Skip to content

CNTRLPLANE-3652: Add TLS ownership for 5 unowned artifacts #31348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
oceanc80 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

CNTRLPLANE-3652: Add TLS ownership for 5 unowned artifacts #31348

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a9a7155
tls: add ownership for 5 TLS artifacts missing owners
redhat-chai-bot Jun 29, 2026
196a8c5
tls: fix TOC anchor fragments to use lowercase slugs
redhat-chai-bot Jul 2, 2026
ebb24c7
tls: update deps.diff for library-go markdown carry patch
redhat-chai-bot Jul 6, 2026
1ed2b76
tls: revert vendor carry patch, keep ownership data
redhat-chai-bot Jul 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions deps.diff
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
diff --no-dereference -N -r current/vendor/github.com/openshift/library-go/pkg/markdown/markdown.go updated/vendor/github.com/openshift/library-go/pkg/markdown/markdown.go
58d57
< tocLink = strings.ToLower(tocLink)
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
20 changes: 10 additions & 10 deletions tls/autoregenerate-after-expiry/autoregenerate-after-expiry.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@
"Name": "extension-apiserver-authentication"
},
"certificateAuthorityBundleInfo": {
"owningJiraComponent": "",
"description": ""
"owningJiraComponent": "kube-apiserver",
"description": "CA bundle used to verify client certificates for aggregated API servers, managed by kube-apiserver."
}
},
"OnDiskLocation": null
Expand Down Expand Up @@ -515,8 +515,8 @@
"Name": "default-ingress-cert"
},
"certificateAuthorityBundleInfo": {
"owningJiraComponent": "",
"description": ""
"owningJiraComponent": "Networking / router",
"description": "CA bundle containing the certificate for the default ingress controller, published by the ingress operator."
}
},
"OnDiskLocation": null
Expand Down Expand Up @@ -734,8 +734,8 @@
"Name": "default-ingress-cert"
},
"certificateAuthorityBundleInfo": {
"owningJiraComponent": "",
"description": ""
"owningJiraComponent": "Networking / router",
"description": "CA bundle containing the certificate for the default ingress controller, published by the ingress operator."
}
},
"OnDiskLocation": null
Expand Down Expand Up @@ -3756,8 +3756,8 @@
"Name": "router-certs-default"
},
"certKeyInfo": {
"owningJiraComponent": "",
"description": ""
"owningJiraComponent": "Networking / router",
"description": "Serving certificate for the default ingress controller, managed by the ingress operator."
}
},
"OnDiskLocation": null
Expand Down Expand Up @@ -3838,8 +3838,8 @@
"Name": "router-ca"
},
"certKeyInfo": {
"owningJiraComponent": "",
"description": ""
"owningJiraComponent": "Networking / router",
"description": "CA certificate used by the ingress operator to sign default serving certificates for ingress controllers."
}
},
"OnDiskLocation": null
Expand Down
196 changes: 98 additions & 98 deletions tls/autoregenerate-after-expiry/autoregenerate-after-expiry.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,61 +1,61 @@
# Auto Regenerate After Offline Expiry

