Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-59527

Invalid target signer validity is preventing from issuing node-system-admin-client for 2 years

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • Done
    • Bug Fix
    • Hide
      * Before this update, the node-system-admin-signer's validity was limited to one year and was not extended or refreshed at 2.5 years, hindering the issuance of the node-system-admin-client for two years. In this update, the node-system-admin-signer's validity is now actively set to last for three years, allowing for the issuance of the node-system-admin-client during a two-year period. (link:https://issues.redhat.com/browse/OCPBUGS-59527[OCPBUGS-59527])
      ____
      *Cause*: Target certificate lifetime depends on signer lifetime, so when target certificate is created it cannot be valid longer than the signer used to create it
      *Consequence*: node-system-admin-client duration is set to 1 year instead of expected 2, so localhost-recovery.kubeconfig is valid for 1 year only
      *Fix*: Signer validity extended to 3 years, so now node-system-admin-client validity is now set to two years as desired
      *Result*: localhost-recovery.kubeconfig doesn't expire after 1 year and now valid for two years
      Show
      * Before this update, the node-system-admin-signer's validity was limited to one year and was not extended or refreshed at 2.5 years, hindering the issuance of the node-system-admin-client for two years. In this update, the node-system-admin-signer's validity is now actively set to last for three years, allowing for the issuance of the node-system-admin-client during a two-year period. (link: https://issues.redhat.com/browse/OCPBUGS-59527 [ OCPBUGS-59527 ]) ____ *Cause*: Target certificate lifetime depends on signer lifetime, so when target certificate is created it cannot be valid longer than the signer used to create it *Consequence*: node-system-admin-client duration is set to 1 year instead of expected 2, so localhost-recovery.kubeconfig is valid for 1 year only *Fix*: Signer validity extended to 3 years, so now node-system-admin-client validity is now set to two years as desired *Result*: localhost-recovery.kubeconfig doesn't expire after 1 year and now valid for two years
    • None
    • None
    • None
    • None

      Description of problem:

          Target cert validity cannot be longer than signer validity. As a result, node-system-admin-client cannot be issued for 2 years as node-system-admin-signer is valid for 1 year only.
Signer validity should be extended to 3 years (and refreshed at 2.5 years)

      Version-Release number of selected component (if applicable):

      How reproducible:

      Steps to Reproduce:

          1.
    2.
    3.

      Actual results:

      Expected results:

      Additional info:

              vrutkovs@redhat.com Vadim Rutkovsky
              vrutkovs@redhat.com Vadim Rutkovsky
              None
              None
              Ke Wang Ke Wang
              None
              Votes:
              1 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated: