OCPBUGS#8882: configure an addditionl clientca for the openshiftapi s… #89427

bergerhoffer · 2025-03-03T14:33:55Z

…erver

Version(s):
4.12+

Issue:
https://issues.redhat.com/browse/OCPBUGS-8882#

Link to docs preview:

QE review:

QE has approved this change.

Additional information:

…erver

openshift-ci-robot · 2025-03-03T14:33:59Z

@bergerhoffer: This pull request references ocpbugs-8882 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.19.0" version, but no target version was set.

In response to this:

…erver

Version(s):
4.12+

Issue:
https://issues.redhat.com/browse/OCPBUGS-8882#

Link to docs preview:

QE review:

QE has approved this change.

Additional information:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-03-03T14:35:10Z

@bergerhoffer: No Jira issue is referenced in the title of this pull request.
To reference a jira issue, add 'XYZ-NNN:' to the title of this pull request and request another refresh with /jira refresh.

In response to this:

…erver

Version(s):
4.12+

Issue:
https://issues.redhat.com/browse/OCPBUGS-8882#

Link to docs preview:

QE review:

QE has approved this change.

Additional information:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ocpdocs-previewbot · 2025-03-03T14:49:54Z

🤖 Mon Mar 03 14:49:54 - Prow CI generated the docs preview:

https://89427--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/certificates/api-server.html

ocpdocs-vale-bot · 2025-03-03T14:51:43Z

modules/configure-an-additional-clientCA.adoc

@@ -0,0 +1,46 @@
+// Module included in the following assemblies:


🤖 [error] OpenShiftAsciiDoc.ModuleContainsContentType: Module is missing the '_mod-docs-content-type' variable.

ocpdocs-vale-bot · 2025-03-03T14:51:45Z

modules/configure-an-additional-clientCA.adoc

+:_content-type: PROCEDURE
+[id="configure-an-additional-clientCA-for-the-OpenShift-API-server_{context}"]
+
+= Replacing the installer-generated clientCA with a new clientCA for the OpenShift API server


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2025-03-03T14:51:46Z

modules/configure-an-additional-clientCA.adoc

+
+An existing kubeconfig is replaced by adding a new kubeconfig and configuring the existing kubeconfig to be invalid. The existing kubeconfig remains in place, but is not used due to its invalidating configuration. The existing, now invalid, kubeconfig cannot be removed.
+
+Optionally, you can replace the installer-generated kubeconfig. This process is also referred to as configuring the installer-generated kubceconfig to be invalid. 


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2025-03-03T14:51:47Z

modules/configure-an-additional-clientCA.adoc

+
+An existing kubeconfig is replaced by adding a new kubeconfig and configuring the existing kubeconfig to be invalid. The existing kubeconfig remains in place, but is not used due to its invalidating configuration. The existing, now invalid, kubeconfig cannot be removed.
+
+Optionally, you can replace the installer-generated kubeconfig. This process is also referred to as configuring the installer-generated kubceconfig to be invalid. 


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2025-03-03T14:51:48Z

modules/configure-an-additional-clientCA.adoc

+
+.Procedure
+
+To replace the installer-generated kubeconfig, remove the installer-generated clientCA from the API server:


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2025-03-03T14:51:49Z

modules/configure-an-additional-clientCA.adoc

+
+.Procedure
+
+To replace the installer-generated kubeconfig, remove the installer-generated clientCA from the API server:


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2025-03-03T14:51:50Z

modules/configure-an-additional-clientCA.adoc

+----
+
+. Test the new clientCA certificate with a certificate signed from the new clientCA.
+. If the test is successful, you can remove the installer-generated clientCA.


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2025-03-03T14:51:53Z

modules/replace-the-certificate-authority-clientca.adoc

@@ -0,0 +1,102 @@
+// Module included in the following assemblies:


🤖 [error] OpenShiftAsciiDoc.ModuleContainsContentType: Module is missing the '_mod-docs-content-type' variable.

ocpdocs-vale-bot · 2025-03-03T14:51:54Z

modules/replace-the-certificate-authority-clientca.adoc

+:_content-type: PROCEDURE
+[id="replace-the-certificate-authority_{context}"]
+
+= Invalidating the installer-generated kubeconfig before replacing it with a newly generated CA certificate


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2025-03-03T14:51:55Z

modules/replace-the-certificate-authority-clientca.adoc

+
+= Invalidating the installer-generated kubeconfig before replacing it with a newly generated CA certificate
+
+The installer-generated kubeconfig cannot be removed, but it can be invalidated and replaced with a newly generated CA certificate.


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'The installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2025-03-03T14:51:56Z

modules/replace-the-certificate-authority-clientca.adoc

+
+The installer-generated kubeconfig cannot be removed, but it can be invalidated and replaced with a newly generated CA certificate.
+
+You can replace the installer-generated kubeconfig. You might do this if any of the following conditions exist:


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2025-03-03T14:51:58Z

security/certificates/api-server.adoc

+== Additional resources
+
+* link:https://access.redhat.com/solutions/6054981[Replacing the certificate authority for the installer system:admin kubeconfig]


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

openshift-ci · 2025-03-03T14:52:05Z

@bergerhoffer: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-bot · 2025-06-02T01:00:58Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

palonsoro · 2025-06-02T11:04:28Z

/remove-lifecycle stale

ocpbugs-8882: configure an addditionl clientca for the openshiftapi s…

7633bfe

…erver

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 3, 2025

bergerhoffer added this to the Continuous Release milestone Mar 3, 2025

bergerhoffer mentioned this pull request Mar 3, 2025

ocpbugs-8882: configure an additional clientca for the openshiftapi s… #66833

Closed

bergerhoffer changed the title ~~ocpbugs-8882: configure an addditionl clientca for the openshiftapi s…~~ OCPBUGS#8882: configure an addditionl clientca for the openshiftapi s… Mar 3, 2025

openshift-ci-robot removed the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 3, 2025

openshift-ci bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Mar 3, 2025

ocpdocs-vale-bot reviewed Mar 3, 2025

View reviewed changes

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 2, 2025

openshift-ci bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 2, 2025

		@@ -0,0 +1,46 @@
		// Module included in the following assemblies:


		An existing kubeconfig is replaced by adding a new kubeconfig and configuring the existing kubeconfig to be invalid. The existing kubeconfig remains in place, but is not used due to its invalidating configuration. The existing, now invalid, kubeconfig cannot be removed.

		Optionally, you can replace the installer-generated kubeconfig. This process is also referred to as configuring the installer-generated kubceconfig to be invalid.


		.Procedure

		To replace the installer-generated kubeconfig, remove the installer-generated clientCA from the API server:

		@@ -0,0 +1,102 @@
		// Module included in the following assemblies:


		= Invalidating the installer-generated kubeconfig before replacing it with a newly generated CA certificate

		The installer-generated kubeconfig cannot be removed, but it can be invalidated and replaced with a newly generated CA certificate.


		The installer-generated kubeconfig cannot be removed, but it can be invalidated and replaced with a newly generated CA certificate.

		You can replace the installer-generated kubeconfig. You might do this if any of the following conditions exist:

		== Additional resources

		* link:https://access.redhat.com/solutions/6054981[Replacing the certificate authority for the installer system:admin kubeconfig]

OCPBUGS#8882: configure an addditionl clientca for the openshiftapi s… #89427

Are you sure you want to change the base?

OCPBUGS#8882: configure an addditionl clientca for the openshiftapi s… #89427

Uh oh!

Conversation

bergerhoffer commented Mar 3, 2025

Uh oh!

openshift-ci-robot commented Mar 3, 2025

Uh oh!

openshift-ci-robot commented Mar 3, 2025

Uh oh!

ocpdocs-previewbot commented Mar 3, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Mar 3, 2025

Uh oh!

openshift-bot commented Jun 2, 2025

Uh oh!

palonsoro commented Jun 2, 2025

Uh oh!

Uh oh!