[release-4.16] OCPBUGS-55697: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs - #6114
Conversation
openshift-ci-robot
added
jira/valid-reference
|
@jparrill: This pull request references Jira Issue OCPBUGS-55697, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. This pull request references RHOCPPRIO-433 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.16.z" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
area/control-plane-operator
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jparrill The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
area/testing
|
@jparrill: This pull request references Jira Issue OCPBUGS-55697, which is invalid:
Comment This pull request references RHOCPPRIO-433 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.16.z" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Looking at the log error: We need to move the Golang version (of 4.16, 4.15 and 4.14) to >= 1.22.1 in order to continue with this backport to all way long to release-4.14. @sjenning WDYT? |
4c3d13f to
7cd7560
Compare
nvm, looks like there was an issue in my local with cache. All ok now |
|
@jparrill: An error was encountered updating to the POST state for bug OCPBUGS-55697 on the Jira server at https://issues.redhat.com/. No known errors were detected, please see the full error message for details. Full error message.
No response returned: Post "https://issues.redhat.com/rest/api/2/issue/16873217/transitions": POST https://issues.redhat.com/rest/api/2/issue/16873217/transitions giving up after 5 attempt(s)
Please contact an administrator to resolve this issue, then request a bug refresh with DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm |
|
/retest |
1 similar comment
|
/retest |
|
/test e2e-aws |
|
/retest |
|
/retitle [release-4.16] OCPBUGS-55697: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
the
jira/valid-bug
|
@jparrill: This pull request references Jira Issue OCPBUGS-55697, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
removed
the
jira/invalid-bug
10 similar comments
…r and NamedCertificates SANs This PR adds validation to ensure there are no conflicts between the SAN's of the user's APIServer NamedCertificates and the KubeAPIServer CPO certificates. This prevents potential issues with certificate SANs conflicts that could break the TLS trust chain between the nodes and the KAS Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>
7cd7560 to
e2a2085
Compare
|
@jparrill: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
@jparrill: An error was encountered updating to the MODIFIED state for bug OCPBUGS-55697 on the Jira server at https://issues.redhat.com/. No known errors were detected, please see the full error message for details. Full error message.
No response returned: Post "https://issues.redhat.com/rest/api/2/issue/OCPBUGS-55697/transitions": POST https://issues.redhat.com/rest/api/2/issue/OCPBUGS-55697/transitions giving up after 5 attempt(s)
Please contact an administrator to resolve this issue, then request a bug refresh with DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[ART PR BUILD NOTIFIER] Distgit: hypershift |
|
/jira backport release-4.15 |
|
@jparrill: The following backport issues have been created:
Queuing cherrypicks to the requested branches to be created after this PR merges: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@openshift-ci-robot: #6114 failed to apply on top of branch "release-4.15": DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
PR openshift#6114 backported code that did not include the service network DNS entries for the kube apiserver. This was ok in releases 4.17 and newer because in those releases a separate certificate is created to serve those service network DNS entries. However in 4.16 and older, there is only one serving certificate for the kube apiserver. This resulted in clients like ACM failing to communicate with the kube apiserver because they use the service network endpoint to install the klusterlet in the hosted cluster. This fix adds the missing entries back into the dns names of the KAS serving certificate.
PR openshift#6114 backported code that did not include the service network DNS entries for the kube apiserver. This was ok in releases 4.17 and newer because in those releases a separate certificate is created to serve those service network DNS entries. However in 4.16 and older, there is only one serving certificate for the kube apiserver. This resulted in clients like ACM failing to communicate with the kube apiserver because they use the service network endpoint to install the klusterlet in the hosted cluster. This fix adds the missing entries back into the dns names of the KAS serving certificate.
PR openshift#6114 backported code that did not include the service network DNS entries for the kube apiserver. This was ok in releases 4.17 and newer because in those releases a separate certificate is created to serve those service network DNS entries. However in 4.16 and older, there is only one serving certificate for the kube apiserver. This resulted in clients like ACM failing to communicate with the kube apiserver because they use the service network endpoint to install the klusterlet in the hosted cluster. This fix adds the missing entries back into the dns names of the KAS serving certificate.
8 participants
What this PR does / why we need it
Which issue(s) this PR fixes