tls: refactor TLS cert generation to support configurable key algorithms

Refactor pkg/asset/tls/ to support generating signer certificates with
configurable key algorithms (RSA or ECDSA). PrivateKeyToPem now returns
([]byte, error) instead of calling logrus.Fatalf, and
GenerateSelfSignedCertificate accepts PrivateKeyParams to control key
generation. KeyUsage flags are set based on the algorithm since ECDSA
keys cannot perform key encipherment.

All signer certs pass nil for pkiConfig in this commit, preserving
the existing RSA-2048 behavior. Wiring signers to read PKI config
is deferred to a follow-up to avoid breaking codepaths that generate
signer certs without an install-config on disk (e.g. agent create
certificates, node-joiner add-nodes).

Assisted-by: Claude Code (Opus 4.6)

Author: hasbro17

pkg/asset/imagebased/configimage/ingressoperatorsigner.go

@@ -59,7 +59,10 @@ func (a *IngressOperatorSignerCertKey) Generate(ctx context.Context, dependencie
 		return err
 	}
 
-	a.KeyRaw = tls.PrivateKeyToPem(key)
+	a.KeyRaw, err = tls.PrivateKeyToPem(key)
+	if err != nil {
+		return fmt.Errorf("failed to encode private key to PEM: %w", err)
+	}
 	a.CertRaw = tls.CertToPem(crt)
 
 	return nil

pkg/asset/tls/adminkubeconfig.go

@@ -15,21 +15,27 @@ type AdminKubeConfigSignerCertKey struct {
 
 var _ asset.WritableAsset = (*AdminKubeConfigSignerCertKey)(nil)
 
-// Dependencies returns the dependency of the root-ca, which is empty.
+// Dependencies returns no dependencies. Configurable PKI requires
+// reading the PKI config from InstallConfig, but adding InstallConfig
+// as a dependency here would break codepaths that generate signer certs
+// without an install-config on disk (e.g. agent create certificates,
+// node-joiner). A follow-up commit introduces an intermediate asset
+// that reads the config directly from disk without triggering
+// InstallConfig validation.
 func (c *AdminKubeConfigSignerCertKey) Dependencies() []asset.Asset {
 	return []asset.Asset{}
 }
 
 // Generate generates the root-ca key and cert pair.
 func (c *AdminKubeConfigSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
 	cfg := &CertCfg{
-		Subject:   pkix.Name{CommonName: "admin-kubeconfig-signer", OrganizationalUnit: []string{"openshift"}},
-		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		Validity:  ValidityTenYears(),
-		IsCA:      true,
+		Subject: pkix.Name{CommonName: "admin-kubeconfig-signer", OrganizationalUnit: []string{"openshift"}},
+		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
+		Validity: ValidityTenYears(),
+		IsCA:     true,
 	}
 
-	return c.SelfSignedCertKey.Generate(ctx, cfg, "admin-kubeconfig-signer")
+	return c.SelfSignedCertKey.Generate(ctx, cfg, "admin-kubeconfig-signer", nil)
 }
 
 // Load reads the asset files from disk.

pkg/asset/tls/aggregator.go

@@ -32,13 +32,13 @@ func (a *AggregatorCA) Generate(ctx context.Context, dependencies asset.Parents)
 	dependencies.Get(installConfig)
 
 	cfg := &CertCfg{
-		Subject:   pkix.Name{CommonName: "aggregator", OrganizationalUnit: []string{"bootkube"}},
-		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		Validity:  ValidityOneDay(installConfig),
-		IsCA:      true,
+		Subject: pkix.Name{CommonName: "aggregator", OrganizationalUnit: []string{"bootkube"}},
+		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
+		Validity: ValidityOneDay(installConfig),
+		IsCA:     true,
 	}
 
-	return a.SelfSignedCertKey.Generate(ctx, cfg, "aggregator-ca")
+	return a.SelfSignedCertKey.Generate(ctx, cfg, "aggregator-ca", nil)
 }
 
 // Name returns the human-friendly name of the asset.
@@ -102,13 +102,13 @@ func (c *AggregatorSignerCertKey) Generate(ctx context.Context, parents asset.Pa
 	installConfig := &installconfig.InstallConfig{}
 	parents.Get(installConfig)
 	cfg := &CertCfg{
-		Subject:   pkix.Name{CommonName: "aggregator-signer", OrganizationalUnit: []string{"openshift"}},
-		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		Validity:  ValidityOneDay(installConfig),
-		IsCA:      true,
+		Subject: pkix.Name{CommonName: "aggregator-signer", OrganizationalUnit: []string{"openshift"}},
+		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
+		Validity: ValidityOneDay(installConfig),
+		IsCA:     true,
 	}
 
-	return c.SelfSignedCertKey.Generate(ctx, cfg, "aggregator-signer")
+	return c.SelfSignedCertKey.Generate(ctx, cfg, "aggregator-signer", nil)
 }
 
 // Name returns the human-friendly name of the asset.

pkg/asset/tls/apiserver.go

@@ -29,13 +29,13 @@ func (c *KubeAPIServerToKubeletSignerCertKey) Generate(ctx context.Context, pare
 	installConfig := &installconfig.InstallConfig{}
 	parents.Get(installConfig)
 	cfg := &CertCfg{
-		Subject:   pkix.Name{CommonName: "kube-apiserver-to-kubelet-signer", OrganizationalUnit: []string{"openshift"}},
-		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		Validity:  ValidityOneYear(installConfig),
-		IsCA:      true,
+		Subject: pkix.Name{CommonName: "kube-apiserver-to-kubelet-signer", OrganizationalUnit: []string{"openshift"}},
+		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
+		Validity: ValidityOneYear(installConfig),
+		IsCA:     true,
 	}
 
-	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-to-kubelet-signer")
+	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-to-kubelet-signer", nil)
 }
 
 // Name returns the human-friendly name of the asset.
@@ -116,21 +116,27 @@ type KubeAPIServerLocalhostSignerCertKey struct {
 
 var _ asset.WritableAsset = (*KubeAPIServerLocalhostSignerCertKey)(nil)
 
-// Dependencies returns the dependency of the root-ca, which is empty.
+// Dependencies returns no dependencies. Configurable PKI requires
+// reading the PKI config from InstallConfig, but adding InstallConfig
+// as a dependency here would break codepaths that generate signer certs
+// without an install-config on disk (e.g. agent create certificates,
+// node-joiner). A follow-up commit introduces an intermediate asset
+// that reads the config directly from disk without triggering
+// InstallConfig validation.
 func (c *KubeAPIServerLocalhostSignerCertKey) Dependencies() []asset.Asset {
 	return []asset.Asset{}
 }
 
 // Generate generates the root-ca key and cert pair.
 func (c *KubeAPIServerLocalhostSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
 	cfg := &CertCfg{
-		Subject:   pkix.Name{CommonName: "kube-apiserver-localhost-signer", OrganizationalUnit: []string{"openshift"}},
-		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		Validity:  ValidityTenYears(),
-		IsCA:      true,
+		Subject: pkix.Name{CommonName: "kube-apiserver-localhost-signer", OrganizationalUnit: []string{"openshift"}},
+		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
+		Validity: ValidityTenYears(),
+		IsCA:     true,
 	}
 
-	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-localhost-signer")
+	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-localhost-signer", nil)
 }
 
 // Load reads the asset files from disk.
@@ -220,21 +226,27 @@ type KubeAPIServerServiceNetworkSignerCertKey struct {
 
 var _ asset.WritableAsset = (*KubeAPIServerServiceNetworkSignerCertKey)(nil)
 
-// Dependencies returns the dependency of the root-ca, which is empty.
+// Dependencies returns no dependencies. Configurable PKI requires
+// reading the PKI config from InstallConfig, but adding InstallConfig
+// as a dependency here would break codepaths that generate signer certs
+// without an install-config on disk (e.g. agent create certificates,
+// node-joiner). A follow-up commit introduces an intermediate asset
+// that reads the config directly from disk without triggering
+// InstallConfig validation.
 func (c *KubeAPIServerServiceNetworkSignerCertKey) Dependencies() []asset.Asset {
 	return []asset.Asset{}
 }
 
 // Generate generates the root-ca key and cert pair.
 func (c *KubeAPIServerServiceNetworkSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
 	cfg := &CertCfg{
-		Subject:   pkix.Name{CommonName: "kube-apiserver-service-network-signer", OrganizationalUnit: []string{"openshift"}},
-		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		Validity:  ValidityTenYears(),
-		IsCA:      true,
+		Subject: pkix.Name{CommonName: "kube-apiserver-service-network-signer", OrganizationalUnit: []string{"openshift"}},
+		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
+		Validity: ValidityTenYears(),
+		IsCA:     true,
 	}
 
-	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-service-network-signer")
+	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-service-network-signer", nil)
 }
 
 // Load reads the asset files from disk.
@@ -333,21 +345,27 @@ type KubeAPIServerLBSignerCertKey struct {
 
 var _ asset.WritableAsset = (*KubeAPIServerLBSignerCertKey)(nil)
 
-// Dependencies returns the dependency of the root-ca, which is empty.
+// Dependencies returns no dependencies. Configurable PKI requires
+// reading the PKI config from InstallConfig, but adding InstallConfig
+// as a dependency here would break codepaths that generate signer certs
+// without an install-config on disk (e.g. agent create certificates,
+// node-joiner). A follow-up commit introduces an intermediate asset
+// that reads the config directly from disk without triggering
+// InstallConfig validation.
 func (c *KubeAPIServerLBSignerCertKey) Dependencies() []asset.Asset {
 	return []asset.Asset{}
 }
 
 // Generate generates the root-ca key and cert pair.
 func (c *KubeAPIServerLBSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
 	cfg := &CertCfg{
-		Subject:   pkix.Name{CommonName: "kube-apiserver-lb-signer", OrganizationalUnit: []string{"openshift"}},
-		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		Validity:  ValidityTenYears(),
-		IsCA:      true,
+		Subject: pkix.Name{CommonName: "kube-apiserver-lb-signer", OrganizationalUnit: []string{"openshift"}},
+		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
+		Validity: ValidityTenYears(),
+		IsCA:     true,
 	}
 
-	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-lb-signer")
+	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-lb-signer", nil)
 }
 
 // Load reads the asset files from disk.

pkg/asset/tls/boundsasigningkey.go

@@ -2,6 +2,7 @@ package tls
 
 import (
 	"context"
+	"crypto/rsa"
 	"os"
 
 	"github.com/pkg/errors"
@@ -50,10 +51,14 @@ func (sk *BoundSASigningKey) Load(f asset.FileFetcher) (bool, error) {
 		return false, err
 	}
 
-	rsaKey, err := PemToPrivateKey(keyFile.Data)
+	key, err := PemToPrivateKey(keyFile.Data)
 	if err != nil {
-		logrus.Debugf("Failed to load rsa.PrivateKey from file: %s", err)
-		return false, errors.Wrap(err, "failed to load rsa.PrivateKey from the file")
+		logrus.Debugf("Failed to load private key from file: %s", err)
+		return false, errors.Wrap(err, "failed to load private key from the file")
+	}
+	rsaKey, ok := key.(*rsa.PrivateKey)
+	if !ok {
+		return false, errors.New("bound service account signing key must be RSA")
 	}
 	pubData, err := PublicKeyToPem(&rsaKey.PublicKey)
 	if err != nil {

pkg/asset/tls/certkey.go

@@ -3,14 +3,13 @@ package tls
 import (
 	"bytes"
 	"context"
-	"crypto/rsa"
-	"crypto/x509"
 	"os"
 
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 
 	"github.com/openshift/installer/pkg/asset"
+	"github.com/openshift/installer/pkg/types"
 )
 
 // CertInterface contains cert.
@@ -128,14 +127,10 @@ func (c *SignedCertKey) Generate(_ context.Context,
 	filenameBase string,
 	appendParent AppendParentChoice,
 ) error {
-	var key *rsa.PrivateKey
-	var crt *x509.Certificate
-	var err error
-
 	caKey, err := PemToPrivateKey(parentCA.Key())
 	if err != nil {
-		logrus.Debugf("Failed to parse RSA private key: %s", err)
-		return errors.Wrap(err, "failed to parse rsa private key")
+		logrus.Debugf("Failed to parse private key: %s", err)
+		return errors.Wrap(err, "failed to parse private key")
 	}
 
 	caCert, err := PemToCertificate(parentCA.Cert())
@@ -144,13 +139,16 @@ func (c *SignedCertKey) Generate(_ context.Context,
 		return errors.Wrap(err, "failed to parse x509 certificate")
 	}
 
-	key, crt, err = GenerateSignedCertificate(caKey, caCert, cfg)
+	key, crt, err := GenerateSignedCertificate(caKey, caCert, cfg)
 	if err != nil {
 		logrus.Debugf("Failed to generate signed cert/key pair: %s", err)
 		return errors.Wrap(err, "failed to generate signed cert/key pair")
 	}
 
-	c.KeyRaw = PrivateKeyToPem(key)
+	c.KeyRaw, err = PrivateKeyToPem(key)
+	if err != nil {
+		return errors.Wrap(err, "failed to encode private key to PEM")
+	}
 	c.CertRaw = CertToPem(crt)
 
 	if appendParent {
@@ -167,17 +165,23 @@ type SelfSignedCertKey struct {
 	CertKey
 }
 
-// Generate generates a cert/key pair signed by the specified parent CA.
+// Generate generates a self-signed cert/key pair using the specified PKI profile.
 func (c *SelfSignedCertKey) Generate(_ context.Context,
 	cfg *CertCfg,
 	filenameBase string,
+	pkiConfig *types.PKIConfig,
 ) error {
-	key, crt, err := GenerateSelfSignedCertificate(cfg)
+	params := PKIConfigToKeyParams(pkiConfig)
+
+	key, crt, err := GenerateSelfSignedCertificate(cfg, params)
 	if err != nil {
 		return errors.Wrap(err, "failed to generate self-signed cert/key pair")
 	}
 
-	c.KeyRaw = PrivateKeyToPem(key)
+	c.KeyRaw, err = PrivateKeyToPem(key)
+	if err != nil {
+		return errors.Wrap(err, "failed to encode private key to PEM")
+	}
 	c.CertRaw = CertToPem(crt)
 
 	c.generateFiles(filenameBase)
@@ -192,14 +196,10 @@ func RegenerateSignedCertKey(
 	parentCA CertKeyInterface,
 	appendParent AppendParentChoice,
 ) ([]byte, []byte, error) {
-	var key *rsa.PrivateKey
-	var crt *x509.Certificate
-	var err error
-
 	caKey, err := PemToPrivateKey(parentCA.Key())
 	if err != nil {
-		logrus.Debugf("Failed to parse RSA private key: %s", err)
-		return nil, nil, errors.Wrap(err, "failed to parse rsa private key")
+		logrus.Debugf("Failed to parse private key: %s", err)
+		return nil, nil, errors.Wrap(err, "failed to parse private key")
 	}
 
 	caCert, err := PemToCertificate(parentCA.Cert())
@@ -208,13 +208,16 @@ func RegenerateSignedCertKey(
 		return nil, nil, errors.Wrap(err, "failed to parse x509 certificate")
 	}
 
-	key, crt, err = GenerateSignedCertificate(caKey, caCert, cfg)
-	if err != nil {
-		logrus.Debugf("Failed to generate signed cert/key pair: %s", err)
-		return nil, nil, errors.Wrap(err, "failed to generate signed cert/key pair")
+	key, crt, generateErr := GenerateSignedCertificate(caKey, caCert, cfg)
+	if generateErr != nil {
+		logrus.Debugf("Failed to generate signed cert/key pair: %s", generateErr)
+		return nil, nil, errors.Wrap(generateErr, "failed to generate signed cert/key pair")
 	}
 
-	keyRaw := PrivateKeyToPem(key)
+	keyRaw, err := PrivateKeyToPem(key)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "failed to encode private key to PEM")
+	}
 	certRaw := CertToPem(crt)
 
 	if appendParent {