certificate authority (CA). With this release, the `kubeconfig file contains the ingress router CA upon the completion of a cluster installation. (link: https://issues.redhat.com/browse/OCPBUGS-45256 [ OCPBUGS-45256 ])

Escape Reason:
None
Escape Impact:
None
Corrective Measures:
None
SDLC stage when should've been found:
None

Description of problem:

    The kubeconfig generate via the openshift-install agent create command does not contain the router CA from the default-ingress-cert

Version-Release number of selected component (if applicable):

How reproducible:

    always

Steps to Reproduce:

    1. openshift-install agent create image
    2. Check the content of the generated kubeconfig

Actual results:

    conformance parallel test [sig-auth][Feature:LDAP] LDAP IDP should authenticate against an ldap server [apigroup:user.openshift.io][apigroup:route.openshift.io] [Suite:openshift/conformance/parallel] fails

Expected results:

    conformance parallel test [sig-auth][Feature:LDAP] LDAP IDP should authenticate against an ldap server [apigroup:user.openshift.io][apigroup:route.openshift.io] [Suite:openshift/conformance/parallel] must pass

Additional info:

    The non-ABI installation modifies the generated kubeconfig via the addRouterCAToClusterCA() method, which is always included in the create command (but not as an asset). The same does not happen for the ABI create command

blocks

OCPBUGS-60003 ABI generated kubeconfig does not contain default-ingress-cert

Closed

MULTIARCH-5021 Agent based workflow seems to be missing for a cert in kubeconfig

Closed

is cloned by

OCPBUGS-60003 ABI generated kubeconfig does not contain default-ingress-cert

Closed

links to

openshift/installer#7678: OCPBUGS-18658 OCPBUGS-45256: Unify agent install-complete with installer

Skip test PR

Assignee:: Robert Fournier

Reporter:: Andrea Fasano

Need Info From:: None

Contributors:: Shilpa Gokul

QA Contact:: zhenying niu

Doc Contact:: None

Votes:: 0 Vote for this issue

Watchers:: 13 Start watching this issue

Created:: 2024/12/02 11:56 AM

Updated:: 2025/10/17 4:40 PM

Details

Description

Attachments

Issue Links

Easy Agile Planning Poker

Activity

People

Dates

Hide