tls: add ownership for 5 TLS artifacts missing owners

Add ownership information for 5 TLS artifacts that were listed as
missing owners in the TLS registry:

- ns/openshift-ingress secret/router-certs-default → Networking / router
- ns/openshift-ingress-operator secret/router-ca → Networking / router
- ns/kube-system configmap/extension-apiserver-authentication → kube-apiserver
- ns/openshift-config-managed configmap/default-ingress-cert → Networking / router
- ns/openshift-console configmap/default-ingress-cert → Networking / router

Updates ownership.json, ownership.md, all raw-data files, and empties
the ownership-violations.json file.

Ref: CNTRLPLANE-3652

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: redhat-chai-bot

tls/ownership/ownership.json

@@ -7,8 +7,8 @@
                     "Name": "extension-apiserver-authentication"
                 },
                 "certificateAuthorityBundleInfo": {
-                    "owningJiraComponent": "",
-                    "description": ""
+                    "owningJiraComponent": "kube-apiserver",
+                    "description": "CA bundle used to verify client certificates for aggregated API servers, managed by kube-apiserver."
                 }
             },
             "OnDiskLocation": null
@@ -515,8 +515,8 @@
                     "Name": "default-ingress-cert"
                 },
                 "certificateAuthorityBundleInfo": {
-                    "owningJiraComponent": "",
-                    "description": ""
+                    "owningJiraComponent": "Networking / router",
+                    "description": "CA bundle containing the certificate for the default ingress controller, published by the ingress operator."
                 }
             },
             "OnDiskLocation": null
@@ -734,8 +734,8 @@
                     "Name": "default-ingress-cert"
                 },
                 "certificateAuthorityBundleInfo": {
-                    "owningJiraComponent": "",
-                    "description": ""
+                    "owningJiraComponent": "Networking / router",
+                    "description": "CA bundle containing the certificate for the default ingress controller, published by the ingress operator."
                 }
             },
             "OnDiskLocation": null
@@ -3756,8 +3756,8 @@
                     "Name": "router-certs-default"
                 },
                 "certKeyInfo": {
-                    "owningJiraComponent": "",
-                    "description": ""
+                    "owningJiraComponent": "Networking / router",
+                    "description": "Serving certificate for the default ingress controller, managed by the ingress operator."
                 }
             },
             "OnDiskLocation": null
@@ -3838,8 +3838,8 @@
                     "Name": "router-ca"
                 },
                 "certKeyInfo": {
-                    "owningJiraComponent": "",
-                    "description": ""
+                    "owningJiraComponent": "Networking / router",
+                    "description": "CA certificate used by the ingress operator to sign default serving certificates for ingress controllers."
                 }
             },
             "OnDiskLocation": null

tls/ownership/ownership.md

@@ -1,9 +1,6 @@
 # Certificate Ownership
 
 ## Table of Contents
-  - [Missing Owners (5)](#Missing-Owners-5)
-    - [Certificates (2)](#Certificates-2)
-    - [Certificate Authority Bundles (3)](#Certificate-Authority-Bundles-3)
   - [Bare Metal Hardware Provisioning / cluster-baremetal-operator (1)](#Bare-Metal-Hardware-Provisioning-/-cluster-baremetal-operator-1)
     - [Certificates (1)](#Certificates-1)
   - [Cloud Compute / Cloud Controller Manager (1)](#Cloud-Compute-/-Cloud-Controller-Manager-1)
@@ -23,6 +20,9 @@
   - [Networking / cluster-network-operator (41)](#Networking-/-cluster-network-operator-41)
     - [Certificates (8)](#Certificates-8)
     - [Certificate Authority Bundles (33)](#Certificate-Authority-Bundles-33)
+  - [Networking / router (4)](#Networking-/-router-4)
+    - [Certificates (2)](#Certificates-2)
+    - [Certificate Authority Bundles (2)](#Certificate-Authority-Bundles-2)
   - [Node / Kubelet (2)](#Node-/-Kubelet-2)
     - [Certificates (2)](#Certificates-2)
   - [Operator Framework / operator-lifecycle-manager (2)](#Operator-Framework-/-operator-lifecycle-manager-2)
@@ -37,9 +37,9 @@
   - [etcd (34)](#etcd-34)
     - [Certificates (25)](#Certificates-25)
     - [Certificate Authority Bundles (9)](#Certificate-Authority-Bundles-9)
-  - [kube-apiserver (46)](#kube-apiserver-46)
+  - [kube-apiserver (47)](#kube-apiserver-47)
     - [Certificates (25)](#Certificates-25)
-    - [Certificate Authority Bundles (21)](#Certificate-Authority-Bundles-21)
+    - [Certificate Authority Bundles (22)](#Certificate-Authority-Bundles-22)
   - [kube-controller-manager (12)](#kube-controller-manager-12)
     - [Certificates (3)](#Certificates-3)
     - [Certificate Authority Bundles (9)](#Certificate-Authority-Bundles-9)
@@ -52,44 +52,6 @@
     - [Certificate Authority Bundles (3)](#Certificate-Authority-Bundles-3)
 
 
-## Missing Owners (5)
-### Certificates (2)
-1. ns/openshift-ingress secret/router-certs-default
-
-      **Description:** 
-      
-
-2. ns/openshift-ingress-operator secret/router-ca
-
-      **Description:** 
-      
-
-
-
-### Certificate Authority Bundles (3)
-1. ns/kube-system configmap/extension-apiserver-authentication
-
-      **Description:** 
-      
-
-      Other locations:
-
-      * file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/configmaps/aggregator-client-ca/ca-bundle.crt
-      * file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/aggregator-client-ca/ca-bundle.crt
-      
-
-2. ns/openshift-config-managed configmap/default-ingress-cert
-
-      **Description:** 
-      
-
-3. ns/openshift-console configmap/default-ingress-cert
-
-      **Description:** 
-      
-
-
-
 ## Bare Metal Hardware Provisioning / cluster-baremetal-operator (1)
 ### Certificates (1)
 1. ns/openshift-machine-api secret/metal3-ironic-tls
@@ -478,6 +440,33 @@
 
 
 
+## Networking / router (4)
+### Certificates (2)
+1. ns/openshift-ingress secret/router-certs-default
+
+      **Description:** Serving certificate for the default ingress controller, managed by the ingress operator.
+      
+
+2. ns/openshift-ingress-operator secret/router-ca
+
+      **Description:** CA certificate used by the ingress operator to sign default serving certificates for ingress controllers.
+      
+
+
+
+### Certificate Authority Bundles (2)
+1. ns/openshift-config-managed configmap/default-ingress-cert
+
+      **Description:** CA bundle containing the certificate for the default ingress controller, published by the ingress operator.
+      
+
+2. ns/openshift-console configmap/default-ingress-cert
+
+      **Description:** CA bundle containing the certificate for the default ingress controller, published by the ingress operator.
+      
+
+
+
 ## Node / Kubelet (2)
 ### Certificates (2)
 1. file /var/lib/kubelet/pki/kubelet-client-\<timestamp>.pem
@@ -838,7 +827,7 @@
 
 
 
-## kube-apiserver (46)
+## kube-apiserver (47)
 ### Certificates (25)
 1. ns/openshift-config-managed secret/kube-controller-manager-client-cert-key
 
@@ -1043,13 +1032,24 @@
 
 
 
-### Certificate Authority Bundles (21)
-1. ns/openshift-config configmap/admin-kubeconfig-client-ca
+### Certificate Authority Bundles (22)
+1. ns/kube-system configmap/extension-apiserver-authentication
+
+      **Description:** CA bundle used to verify client certificates for aggregated API servers, managed by kube-apiserver.
+      
+
+      Other locations:
+
+      * file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/configmaps/aggregator-client-ca/ca-bundle.crt
+      * file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/aggregator-client-ca/ca-bundle.crt
+      
+
+2. ns/openshift-config configmap/admin-kubeconfig-client-ca
 
       **Description:** CA for kube-apiserver to recognize the system:master created by the installer.
 
 
-2. ns/openshift-config-managed configmap/kube-apiserver-aggregator-client-ca
+3. ns/openshift-config-managed configmap/kube-apiserver-aggregator-client-ca
 
       **Description:** CA for aggregated apiservers to recognize kube-apiserver as front-proxy.
 
@@ -1060,7 +1060,7 @@
       * file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/aggregator-client-ca/ca-bundle.crt
 
 
-3. ns/openshift-config-managed configmap/kube-apiserver-client-ca
+4. ns/openshift-config-managed configmap/kube-apiserver-client-ca
 
       **Description:** 
 
@@ -1072,7 +1072,7 @@
       * file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/client-ca/ca-bundle.crt
 
 
-4. ns/openshift-config-managed configmap/kube-apiserver-server-ca
+5. ns/openshift-config-managed configmap/kube-apiserver-server-ca
 
       **Description:** 
 
@@ -1086,12 +1086,12 @@
       * file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfig
 
 
-5. ns/openshift-config-managed configmap/kubelet-bootstrap-kubeconfig
+6. ns/openshift-config-managed configmap/kubelet-bootstrap-kubeconfig
 
       **Description:** 
 
 
-6. ns/openshift-controller-manager configmap/client-ca
+7. ns/openshift-controller-manager configmap/client-ca
 
       **Description:** 
 
@@ -1103,7 +1103,7 @@
       * file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/client-ca/ca-bundle.crt
 
 
-7. ns/openshift-kube-apiserver configmap/aggregator-client-ca
+8. ns/openshift-kube-apiserver configmap/aggregator-client-ca
 
       **Description:** CA for aggregated apiservers to recognize kube-apiserver as front-proxy.
 
@@ -1114,7 +1114,7 @@
       * file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/aggregator-client-ca/ca-bundle.crt
 
 
-8. ns/openshift-kube-apiserver configmap/client-ca
+9. ns/openshift-kube-apiserver configmap/client-ca
 
       **Description:** 
 
@@ -1126,7 +1126,7 @@
       * file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/client-ca/ca-bundle.crt
 
 
-9. ns/openshift-kube-apiserver configmap/kube-apiserver-server-ca
+10. ns/openshift-kube-apiserver configmap/kube-apiserver-server-ca
 
       **Description:** 
 
@@ -1140,42 +1140,42 @@
       * file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfig
 
 
-10. ns/openshift-kube-apiserver-operator configmap/kube-apiserver-to-kubelet-client-ca
+11. ns/openshift-kube-apiserver-operator configmap/kube-apiserver-to-kubelet-client-ca
 
       **Description:** CA for the kubelet to recognize the kube-apiserver client certificate.
 
 
-11. ns/openshift-kube-apiserver-operator configmap/kube-control-plane-signer-ca
+12. ns/openshift-kube-apiserver-operator configmap/kube-control-plane-signer-ca
 
       **Description:** CA for kube-apiserver to recognize the kube-controller-manager and kube-scheduler client certificates.
 
 
-12. ns/openshift-kube-apiserver-operator configmap/loadbalancer-serving-ca
+13. ns/openshift-kube-apiserver-operator configmap/loadbalancer-serving-ca
 
       **Description:** CA for recognizing the kube-apiserver when connecting via the internal or external load balancers.
 
 
-13. ns/openshift-kube-apiserver-operator configmap/localhost-recovery-serving-ca
+14. ns/openshift-kube-apiserver-operator configmap/localhost-recovery-serving-ca
 
       **Description:** CA for recognizing the kube-apiserver when connecting via the localhost recovery SNI ServerName.
 
 
-14. ns/openshift-kube-apiserver-operator configmap/localhost-serving-ca
+15. ns/openshift-kube-apiserver-operator configmap/localhost-serving-ca
 
       **Description:** CA for recognizing the kube-apiserver when connecting via localhost.
 
 
-15. ns/openshift-kube-apiserver-operator configmap/node-system-admin-ca
+16. ns/openshift-kube-apiserver-operator configmap/node-system-admin-ca
 
       **Description:** CA for kube-apiserver to recognize local system:masters rendered to each master.
 
 
-16. ns/openshift-kube-apiserver-operator configmap/service-network-serving-ca
+17. ns/openshift-kube-apiserver-operator configmap/service-network-serving-ca
 
       **Description:** CA for recognizing the kube-apiserver when connecting via the service network (kuberentes.default.svc).
 
 
-17. ns/openshift-kube-controller-manager configmap/aggregator-client-ca
+18. ns/openshift-kube-controller-manager configmap/aggregator-client-ca
 
       **Description:** CA for aggregated apiservers to recognize kube-apiserver as front-proxy.
 
@@ -1186,7 +1186,7 @@
       * file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/aggregator-client-ca/ca-bundle.crt
 
 
-18. ns/openshift-kube-controller-manager configmap/client-ca
+19. ns/openshift-kube-controller-manager configmap/client-ca
 
       **Description:** 
 
@@ -1198,7 +1198,7 @@
       * file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/client-ca/ca-bundle.crt
 
 
-19. ns/openshift-route-controller-manager configmap/client-ca
+20. ns/openshift-route-controller-manager configmap/client-ca
 
       **Description:** 
 
@@ -1210,7 +1210,7 @@
       * file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/client-ca/ca-bundle.crt
 
 
-20. file /etc/kubernetes/kubeconfig
+21. file /etc/kubernetes/kubeconfig
 
       **Description:** 
 
@@ -1223,7 +1223,7 @@
       * file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfig
 
 
-21. file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/configmaps/trusted-ca-bundle/ca-bundle.crt
+22. file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/configmaps/trusted-ca-bundle/ca-bundle.crt
 
       **Description:**