AGENT-1389: create InternalReleaseImage registry TLS certificate by andfasano · Pull Request #10147 · openshift/installer

andfasano · 2025-12-04T17:10:48Z

This patch adds two new assets, respectively IRICertKey and InternalReleaseImageTLSSecret, for generating a new TLS certificate (signed by the RootCA asset) to be used for the InternalReleaseImage registry (introduced in #5452).

The code is completely fenced by the NoRegistryClusterInstall feature gate, as it's still in TP.

openshift-ci-robot · 2025-12-04T17:10:53Z

@andfasano: This pull request references AGENT-1389 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

Details

In response to this:

This patch adds two new assets, respectively IRICertKey and InternalReleaseImageTLSSecret, for generating a new TLS certificate (signed by the RootCA asset) to be used for the InternalReleaseImage registry (introduced in #5452).

The code is completely fenced by the NoRegistryClusterInstall feature gate, as it's still in TP.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

andfasano · 2025-12-04T17:54:53Z

cc @pablintino @djoshy

patrickdillon

/approve

patrickdillon · 2025-12-04T19:47:00Z

 		}
 	}
+
+	if installConfig.Config.EnabledFeatureGates().Enabled(features.FeatureGateNoRegistryClusterInstall) {


Is this feature only enabled/disabled by the feature gate? It does not require opt in through the install config or anything?

That's a good point that I've missed it, thanks!
In general to opt in the feature, it is expected that the InternalReleaseImage resource will be provided as an extra manifest (ie, if not present, during the bootstrap the related MCO controller will simply ignore it).
Anyhow currently the only way to consume such feature is via OVE ISO, so the injection point of this extra manifest is done via the Appliance (there's a pending PR for this openshift/appliance#612), the underlying tool used to build the ISO in konflux.

I've added then a support asset to check for the presence of the InternalReleaseImage manifests (note: due the imports rules the best location I was able to find was /pkg/asset/template/content/manifests, please let me know if you think there's a more suitable one)

(and included an existence check wherever necessary for the IRI manifest)

openshift-ci · 2025-12-04T19:49:09Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: patrickdillon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [patrickdillon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rwsu · 2025-12-04T22:31:54Z

+	cfg := &CertCfg{
+		Subject:      pkix.Name{CommonName: "system:internal-release-image"},
+		ExtKeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		Validity:     time.Hour * 24 * 182, // 6 months


Just curious, why 6 months? MCSCertKey uses ValidityTenYears().

Thanks @rwsu , after a discussion with @zaneb we agree to set it back to 10y, not really any real benefit of keeping shorter - even for the TP version

andfasano · 2025-12-05T11:17:12Z

+			continue
+		}
+
+		if u.GetKind() == internalReleaseImageKind && u.GetName() == internalReleaseImageInstanceName {


note: a future improvement could be to check an exact match for the current release version

andfasano · 2025-12-05T11:50:11Z

/test golint

~~The latest failures were pretty weird, not related to the current patch o_O~~
There was a mismatch in the imports, fixing

openshift-ci · 2025-12-05T12:13:29Z

@andfasano: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-vsphere-ovn	`4ede1a7`	link	false	`/test okd-scos-e2e-vsphere-ovn`
ci/prow/e2e-aws-ovn	`4ede1a7`	link	true	`/test e2e-aws-ovn`
ci/prow/govet	`4ede1a7`	link	true	`/test govet`
ci/prow/e2e-aws-ovn-heterogeneous	`4ede1a7`	link	false	`/test e2e-aws-ovn-heterogeneous`
ci/prow/okd-scos-images	`4ede1a7`	link	true	`/test okd-scos-images`
ci/prow/e2e-aws-ovn-single-node	`4ede1a7`	link	false	`/test e2e-aws-ovn-single-node`
ci/prow/artifacts-images	`4ede1a7`	link	true	`/test artifacts-images`
ci/prow/e2e-aws-ovn-edge-zones	`4ede1a7`	link	false	`/test e2e-aws-ovn-edge-zones`
ci/prow/e2e-aws-ovn-imdsv2	`4ede1a7`	link	false	`/test e2e-aws-ovn-imdsv2`
ci/prow/e2e-aws-ovn-edge-zones-manifest-validation	`4ede1a7`	link	true	`/test e2e-aws-ovn-edge-zones-manifest-validation`
ci/prow/e2e-aws-ovn-shared-vpc-edge-zones	`4ede1a7`	link	false	`/test e2e-aws-ovn-shared-vpc-edge-zones`
ci/prow/e2e-aws-byo-subnet-role-security-groups	`4ede1a7`	link	false	`/test e2e-aws-byo-subnet-role-security-groups`
ci/prow/golint	`4ede1a7`	link	true	`/test golint`
ci/prow/e2e-aws-ovn-fips	`4ede1a7`	link	false	`/test e2e-aws-ovn-fips`
ci/prow/e2e-aws-ovn-shared-vpc-custom-security-groups	`4ede1a7`	link	false	`/test e2e-aws-ovn-shared-vpc-custom-security-groups`
ci/prow/images	`4ede1a7`	link	true	`/test images`
ci/prow/aws-private	`4ede1a7`	link	false	`/test aws-private`
ci/prow/unit	`4ede1a7`	link	true	`/test unit`
ci/prow/e2e-aws-default-config	`4ede1a7`	link	false	`/test e2e-aws-default-config`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

patrickdillon · 2025-12-05T14:01:11Z

/payload-job periodic-ci-openshift-release-master-ci-4.21-e2e-aws-ovn-techpreview-serial-1of3

openshift-ci · 2025-12-05T14:01:16Z

@patrickdillon: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-master-ci-4.21-e2e-aws-ovn-techpreview-serial-1of3

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/db64dd40-d1e2-11f0-9c33-5b02a65e89d7-0

patrickdillon · 2025-12-05T14:01:23Z

/payload-job periodic-ci-openshift-release-master-ci-4.21-e2e-aws-ovn-techpreview-serial-2of3

patrickdillon · 2025-12-05T14:01:28Z

/payload-job periodic-ci-openshift-release-master-ci-4.21-e2e-aws-ovn-techpreview-serial-3of3

openshift-ci · 2025-12-05T14:01:33Z

@patrickdillon: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-master-ci-4.21-e2e-aws-ovn-techpreview-serial-2of3

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/e2c7bbc0-d1e2-11f0-9bc4-efb6b057c087-0

openshift-ci · 2025-12-05T14:01:39Z

@patrickdillon: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-master-ci-4.21-e2e-aws-ovn-techpreview-serial-3of3

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/e52fbb10-d1e2-11f0-9bfd-d3ceb8cbe66a-0

pawanpinjarkar · 2025-12-05T14:39:12Z

/lgtm

andfasano · 2025-12-05T14:49:36Z

/label acknowledge-critical-fixes-only
/verified later @andfasano

openshift-ci-robot · 2025-12-05T14:49:49Z

@andfasano: This PR has been marked to be verified later by @andfasano.

Details

In response to this:

/label acknowledge-critical-fixes-only
/verified later @andfasano

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Dec 4, 2025

openshift-ci Bot requested review from jhixson74 and pawanpinjarkar December 4, 2025 17:18

andfasano force-pushed the iri-certs branch 2 times, most recently from 7ffe266 to 87c2c7e Compare December 4, 2025 18:45

patrickdillon reviewed Dec 4, 2025

View reviewed changes

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 4, 2025

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 4, 2025

rwsu reviewed Dec 4, 2025

View reviewed changes

andfasano force-pushed the iri-certs branch from 87c2c7e to 899086c Compare December 5, 2025 11:14

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 5, 2025

andfasano commented Dec 5, 2025

View reviewed changes

andfasano force-pushed the iri-certs branch from 899086c to 4ede1a7 Compare December 5, 2025 11:38

create a tls certificate to be used by the InternalReleaseImage registry

117d3e9

andfasano force-pushed the iri-certs branch from 4ede1a7 to 117d3e9 Compare December 5, 2025 13:07

openshift-ci Bot assigned pawanpinjarkar Dec 5, 2025

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Dec 5, 2025

openshift-ci Bot added the acknowledge-critical-fixes-only Indicates if the issuer of the label is OK with the policy. label Dec 5, 2025

openshift-ci-robot added verified-later verified Signifies that the PR passed pre-merge verification criteria labels Dec 5, 2025

openshift-merge-bot Bot merged commit ca7b596 into openshift:main Dec 5, 2025
14 of 15 checks passed

andfasano mentioned this pull request Dec 10, 2025

AGENT-1391: Use TLS cert for the InternalReleaseImage registry openshift/machine-config-operator#5483

Merged

Conversation

andfasano commented Dec 4, 2025

Uh oh!

openshift-ci-robot commented Dec 4, 2025 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

andfasano commented Dec 4, 2025

Uh oh!

patrickdillon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

patrickdillon Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

andfasano Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

andfasano Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Dec 4, 2025

Uh oh!

rwsu Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

andfasano Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

andfasano Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

andfasano commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Dec 5, 2025

Uh oh!

patrickdillon commented Dec 5, 2025

Uh oh!

openshift-ci Bot commented Dec 5, 2025

Uh oh!

patrickdillon commented Dec 5, 2025

Uh oh!

patrickdillon commented Dec 5, 2025

Uh oh!

openshift-ci Bot commented Dec 5, 2025

Uh oh!

openshift-ci Bot commented Dec 5, 2025

Uh oh!

pawanpinjarkar commented Dec 5, 2025

Uh oh!

andfasano commented Dec 5, 2025

Uh oh!

openshift-ci-robot commented Dec 5, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

openshift-ci-robot commented Dec 4, 2025 •

edited by openshift-ci Bot

Loading

andfasano commented Dec 5, 2025 •

edited

Loading