Loading...

XML

Word

Printable

Type: Task
Resolution: Unresolved
Priority: Normal
Fix Version/s: None
Affects Version/s: None
Component/s: None
Labels:

Activity Type:
Quality / Stability / Reliability
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Ready:
False
Epic Link:
None
Story Points:
5

Target Version:
None
Release Blocker:
None
Sprint:
None

Test coverage for ~~OCPBUGS-17528~~

Background

The MCO removed certificates from MachineConfig and moved them to controllerConfig:

/etc/kubernetes/kubelet-ca.crt
/etc/kubernetes/static-pod-resources/configmaps/cloud-config/ca-bundle.pem
/etc/pki/ca-trust/source/anchors/openshift-config-user-ca-bundle.crt

WMCO was fixed in PR #1725 to read from controllerConfig.Spec.KubeAPIServerServingCAData instead of MachineConfig ignition.

Test Requirements

Verify that WMCO correctly provisions all three certificates on Windows nodes when they are stored in controllerConfig (not MachineConfig).

Existing Tests

OCP-50924: Tests kubelet-ca.crt rotation but doesn't verify the source
OCP-68320: Tests user-ca-bundle ConfigMap but not controllerConfig
OCP-84267: Tests hybrid-overlay CA cert configuration

Related Issues

Original QE tracking: OCPQE-16606
Upstream fix: ~~OCPBUGS-17528~~ (Closed - Done-Errata)
Fix PR: https://github.com/openshift/windows-machine-config-operator/pull/1725

depends on

WINC-1607 Create Polarion test case that validates certificates from controllerConfig

To Do

relates to

OCPBUGS-17528 WMCO needs to ensure it still has all necessary certs.

Closed

Assignee:: Aharon Rasouli

Reporter:: Aharon Rasouli

Need Info From:: None

Contributors:: None

QA Contact:: None

Doc Contact:: None

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Created:: 2026/02/03 8:06 AM

Updated:: 2026/02/05 8:20 AM