CNTRLPLANE-2012: Wire signer certs to read PKI config via SignerKeyParams#10595
CNTRLPLANE-2012: Wire signer certs to read PKI config via SignerKeyParams#10595hasbro17 wants to merge 1 commit into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@hasbro17: This pull request references CNTRLPLANE-2012 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "5.0." or "openshift-5.0.", but it targets "openshift-4.22" instead. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a feature-gated ChangesConfigurable PKI and TLS generation
Sequence Diagram(s)PKI manifest generation sequenceDiagram
participant Manifests
participant PKIConfiguration
participant InstallConfig
participant EffectiveSignerPKIConfig
participant DefaultPKIProfile
Manifests->>PKIConfiguration: Generate(...)
PKIConfiguration->>InstallConfig: load installconfig.InstallConfig
PKIConfiguration->>EffectiveSignerPKIConfig: resolve signer PKIConfig
EffectiveSignerPKIConfig->>DefaultPKIProfile: derive default signer values
Manifests->>PKIConfiguration: Files()
Signer certificate generation sequenceDiagram
participant RootCA
participant SignerKeyParams
participant SelfSignedCertKey
participant GenerateSelfSignedCertificate
participant PrivateKeyToPem
RootCA->>SignerKeyParams: read PKIConfig
RootCA->>SelfSignedCertKey: Generate(..., PKIConfig)
SelfSignedCertKey->>GenerateSelfSignedCertificate: create key and certificate
SelfSignedCertKey->>PrivateKeyToPem: encode generated key
Estimated code review effort🎯 5 (Critical) | ⏱️ ~90+ minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
do-not-merge/hold
|
/test e2e-aws-ovn-pki-default-techpreview |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/types/pki/defaults.go`:
- Around line 36-53: EffectiveSignerPKIConfig currently returns ic.PKI before
checking the ConfigurablePKI feature gate, allowing user PKI to be honored even
when the gate is off; change the logic in EffectiveSignerPKIConfig so it first
checks ic.Enabled(features.FeatureGateConfigurablePKI) and if the gate is
disabled return nil, and only when the gate is enabled honor ic.PKI (return it)
or fall back to the default SignerCertificates config; update references in
EffectiveSignerPKIConfig to enforce the gate-first behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b8a25289-d43e-4637-8509-4498d6ba55cf
⛔ Files ignored due to path filters (1)
pkg/types/zz_generated.deepcopy.gois excluded by!**/zz_generated*
📒 Files selected for processing (39)
data/data/install.openshift.io_installconfigs.yamlpkg/asset/ignition/machine/arbiter_ignition_customizations_test.gopkg/asset/ignition/machine/arbiter_test.gopkg/asset/ignition/machine/master_ignition_customizations_test.gopkg/asset/ignition/machine/master_test.gopkg/asset/ignition/machine/worker_ignition_customizations_test.gopkg/asset/ignition/machine/worker_test.gopkg/asset/imagebased/configimage/ingressoperatorsigner.gopkg/asset/manifests/operators.gopkg/asset/manifests/pki.gopkg/asset/manifests/pki_test.gopkg/asset/tls/adminkubeconfig.gopkg/asset/tls/aggregator.gopkg/asset/tls/apiserver.gopkg/asset/tls/boundsasigningkey.gopkg/asset/tls/certkey.gopkg/asset/tls/certkey_test.gopkg/asset/tls/ironictls.gopkg/asset/tls/keypair.gopkg/asset/tls/kubecontrolplane.gopkg/asset/tls/kubelet.gopkg/asset/tls/root.gopkg/asset/tls/signerkey_params.gopkg/asset/tls/tls.gopkg/asset/tls/tls_test.gopkg/asset/tls/utils.gopkg/asset/tls/utils_test.gopkg/explain/printer_test.gopkg/types/defaults/installconfig.gopkg/types/installconfig.gopkg/types/pki/conversion.gopkg/types/pki/defaults.gopkg/types/pki/defaults_test.gopkg/types/pki/validation.gopkg/types/pki/validation_test.gopkg/types/validation/featuregate_test.gopkg/types/validation/featuregates.gopkg/types/validation/installconfig.gopkg/types/validation/installconfig_test.go
0e262ca to
2ab8c63
Compare
|
/test e2e-aws-ovn-pki-default-techpreview |
|
Okay the e2e tests pass now: So the SignerKeyParams helps walk the line between IPI and ABI for those signers. |
0a3fbe6 to
9d66374
Compare
|
/test e2e-aws-ovn-pki-default-techpreview |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/asset/manifests/pki.go`:
- Around line 42-48: The Generate method on PKIConfiguration exits early when
the FeatureGateConfigurablePKI is disabled but doesn't clear previously
generated state; ensure you reset p.FileList (e.g., set to nil or an empty
slice) before the early return in PKIConfiguration.Generate so stale PKI
manifests aren't retained across runs when the feature gate is off.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2313bdbb-b13e-49c2-89f3-c0d815a13343
⛔ Files ignored due to path filters (1)
pkg/types/zz_generated.deepcopy.gois excluded by!**/zz_generated*
📒 Files selected for processing (40)
data/data/install.openshift.io_installconfigs.yamlpkg/asset/ignition/machine/arbiter_ignition_customizations_test.gopkg/asset/ignition/machine/arbiter_test.gopkg/asset/ignition/machine/master_ignition_customizations_test.gopkg/asset/ignition/machine/master_test.gopkg/asset/ignition/machine/worker_ignition_customizations_test.gopkg/asset/ignition/machine/worker_test.gopkg/asset/imagebased/configimage/ingressoperatorsigner.gopkg/asset/manifests/operators.gopkg/asset/manifests/pki.gopkg/asset/manifests/pki_test.gopkg/asset/tls/adminkubeconfig.gopkg/asset/tls/aggregator.gopkg/asset/tls/apiserver.gopkg/asset/tls/boundsasigningkey.gopkg/asset/tls/certkey.gopkg/asset/tls/certkey_test.gopkg/asset/tls/ironictls.gopkg/asset/tls/keypair.gopkg/asset/tls/kubecontrolplane.gopkg/asset/tls/kubelet.gopkg/asset/tls/root.gopkg/asset/tls/signerkey_params.gopkg/asset/tls/tls.gopkg/asset/tls/tls_test.gopkg/asset/tls/utils.gopkg/asset/tls/utils_test.gopkg/explain/printer_test.gopkg/types/defaults/installconfig.gopkg/types/installconfig.gopkg/types/pki/conversion.gopkg/types/pki/conversion_test.gopkg/types/pki/defaults.gopkg/types/pki/defaults_test.gopkg/types/pki/validation.gopkg/types/pki/validation_test.gopkg/types/validation/featuregate_test.gopkg/types/validation/featuregates.gopkg/types/validation/installconfig.gopkg/types/validation/installconfig_test.go
✅ Files skipped from review due to trivial changes (5)
- pkg/asset/ignition/machine/arbiter_test.go
- pkg/explain/printer_test.go
- pkg/types/defaults/installconfig.go
- pkg/asset/manifests/pki_test.go
- pkg/types/validation/featuregates.go
🚧 Files skipped from review as they are similar to previous changes (30)
- pkg/asset/imagebased/configimage/ingressoperatorsigner.go
- pkg/asset/tls/ironictls.go
- pkg/asset/tls/utils_test.go
- pkg/asset/ignition/machine/worker_test.go
- pkg/asset/ignition/machine/master_test.go
- pkg/types/validation/featuregate_test.go
- pkg/asset/ignition/machine/arbiter_ignition_customizations_test.go
- pkg/types/validation/installconfig_test.go
- pkg/types/validation/installconfig.go
- pkg/types/pki/validation.go
- pkg/types/pki/defaults.go
- pkg/types/pki/defaults_test.go
- pkg/asset/tls/boundsasigningkey.go
- pkg/types/installconfig.go
- data/data/install.openshift.io_installconfigs.yaml
- pkg/asset/tls/keypair.go
- pkg/asset/tls/kubecontrolplane.go
- pkg/asset/tls/apiserver.go
- pkg/asset/tls/certkey.go
- pkg/asset/tls/tls_test.go
- pkg/asset/tls/adminkubeconfig.go
- pkg/asset/tls/signerkey_params.go
- pkg/asset/tls/kubelet.go
- pkg/asset/tls/aggregator.go
- pkg/asset/ignition/machine/worker_ignition_customizations_test.go
- pkg/asset/tls/utils.go
- pkg/asset/tls/root.go
- pkg/asset/tls/certkey_test.go
- pkg/types/pki/validation_test.go
- pkg/asset/tls/tls.go
9d66374 to
fcfc32e
Compare
|
/test e2e-aws-ovn-pki-default-techpreview |
d217ac0 to
c665423
Compare
c665423 to
e4030fd
Compare
|
/test e2e-aws-ovn-pki-default-techpreview |
e4030fd to
de6f285
Compare
|
/hold cancel |
openshift-ci
Bot
removed
the
do-not-merge/hold
|
Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage. |
|
/retest |
1 similar comment
|
/retest |
|
/retest |
| &clusterapi.Cluster{}, | ||
| // Persist PKI config to the state file so that signer certs | ||
| // generated in a subsequent create cluster use the correct | ||
| // key algorithm after install-config.yaml has been consumed. |
There was a problem hiding this comment.
These comments feels like overkill. If you document it only in the commit message then anybody who wonders why it is here will still be able to find out.
| // Persist PKI config to the state file so that signer certs | ||
| // generated in a subsequent agent create image use the correct | ||
| // key algorithm after install-config.yaml has been consumed. | ||
| &tls.SignerKeyParams{}, |
There was a problem hiding this comment.
This one is not necessary. Install-config is not an input to this command.
|
/hold There are new outstanding reviews 👀 |
openshift-ci
Bot
added
the
do-not-merge/hold
663b47b to
ef3e716
Compare
Introduce SignerKeyParams, a WritableAsset with zero dependencies that reads install-config.yaml via AssetBase.LoadFromFile (strict YAML, deprecated field conversion, defaults) and extracts the effective PKI configuration via EffectiveSignerPKIConfig(). When no install-config is present, Load() returns (false, nil) so the asset store falls back to the state file between multi-step invocations (e.g. create manifests followed by create cluster, where install-config.yaml is consumed after the first step). In the agent flow where neither file nor state exists, Generate() leaves PKIConfig nil (RSA-2048). SignerKeyParams is explicitly added to the Manifests and agent target asset lists so that its PKIConfig is persisted to the state file, ensuring correct key algorithms in multi-step flows where install-config.yaml is consumed between commands. Signers that previously had zero dependencies now depend on SignerKeyParams instead of InstallConfig, avoiding validation that would reject configs valid in the agent flow. Signers that already depended on InstallConfig use EffectiveSignerPKIConfig() to resolve the effective PKI config including feature gate defaults. With TechPreview enabled and no explicit pki config, all signer certs are generated with RSA-4096 (the current DefaultPKIProfile default). Assisted-by: Claude Code (Opus 4.6)
ef3e716 to
0b7b63e
Compare
|
/test e2e-agent-compact-ipv4-iso-no-registry |
|
@hasbro17: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
openshift-ci
Bot
removed
the
do-not-merge/hold
|
Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage. |
CI Verification Summary:Job results
Analysise2e-azure-ovn-techpreview — NOT caused by this PRThe cluster installed successfully with The single blocking failure is Result: 2364 pass, 1 blocking fail (router PID), 11 informing fail (OVN + CCO), 2193 skip. e2e-aws-ovn-pki-default-techpreview — Expected failureThe cluster installed successfully. The PKI verification step correctly detected that all 7 installer-managed signers are using RSA-4096 instead of ECDSA P-384: This is expected. The test expects Notable improvement from the previous run: both etcd-signer and etcd-metrics-signer now PASS, confirming that the etcd operator fix (cluster-etcd-operator#1648) and the CI test name fix (openshift/release#82191) are working. Conclusion
|
|
/test e2e-aws-ovn-fips |
|
/test e2e-metal-assisted |
|
@tthvo: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/8ffd5070-86e2-11f1-93bc-ba626c5e1ade-0 |
|
/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-aws-c2s-ipi-disc-priv-fips-f28-tp-longduration-cloud |
|
@tthvo: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f040b760-86e2-11f1-908e-2997670f77fa-0 |
|
/test e2e-aws-eusc-techpreview |
|
/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-short-cert-rotation-f7 |
|
@tthvo: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/dec86810-86e3-11f1-8f7e-9a6867363117-0 |
|
/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-short-cert-rotation-f7 |
|
@tthvo: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/b2a12640-86ee-11f1-87c1-6f93223ce9a6-0 |
6 participants
Summary
Part 3 of splitting #10396 into smaller PRs. Depends on #10593 and #10594.
Wires all 11 signer certificates to read PKI configuration for configurable key algorithms.
Problem
6 of these signers previously had zero dependencies — adding
InstallConfigas a dependency would break agent-based installer (ABI) codepaths that generate signer certs without an install-config on disk (e.g.agent create certificatesused byset-node-zero.sh,node-joiner add-nodes). It would also pull in standardInstallConfigvalidation, rejecting configs that are valid under the agent flow's more lenientOptionalInstallConfigrules (e.g. vSphere without credentials).Solution
We introduce
SignerKeyParams— aWritableAssetwith zero dependencies that readsinstall-config.yamlviaAssetBase.LoadFromFile(strict YAML, deprecated field conversion, defaults) and resolves theeffective PKI config via
EffectiveSignerPKIConfig(). When no install-config is found,Load()returns(false, nil)so the asset store falls back to the state file between multi-step invocations (e.g.create manifestsfollowed bycreate cluster, whereinstall-config.yamlis consumed after the first step). In the agent flow where neither file nor state exists,Generate()leaves PKIConfig nil(RSA-2048).
SignerKeyParamsis explicitly added to the Manifests and agent target asset lists so that itsPKIConfigis persisted to the state file, ensuring correct key algorithms in multi-step flows whereinstall-config.yaml is consumed between commands.
6 previously zero-dep signers — now depend on
SignerKeyParams:AdminKubeConfigSignerCertKeyKubeAPIServerLocalhostSignerCertKeyKubeAPIServerServiceNetworkSignerCertKeyKubeAPIServerLBSignerCertKeyRootCAKubeletBootstrapCertSigner5 signers that already depended on InstallConfig — now use
EffectiveSignerPKIConfig()to resolve the effective PKI config including feature gate defaults:KubeAPIServerToKubeletSignerCertKeyAggregatorCAAggregatorSignerCertKeyKubeControlPlaneSignerCertKeyKubeletCSRSignerCertKeyWith TechPreview enabled and no explicit
pkiconfig, all signer certs are generated with RSA-4096 (the currentDefaultPKIProfiledefault). Without TechPreview, all certs remain RSA-2048.PR chain