## Table of Contents
- [How to meet the requirement](#How-to-meet-the-requirement)
- [Items Do NOT Meet the Requirement (243)](#Items-Do-NOT-Meet-the-Requirement-243)
- [Unknown Owner (5)](#Unknown-Owner-5)
- [Certificates (2)](#Certificates-2)
- [Certificate Authority Bundles (3)](#Certificate-Authority-Bundles-3)
- [Bare Metal Hardware Provisioning / cluster-baremetal-operator (1)](#Bare-Metal-Hardware-Provisioning-/-cluster-baremetal-operator-1)
- [Certificates (1)](#Certificates-1)
- [Cloud Compute / Cloud Controller Manager (1)](#Cloud-Compute-/-Cloud-Controller-Manager-1)
- [Certificate Authority Bundles (1)](#Certificate-Authority-Bundles-1)
- [End User (1)](#End-User-1)
- [Certificate Authority Bundles (1)](#Certificate-Authority-Bundles-1)
- [Etcd (1)](#Etcd-1)
- [Certificate Authority Bundles (1)](#Certificate-Authority-Bundles-1)
- [Image Registry (4)](#Image-Registry-4)
- [Certificate Authority Bundles (4)](#Certificate-Authority-Bundles-4)
- [Machine Config Operator (6)](#Machine-Config-Operator-6)
- [Certificates (2)](#Certificates-2)
- [Certificate Authority Bundles (4)](#Certificate-Authority-Bundles-4)
- [Monitoring (8)](#Monitoring-8)
- [Certificates (3)](#Certificates-3)
- [Certificate Authority Bundles (5)](#Certificate-Authority-Bundles-5)
- [Networking / cluster-network-operator (41)](#Networking-/-cluster-network-operator-41)
- [Certificates (8)](#Certificates-8)
- [Certificate Authority Bundles (33)](#Certificate-Authority-Bundles-33)
- [Node / Kubelet (2)](#Node-/-Kubelet-2)
- [Certificates (2)](#Certificates-2)
- [Operator Framework / operator-lifecycle-manager (2)](#Operator-Framework-/-operator-lifecycle-manager-2)
- [Certificates (2)](#Certificates-2)
- [RHCOS (2)](#RHCOS-2)
- [Certificate Authority Bundles (2)](#Certificate-Authority-Bundles-2)
- [How to meet the requirement](#how-to-meet-the-requirement)
- [Items Do NOT Meet the Requirement (243)](#items-do-not-meet-the-requirement-243)
- [Bare Metal Hardware Provisioning / cluster-baremetal-operator (1)](#bare-metal-hardware-provisioning-/-cluster-baremetal-operator-1)
- [Certificates (1)](#certificates-1)
- [Cloud Compute / Cloud Controller Manager (1)](#cloud-compute-/-cloud-controller-manager-1)
- [Certificate Authority Bundles (1)](#certificate-authority-bundles-1)
- [End User (1)](#end-user-1)
- [Certificate Authority Bundles (1)](#certificate-authority-bundles-1)
- [Etcd (1)](#etcd-1)
- [Certificate Authority Bundles (1)](#certificate-authority-bundles-1)
- [Image Registry (4)](#image-registry-4)
- [Certificate Authority Bundles (4)](#certificate-authority-bundles-4)
- [Machine Config Operator (6)](#machine-config-operator-6)
- [Certificates (2)](#certificates-2)
- [Certificate Authority Bundles (4)](#certificate-authority-bundles-4)
- [Monitoring (8)](#monitoring-8)
- [Certificates (3)](#certificates-3)
- [Certificate Authority Bundles (5)](#certificate-authority-bundles-5)
- [Networking / cluster-network-operator (41)](#networking-/-cluster-network-operator-41)
- [Certificates (8)](#certificates-8)
- [Certificate Authority Bundles (33)](#certificate-authority-bundles-33)
- [Networking / router (4)](#networking-/-router-4)
- [Certificates (2)](#certificates-2)
- [Certificate Authority Bundles (2)](#certificate-authority-bundles-2)
- [Node / Kubelet (2)](#node-/-kubelet-2)
- [Certificates (2)](#certificates-2)
- [Operator Framework / operator-lifecycle-manager (2)](#operator-framework-/-operator-lifecycle-manager-2)
- [Certificates (2)](#certificates-2)
- [RHCOS (2)](#rhcos-2)
- [Certificate Authority Bundles (2)](#certificate-authority-bundles-2)
- [apiserver-auth (5)](#apiserver-auth-5)
- [Certificates (3)](#Certificates-3)
- [Certificate Authority Bundles (2)](#Certificate-Authority-Bundles-2)
- [Certificates (3)](#certificates-3)
- [Certificate Authority Bundles (2)](#certificate-authority-bundles-2)
- [cluster-network-operator (1)](#cluster-network-operator-1)
- [Certificate Authority Bundles (1)](#Certificate-Authority-Bundles-1)
- [Certificate Authority Bundles (1)](#certificate-authority-bundles-1)
- [etcd (34)](#etcd-34)
- [Certificates (25)](#Certificates-25)
- [Certificate Authority Bundles (9)](#Certificate-Authority-Bundles-9)
- [kube-apiserver (14)](#kube-apiserver-14)
- [Certificates (3)](#Certificates-3)
- [Certificate Authority Bundles (11)](#Certificate-Authority-Bundles-11)
- [Certificates (25)](#certificates-25)
- [Certificate Authority Bundles (9)](#certificate-authority-bundles-9)
- [kube-apiserver (15)](#kube-apiserver-15)
- [Certificates (3)](#certificates-3)
- [Certificate Authority Bundles (12)](#certificate-authority-bundles-12)
- [kube-controller-manager (12)](#kube-controller-manager-12)
- [Certificates (3)](#Certificates-3)
- [Certificate Authority Bundles (9)](#Certificate-Authority-Bundles-9)
- [Certificates (3)](#certificates-3)
- [Certificate Authority Bundles (9)](#certificate-authority-bundles-9)
- [kube-scheduler (1)](#kube-scheduler-1)
- [Certificate Authority Bundles (1)](#Certificate-Authority-Bundles-1)
- [Certificate Authority Bundles (1)](#certificate-authority-bundles-1)
- [openshift-apiserver (1)](#openshift-apiserver-1)
- [Certificate Authority Bundles (1)](#Certificate-Authority-Bundles-1)
- [Certificate Authority Bundles (1)](#certificate-authority-bundles-1)
- [service-ca (101)](#service-ca-101)
- [Certificates (98)](#Certificates-98)
- [Certificate Authority Bundles (3)](#Certificate-Authority-Bundles-3)
- [Items That DO Meet the Requirement (32)](#Items-That-DO-Meet-the-Requirement-32)
- [Certificates (98)](#certificates-98)
- [Certificate Authority Bundles (3)](#certificate-authority-bundles-3)
- [Items That DO Meet the Requirement (32)](#items-that-do-meet-the-requirement-32)
- [kube-apiserver (32)](#kube-apiserver-32)
- [Certificates (22)](#Certificates-22)
- [Certificate Authority Bundles (10)](#Certificate-Authority-Bundles-10)
- [Certificates (22)](#certificates-22)
- [Certificate Authority Bundles (10)](#certificate-authority-bundles-10)


## How to meet the requirement
Expand All @@ -78,44 +78,6 @@ This assertion means that you have
If you have not done this, you should not merge the annotation.

## Items Do NOT Meet the Requirement (243)
### Unknown Owner (5)
#### Certificates (2)
1. ns/openshift-ingress secret/router-certs-default

**Description:**


2. ns/openshift-ingress-operator secret/router-ca

**Description:**




#### Certificate Authority Bundles (3)
1. ns/kube-system configmap/extension-apiserver-authentication

**Description:**


Other locations:

* file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/configmaps/aggregator-client-ca/ca-bundle.crt
* file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/aggregator-client-ca/ca-bundle.crt


2. ns/openshift-config-managed configmap/default-ingress-cert

**Description:**


3. ns/openshift-console configmap/default-ingress-cert

**Description:**




### Bare Metal Hardware Provisioning / cluster-baremetal-operator (1)
#### Certificates (1)
1. ns/openshift-machine-api secret/metal3-ironic-tls
Expand Down Expand Up @@ -504,6 +466,33 @@ If you have not done this, you should not merge the annotation.



### Networking / router (4)
#### Certificates (2)
1. ns/openshift-ingress secret/router-certs-default

**Description:** Serving certificate for the default ingress controller, managed by the ingress operator.


2. ns/openshift-ingress-operator secret/router-ca

**Description:** CA certificate used by the ingress operator to sign default serving certificates for ingress controllers.




#### Certificate Authority Bundles (2)
1. ns/openshift-config-managed configmap/default-ingress-cert

**Description:** CA bundle containing the certificate for the default ingress controller, published by the ingress operator.


2. ns/openshift-console configmap/default-ingress-cert

**Description:** CA bundle containing the certificate for the default ingress controller, published by the ingress operator.




### Node / Kubelet (2)
#### Certificates (2)
1. file /var/lib/kubelet/pki/kubelet-client-\<timestamp>.pem
Expand Down Expand Up @@ -864,7 +853,7 @@ If you have not done this, you should not merge the annotation.



### kube-apiserver (14)
### kube-apiserver (15)
#### Certificates (3)
1. ns/openshift-kube-apiserver secret/node-kubeconfigs

Expand All @@ -891,13 +880,24 @@ If you have not done this, you should not merge the annotation.



#### Certificate Authority Bundles (11)
1. ns/openshift-config configmap/admin-kubeconfig-client-ca
#### Certificate Authority Bundles (12)
1. ns/kube-system configmap/extension-apiserver-authentication

**Description:** CA bundle used to verify client certificates for aggregated API servers, managed by kube-apiserver.


Other locations:

* file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/configmaps/aggregator-client-ca/ca-bundle.crt
* file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/aggregator-client-ca/ca-bundle.crt


2. ns/openshift-config configmap/admin-kubeconfig-client-ca

**Description:** CA for kube-apiserver to recognize the system:master created by the installer.


2. ns/openshift-config-managed configmap/kube-apiserver-client-ca
3. ns/openshift-config-managed configmap/kube-apiserver-client-ca

**Description:**

Expand All @@ -909,7 +909,7 @@ If you have not done this, you should not merge the annotation.
* file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/client-ca/ca-bundle.crt


3. ns/openshift-config-managed configmap/kube-apiserver-server-ca
4. ns/openshift-config-managed configmap/kube-apiserver-server-ca

**Description:**

Expand All @@ -923,12 +923,12 @@ If you have not done this, you should not merge the annotation.
* file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfig


4. ns/openshift-config-managed configmap/kubelet-bootstrap-kubeconfig
5. ns/openshift-config-managed configmap/kubelet-bootstrap-kubeconfig

**Description:**


5. ns/openshift-controller-manager configmap/client-ca
6. ns/openshift-controller-manager configmap/client-ca

**Description:**

Expand All @@ -940,7 +940,7 @@ If you have not done this, you should not merge the annotation.
* file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/client-ca/ca-bundle.crt


6. ns/openshift-kube-apiserver configmap/client-ca
7. ns/openshift-kube-apiserver configmap/client-ca

**Description:**

Expand All @@ -952,7 +952,7 @@ If you have not done this, you should not merge the annotation.
* file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/client-ca/ca-bundle.crt


7. ns/openshift-kube-apiserver configmap/kube-apiserver-server-ca
8. ns/openshift-kube-apiserver configmap/kube-apiserver-server-ca

**Description:**

Expand All @@ -966,7 +966,7 @@ If you have not done this, you should not merge the annotation.
* file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfig


8. ns/openshift-kube-controller-manager configmap/client-ca
9. ns/openshift-kube-controller-manager configmap/client-ca

**Description:**

Expand All @@ -978,7 +978,7 @@ If you have not done this, you should not merge the annotation.
* file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/client-ca/ca-bundle.crt


9. ns/openshift-route-controller-manager configmap/client-ca
10. ns/openshift-route-controller-manager configmap/client-ca

**Description:**

Expand All @@ -990,7 +990,7 @@ If you have not done this, you should not merge the annotation.
* file /etc/kubernetes/static-pod-resources/kube-controller-manager-certs/configmaps/client-ca/ca-bundle.crt


10. file /etc/kubernetes/kubeconfig
11. file /etc/kubernetes/kubeconfig

**Description:**

Expand All @@ -1003,7 +1003,7 @@ If you have not done this, you should not merge the annotation.
* file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfig


11. file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/configmaps/trusted-ca-bundle/ca-bundle.crt
12. file /etc/kubernetes/static-pod-resources/kube-apiserver-certs/configmaps/trusted-ca-bundle/ca-bundle.crt

**Description:**

Expand Down
Loading