ocpbugs-8882: configure an additional clientca for the openshiftapi s… #66833

nalhadef · 2023-10-24T17:56:49Z

ocpbugs-8882: Configure an additional clientCA for the OpenShift API server

4.11+

Issue:
https://issues.redhat.com/browse/OCPBUGS-8882

Link to docs preview (December 21, 2023):
https://66833--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/certificates/api-server

QE review:

openshift-ci-robot · 2023-10-24T17:56:52Z

@nalhadef: This pull request references ocpbugs-8882 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.15.0" version, but no target version was set.

In response to this:

…erver

ocpbugs-8882: Configure an additional clientCA for the OpenShift API server

4.11+

Issue:
https://issues.redhat.com/browse/OCPBUGS-8882

Link to docs preview:

QE review:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

ocpdocs-previewbot · 2023-10-24T18:01:54Z

🤖 Tue Jan 09 19:13:44 - Prow CI generated the docs preview: https://66833--ocpdocs-pr.netlify.app

jeana-redhat

A couple general comments on this one for you 👍

modules/configure-an-additional-clientCA.adoc

modules/configure-certificates-api-add-named.adoc

nalhadef · 2023-10-25T17:27:51Z

@jeana-redhat, I'll talk with the reporter about this. The bug was to add this material. If he's happy with it being an introduction, I'm happy to do it. Thanks.

modules/configure-an-additional-clientCA.adoc

palonsoro · 2023-11-07T13:26:50Z

modules/configure-an-additional-clientCA.adoc

+----
+
+. Test the new clientCA certificate with a certificate signed from the new clientCA.
+. If the test is successful, you can remove the installer-generated clientCA.


You are not explaining how to remove the installer-generated client CA yet you ask to remove it.

I'd remove this reference from this section but add a new section that explains the removal, after this section, and that suggests that you should first add the new CA as per the section above before replacing.

Pietro may provide a better view on how it should exactly look like

Thanks for the info, Pablo. Could you or Pietro send me the details on how to remove the installer-generated client CA?

@nalhadef here is a bit confusing, this KCS explains the procedure: https://access.redhat.com/solutions/6054981

To give you more context:

the installer-generate kubeconfig contains a client TLS certificate signed by a CA

the CA signing the kubeconfig is stored into the configmap named admin-kubeconfig-client-ca into the openshift-config namespace

in order to invalidate the installer-generated kubeconfig you have to replace the CA (thus the content of the configmap)

replacing the CA can be dangerous because if you are using the installer-generated kubeconfig and the content of the CM is somehow invalid you can be locked out from the API

for that reason in the KCS I suggest to:

first add an additional CA

generate a new kubeconfig using the new CA

replace the original CA replacing the configmap.

Incorporated KCS article content

palonsoro · 2023-11-07T13:27:24Z

I made two in-line comments. Please check them or let me know if you cannot see them

nalhadef · 2023-11-10T20:42:14Z

Began incorporating content about removing installer-generated certificate.

nalhadef · 2023-11-13T20:11:11Z

@palonsoro and @pbertera hi, Pablo and Pietro.

I've incorporated the KCS article content into the documentation. Please let me know if it works for you.
https://66833--docspreview.netlify.app/openshift-enterprise/latest/security/certificates/api-server

Thanks!

palonsoro · 2023-11-15T09:28:33Z

@nalhadef process looks good to me, but QE should do a specific end-to-end test.

Success criteria:

Cluster must be accessible with a kubeconfig that has a client certificate signed by the new CA.
Cluster must not be accessible with the original installation kubeconfig.

If any help is needed during QE testing, feel free to reach out, but we need thorough QE testing for this.

nalhadef · 2023-11-15T12:02:09Z

Thanks, Pablo. QE is next.

…

On Wed, Nov 15, 2023 at 4:28 AM Pablo Alonso Rodriguez < ***@***.***> wrote: @nalhadef <https://github.com/nalhadef> process looks good to me, but QE should do a specific end-to-end test. Success criteria: - Cluster *must* be accessible with a kubeconfig that has a client certificate signed by the new CA. - Cluster *must not* be accessible with the original installation kubeconfig. If any help is needed during QE testing, feel free to reach out, but we need thorough QE testing for this. — Reply to this email directly, view it on GitHub <#66833 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AT7EEZ7GC6LEVMG5UFDFRX3YESDM3AVCNFSM6AAAAAA6OCZ6PGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMJSGA4TEMRUGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

nalhadef · 2023-11-15T13:45:54Z

@xingxingxia Xia, I think you might be the QE for this features. Please do a QE test and, if accurate please add a LGTM label. Thanks!!

xingxingxia · 2023-11-16T02:57:05Z

@nalhadef , this falls in API Server QE team who has the test case , so I'm reassigning https://issues.redhat.com/browse/OCPBUGS-8882 to Ke Wang's team for review.

nalhadef · 2023-12-05T12:31:18Z

Hello, Ke Wang. Can you please assign a member of your team to review and hopefully assign a LGTM to this PR. It's associated with OCPBUS-8882. Thanks.

wangke19 · 2023-12-08T11:10:51Z

@nalhadef here is one doc https://access.redhat.com/solutions/6054981 for this section Configure an additional clientCA for the OpenShift API server, you can refer to it. But I don't think we provide more detail for this, I don't know if we can share the solutions to the public docs.

ocpdocs-vale-bot · 2024-04-12T15:29:22Z

modules/configure-an-additional-clientCA.adoc

+
+An existing kubeconfig is replaced by adding a new kubeconfig and configuring the existing kubeconfig to be invalid. The existing kubeconfig remains in place, but is not used due to its invalidating configuration. The existing, now invalid, kubeconfig cannot be removed.
+
+Optionally, you can replace the installer-generated kubeconfig. This process is also referred to as configuring the installer-generated kubceconfig to be invalid. 


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2024-04-12T15:29:23Z

modules/configure-an-additional-clientCA.adoc

+
+An existing kubeconfig is replaced by adding a new kubeconfig and configuring the existing kubeconfig to be invalid. The existing kubeconfig remains in place, but is not used due to its invalidating configuration. The existing, now invalid, kubeconfig cannot be removed.
+
+Optionally, you can replace the installer-generated kubeconfig. This process is also referred to as configuring the installer-generated kubceconfig to be invalid. 


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2024-04-12T15:29:24Z

modules/configure-an-additional-clientCA.adoc

+
+.Procedure
+
+To replace the installer-generated kubeconfig, remove the installer-generated clientCA from the API server:


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2024-04-12T15:29:25Z

modules/configure-an-additional-clientCA.adoc

+
+.Procedure
+
+To replace the installer-generated kubeconfig, remove the installer-generated clientCA from the API server:


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2024-04-12T15:29:26Z

modules/configure-an-additional-clientCA.adoc

+
+To replace the installer-generated kubeconfig, remove the installer-generated clientCA from the API server:
+
+. Use the following command to import an additional CA certificate in a configmap in the `openshift-config`` namespace. The CA file must be in PEM format.


🤖 [error] RedHat.CaseSensitiveTerms: Use 'config map' rather than 'configmap'. For more information, see RedHat.CaseSensitiveTerms.

ocpdocs-vale-bot · 2024-04-12T15:29:27Z

modules/configure-an-additional-clientCA.adoc

+----
+
+. Test the new clientCA certificate with a certificate signed from the new clientCA.
+. If the test is successful, you can remove the installer-generated clientCA.


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2024-04-12T15:29:29Z

modules/replace-the-certificate-authority-clientca.adoc

+:_content-type: PROCEDURE
+[id="replace-the-certificate-authority_{context}"]
+
+= Invalidating the installer-generated kubeconfig before replacing it with a newly generated CA certificate


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2024-04-12T15:29:30Z

modules/replace-the-certificate-authority-clientca.adoc

+
+= Invalidating the installer-generated kubeconfig before replacing it with a newly generated CA certificate
+
+The installer-generated kubeconfig cannot be removed, but it can be invalidated and replaced with a newly generated CA certificate.


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'The installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2024-04-12T15:29:31Z

modules/replace-the-certificate-authority-clientca.adoc

+
+The installer-generated kubeconfig cannot be removed, but it can be invalidated and replaced with a newly generated CA certificate.
+
+You can replace the installer-generated kubeconfig. You might do this if any of the following conditions exist:


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2024-04-12T15:29:33Z

security/certificates/api-server.adoc

+[role="_additional-resources"]
+== Additional resources
+
+* link:https://access.redhat.com/solutions/6054981[Replacing the certificate authority for the installer system:admin kubeconfig]


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

openshift-ci · 2024-04-12T15:29:55Z

@nalhadef: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-bot · 2024-09-25T09:00:19Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

palonsoro · 2024-09-25T09:56:14Z

/remove-lifecycle stale

bergerhoffer · 2024-10-14T15:08:03Z

The branch/enterprise-4.18 label has been added to this PR.

This is because your PR targets the main branch and is labeled for enterprise-4.17. And any PR going into main must also target the latest version branch (enterprise-4.18).

If the update in your PR does NOT apply to version 4.18 onward, please re-target this PR to go directly into the appropriate version branch or branches (enterprise-4.x) instead of main.

openshift-bot · 2025-01-14T09:00:21Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

palonsoro · 2025-01-14T09:15:24Z

/remove-lifecycle stale

openshift-bot · 2025-02-14T00:30:13Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

openshift-merge-robot · 2025-02-14T00:30:22Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

bergerhoffer · 2025-02-24T19:18:33Z

The branch/enterprise-4.19 label has been added to this PR.

This is because your PR targets the main branch and is labeled for enterprise-4.18. And any PR going into main must also target the latest version branch (enterprise-4.19).

If the update in your PR does NOT apply to version 4.19 onward, please re-target this PR to go directly into the appropriate version branch or branches (enterprise-4.x) instead of main.

bergerhoffer · 2025-03-03T14:34:51Z

Closing in favor of #89427

openshift-ci-robot added the jira/valid-reference label Oct 24, 2023

openshift-ci bot added the size/S label Oct 24, 2023

nalhadef force-pushed the ocpbugs-8882 branch from 3c868b9 to 28c4406 Compare October 25, 2023 13:58

openshift-ci bot added size/M and removed size/S labels Oct 25, 2023

nalhadef force-pushed the ocpbugs-8882 branch 2 times, most recently from c4f78a5 to 28b0e16 Compare October 25, 2023 15:51

jeana-redhat reviewed Oct 25, 2023

View reviewed changes

modules/configure-an-additional-clientCA.adoc Show resolved Hide resolved

modules/configure-certificates-api-add-named.adoc Outdated Show resolved Hide resolved

nalhadef force-pushed the ocpbugs-8882 branch from 28b0e16 to d0c2488 Compare November 2, 2023 19:09

palonsoro reviewed Nov 7, 2023

View reviewed changes

modules/configure-an-additional-clientCA.adoc Outdated Show resolved Hide resolved

palonsoro reviewed Nov 7, 2023

View reviewed changes

nalhadef force-pushed the ocpbugs-8882 branch from d0c2488 to 1198a74 Compare November 8, 2023 16:37

kalexand-rh closed this Nov 8, 2023

kalexand-rh reopened this Nov 8, 2023

nalhadef force-pushed the ocpbugs-8882 branch from 1198a74 to 1b238e2 Compare November 8, 2023 20:05

nalhadef force-pushed the ocpbugs-8882 branch from 1b238e2 to bfc12cb Compare November 13, 2023 20:01

openshift-ci bot added size/L and removed size/M labels Nov 13, 2023

ocpdocs-vale-bot reviewed Apr 12, 2024

View reviewed changes

kalexand-rh added the branch/enterprise-4.17 label Jun 26, 2024

openshift-ci bot added the lifecycle/stale label Sep 25, 2024

openshift-ci bot removed the lifecycle/stale label Sep 25, 2024

bergerhoffer added the branch/enterprise-4.18 label Oct 14, 2024

openshift-ci bot added the lifecycle/stale label Jan 14, 2025

openshift-ci bot added lifecycle/rotten and removed lifecycle/stale labels Feb 14, 2025

openshift-merge-robot added the needs-rebase label Feb 14, 2025

bergerhoffer added the branch/enterprise-4.19 label Feb 24, 2025

bergerhoffer closed this Mar 3, 2025


		An existing kubeconfig is replaced by adding a new kubeconfig and configuring the existing kubeconfig to be invalid. The existing kubeconfig remains in place, but is not used due to its invalidating configuration. The existing, now invalid, kubeconfig cannot be removed.

		Optionally, you can replace the installer-generated kubeconfig. This process is also referred to as configuring the installer-generated kubceconfig to be invalid.


		.Procedure

		To replace the installer-generated kubeconfig, remove the installer-generated clientCA from the API server:


		To replace the installer-generated kubeconfig, remove the installer-generated clientCA from the API server:

		. Use the following command to import an additional CA certificate in a configmap in the `openshift-config`` namespace. The CA file must be in PEM format.


		= Invalidating the installer-generated kubeconfig before replacing it with a newly generated CA certificate

		The installer-generated kubeconfig cannot be removed, but it can be invalidated and replaced with a newly generated CA certificate.


		The installer-generated kubeconfig cannot be removed, but it can be invalidated and replaced with a newly generated CA certificate.

		You can replace the installer-generated kubeconfig. You might do this if any of the following conditions exist:

ocpbugs-8882: configure an additional clientca for the openshiftapi s… #66833

ocpbugs-8882: configure an additional clientca for the openshiftapi s… #66833

Conversation

nalhadef commented Oct 24, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Oct 24, 2023

Uh oh!

ocpdocs-previewbot commented Oct 24, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jeana-redhat left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nalhadef commented Oct 25, 2023

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

palonsoro commented Nov 7, 2023

Uh oh!

nalhadef commented Nov 10, 2023

Uh oh!

nalhadef commented Nov 13, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

palonsoro commented Nov 15, 2023

Uh oh!

nalhadef commented Nov 15, 2023 via email

Uh oh!

nalhadef commented Nov 15, 2023

Uh oh!

xingxingxia commented Nov 16, 2023

Uh oh!

nalhadef commented Dec 5, 2023

Uh oh!

wangke19 commented Dec 8, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Apr 12, 2024

Uh oh!

openshift-bot commented Sep 25, 2024

Uh oh!

palonsoro commented Sep 25, 2024

Uh oh!

bergerhoffer commented Oct 14, 2024

Uh oh!

openshift-bot commented Jan 14, 2025

Uh oh!

palonsoro commented Jan 14, 2025

nalhadef commented Oct 24, 2023 •

edited

Loading

ocpdocs-previewbot commented Oct 24, 2023 •

edited

Loading

nalhadef commented Nov 13, 2023 •

edited

Loading

wangke19 commented Dec 8, 2023 •

edited

Loading