Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-54946

Add validation to check that NamedCertificates and the Internal Certificate SAN does not have conflicting domains

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • Done
    • Bug Fix
    • Hide
      *Cause*: The SAN of the custom certificate added by the user to the field hc.spec.configuration.apiServer.servingCerts.namedCertificates, is conflicting with the hostname set in the hc.spec.services.servicePublishingStrategy for the KAS.
      *Consequence*: The KAS certificate is not added to the set of certificates to generate a new payload, then the new nodes to join the HostedCluster will face an issue with the certificates validation.
      *Fix*: Added a validation to fail earlier and warn the user about the issue
      *Result*: Bug will not happen.
      Show
      *Cause*: The SAN of the custom certificate added by the user to the field hc.spec.configuration.apiServer.servingCerts.namedCertificates, is conflicting with the hostname set in the hc.spec.services.servicePublishingStrategy for the KAS. *Consequence*: The KAS certificate is not added to the set of certificates to generate a new payload, then the new nodes to join the HostedCluster will face an issue with the certificates validation. *Fix*: Added a validation to fail earlier and warn the user about the issue *Result*: Bug will not happen.
    • None
    • None
    • None
    • None

      This is a clone of issue OCPBUGS-53261. The following is the description of the original issue:
      —
      As we discussed in both related issues, there are some situations that could make your HostedCluster configuration to not work properly. In this case is regarding the SAN recorded in the KAS NamedCertificates provided by the customer/user and the SAN recorded in both certificates to host the KAS (Internal and External) we create from our RootCA. The conflicting situation is:

      • You cannot have the NamedCertificates with a SAN recorded that conflicts with the internal API url
      • The servicePublishingStrategy.loadBalancer.hostname records the internal API url that will be set into the kubelets.

      So the NamedCertificate should contain a SAN that points to a CNAME that your DNS will redirect to the hostname set into the servicePublishingStrategy.loadBalancer.hostname. This will make your configuration work properly.

              jparrill@redhat.com Juan Manuel Parrilla Madrid
              openshift-crt-jira-prow OpenShift Prow Bot
              None
              None
              Wen Wang Wen Wang
              None
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: