Uploaded image for project: 'OpenStack as Infra'
  1. OpenStack as Infra
  2. OSASINFRA-3657

Sync CA bundle from root credential to generated credentials

XMLWordPrintable

    • Improvement
    • 1
    • False
    • None
    • False
    • Hide
      When an OpenStack cloud uses self-signed certificates, it is necessary to provide a CA cert alongside the {{cloud.yaml}} file for components that require communication with the cloud. Previously, this was managed on a per-component basis. Starting in OpenShift 4.19, the {{cloud-credential-operator}} (CCO) is now capable of consuming a CA cert provided in the root credentials secret and providing this to all components. This will allows users to easily rotate their CA cert alongside their credentials.
      Show
      When an OpenStack cloud uses self-signed certificates, it is necessary to provide a CA cert alongside the {{cloud.yaml}} file for components that require communication with the cloud. Previously, this was managed on a per-component basis. Starting in OpenShift 4.19, the {{cloud-credential-operator}} (CCO) is now capable of consuming a CA cert provided in the root credentials secret and providing this to all components. This will allows users to easily rotate their CA cert alongside their credentials.
    • Enhancement
    • ShiftStack Sprint 267, ShiftStack Sprint 269
    • +

      The cloud-credential-operator (CCO) consumes a root credential secret from kube-system / openstack-credentials and rolls it out to secrets in different namespaces, in response to CredentialsRequests CRs. We should modify CCO to start looking for a cacert field in this root credential secret and copying it to the generated secrets. This key name is chosen since it aligns with the expected secret key name used by components like CAPO and ORC.

              sfinucan@redhat.com Stephen Finucane
              sfinucan@redhat.com Stephen Finucane
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: