Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-8870

Propagate kubeAPIServerDNSName to oauth Copy Login Command

XMLWordPrintable

    • None
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      1. Proposed title of this feature request
      Propagate kubeAPIServerDNSName to oauth Copy Login Command

      2. What is the nature and description of the request?
      When following Custom Kube API Server DNS Configuration the value from kubeAPIServerDNSName is properly applied/set and also propagated to Red Hat OpenShift with the defined certificates, so one can use certificates from a custom PKI and avoid potential TLS verification failures. While it all works, the value from kubeAPIServerDNSName is not propagated to the oAuth-Server when using the Copy login command menu to quickly get the Token and oc command to access Red Hat OpenShift. Instead the default api.<name>.<domain>:<port> is being presented, triggering inconsistent experience with potential TLS verification failures due to internal certificates being used.

      With kubeAPIServerDNSName being propagated and properly represented by oAuth-Server (it's by the page /oauth/token/display it would be possible to copy the oc command and use it without the need to adjust it again or risk TLS verification error.

      3. Why does the customer need this? (List the business requirements here)
      In restricted environment, custom PKIs are heavily used and therefore Custom Kube API Server DNS Configuration is heavily utilized to provide an API endpoint with certificates from the custom/internal PKI. Failing to represent that within the Copy login command will cause TLS verification issues when accessing the API and hence trigger trust and security issues. It's therefore critical that kubeAPIServerDNSName is being propagated and presented to all customer facing areas, so only this value can be used and to prevent trust and certificate issues.

      4. List any affected packages or components.
      oAuth-Server

              racedoro@redhat.com Ramon Acedo
              rhn-support-sreber Simon Reber
              None
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                None
                None