Loading...

XML

Word

Printable

Type: Bug
Resolution: Duplicate
Priority: Undefined
Fix Version/s: None
Affects Version/s: 4.20
Component/s: HyperShift / OCP Virtualization
Labels:
- component-regression

Activity Type:
Quality / Stability / Reliability
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Story Points:
None
Severity:
None
Regression:
None

Target Backport Versions:
None
Target Version:

4.20.0
Release Blocker:
Approved
Sprint:
None

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

PX Impact Score:

Release Note Status:
None
Release Note Type:
None
Release Note Text:
None

Escape Reason:
None
Escape Impact:
None
Corrective Measures:
None
SDLC stage when should've been found:
None

This is a clone of issue OCPBUGS-61825. The following is the description of the original issue:
—
(Feel free to update this bug's summary to be more specific.)
Component Readiness has found a potential regression in the following test:

TestCreateCluster/Main/break-glass-credentials/sre-break-glass/CSR_flow

Significant regression detected.
Fishers Exact probability of a regression: 100.00%.
Test pass rate dropped from 100.00% to 92.42%.

Sample (being evaluated) Release: 4.20
Start Time: 2025-09-09T00:00:00Z
End Time: 2025-09-16T16:00:00Z
Success Rate: 92.42%
Successes: 61
Failures: 5
Flakes: 0
Base (historical) Release: 4.19
Start Time: 2025-05-18T00:00:00Z
End Time: 2025-06-17T23:59:59Z
Success Rate: 100.00%
Successes: 144
Failures: 0
Flakes: 0

View the test details report for additional context.

Failure message looks as follows:

TestCreateCluster/Main/break-glass-credentials/sre-break-glass/CSR_flow expand_less 	1s
{Failed  === RUN   TestCreateCluster/Main/break-glass-credentials/sre-break-glass/CSR_flow
    pki.go:76: loading certificate/key pair from disk for signer sre-break-glass, use $REGENERATE_PKI to generate new ones
    control_plane_pki_operator.go:201: creating CSR "cr4k1g3xob0b24mlbcykk6db22pw6qd2c1hnnwrds5s" for signer "sre-break-glass", requesting client auth usages
    control_plane_pki_operator.go:211: creating CSRA e2e-clusters-2x7gx-create-cluster-5sm8j/cr4k1g3xob0b24mlbcykk6db22pw6qd2c1hnnwrds5s to trigger automatic approval of the CSR
    control_plane_pki_operator.go:218: Successfully waited for CSR "cr4k1g3xob0b24mlbcykk6db22pw6qd2c1hnnwrds5s" to be approved and signed in 75ms
    control_plane_pki_operator.go:130: validating that the client certificate provides the appropriate access
    control_plane_pki_operator.go:116: amending the existing kubeconfig to use break-glass client certificate credentials
    control_plane_pki_operator.go:133: issuing SSR to identify the subject we are given using the client certificate
    control_plane_pki_operator.go:137: got an unauthorized error for SSR, debugging certificates
    control_plane_pki_operator.go:138: client certificate: -----BEGIN CERTIFICATE-----
        MIIDYjCCAkqgAwIBAgIIE0Qgjkp3gNYwDQYJKoZIhvcNAQELBQAwVTFTMFEGA1UE
        AwxKZTJlLWNsdXN0ZXJzLTJ4N2d4LWNyZWF0ZS1jbHVzdGVyLTVzbThqX3NyZS1z
        eXN0ZW0tYWRtaW4tc2lnbmVyQDE3NTc3OTQwODIwIBgPMDAwMTAxMDEwMDAwMDBa
        Fw0yNTA5MTMyMDM4MjVaMEMxFzAVBgNVBAoTDnN5c3RlbTptYXN0ZXJzMSgwJgYD
        VQQDEx9zeXN0ZW06c3JlLWJyZWFrLWdsYXNzOmUyZS10ZXN0MIIBIjANBgkqhkiG
        9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5BYkJvp2kZdVXev+2NbSI7uMc+GILmm8toCa
        GIgECXbeFuMesoPqCxjeYVxU3YAZjuu9oSi0x596Gci/9L93TbZuQgy86OBfIzD/
        9gCgTp5ThNbDp4bPkpdxHexjzRRHxyb0S5oyO20MEfIXTTaGxWjTqhtUffRaBN3R
        dK+tye1o+vjariwm/bD/DNJrAZYmkzPIu4dfehWemkceeEFw3KJ82pNl0lQ6SCUZ
        wqArfGztkbEdELQe+egfl6NadNOjD/5Lp6RgrPpIgDyC90QudjHgG4Zjdeq4l+jj
        AZ/XTTj9nwXt7HJIFcxlo+A6tGC48iku9+/mbbBVzsvKIAsjeQIDAQABo0YwRDAT
        BgNVHSUEDDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFF8R
        /3uc0MRkCdbVaDBfmJQCsdhsMA0GCSqGSIb3DQEBCwUAA4IBAQAheguyNSoKJfCE
        knEO4Qq00yNDyNnUbmwPn8WJiV8HdrgTKuaURrHTBt8Bg5wpWY+/iOu1Im9u5at6
        7SuEYOBWUp1oQhYWgIno0Dy3IirPtnE0pTO3Lo53UYPGAq0B7gdrYMESIQcQJhCf
        0kwTO/R4ZzssuHyoaenQWmQATnp/bUsPdBzlwdTsZ43pjdYgFeM4Y8Q87Myk8aR7
        kCU9PA6XLWEvrrCM6pm9OzjQ4NudXXsBlrT/nzpNJhPEEhoQVwODrzghcGRDbg6r
        2NlKjsQAYFvENv0WoiqCA8JXQTehtxuQX6zTyqoPo1Uco689dPj59DuRBtqjKAHG
        skM/UCHs
        -----END CERTIFICATE-----
    control_plane_pki_operator.go:141: failed to get total client CA bundle: secrets "client-ca" not found
    control_plane_pki_operator.go:143: server total certificate trust bundle: 
    control_plane_pki_operator.go:146: failed to get KAS total client CA bundle: secrets "total-client-ca" not found
    control_plane_pki_operator.go:148: KAS certificate trust bundle: 
    control_plane_pki_operator.go:150: could not send SSR: Unauthorized
                --- FAIL: TestCreateCluster/Main/break-glass-credentials/sre-break-glass/CSR_flow (0.81s)

Filed by: dgoodwin@redhat.com

clones

OCPBUGS-61825 HyperShift kubevirt break glass credentials tests failing

Verified

duplicates

OCPBUGS-61825 HyperShift kubevirt break glass credentials tests failing

Verified

is blocked by

OCPBUGS-61825 HyperShift kubevirt break glass credentials tests failing

Verified

Assignee:: Krzysztof Majcher

Reporter:: OpenShift Technical Release Team

Need Info From:: None

Contributors:: None

QA Contact:: Yu Li

Doc Contact:: None

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Created:: 2025/09/18 12:43 PM

Updated:: 2025/09/22 3:54 PM

Resolved:: 2025/09/18 1:39 PM

Details

Description

Attachments

Issue Links

Easy Agile Planning Poker

Activity

People

Dates