Fix etcd-metric-signer secret name in PKI verification step#82191
Conversation
openshift-ci
Bot
added
the
approved
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
WalkthroughThe PKI verification script updates the etcd metrics signer secret mapping, captures certificate algorithm and key mismatches, and reports explicit PKI custom resource mode details for pass and fail results. ChangesPKI verification
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
…ostics The etcd metrics signer secret is named "etcd-metric-signer" in the cluster-etcd-operator (pkg/tlshelpers/tlshelpers.go:40), not "etcd-metrics-signer". The name mismatch caused the PKI verification step to fail with "Could not find certificate from <stdin>". Also surface expected-vs-actual mismatch details in the summary table for failed checks instead of only showing the secret path, so failures can be diagnosed from the summary without scrolling through the full log. Assisted-by: Claude Code (Opus 4.6)
91df12a to
59bcbb0
Compare
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse |
|
@hasbro17: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
| if [[ "${status}" == "PASS" ]]; then | ||
| results+=("${status}|${description}|${namespace}/${secret_name}") | ||
| else | ||
| results+=("${status}|${description}|${fail_details}") |
There was a problem hiding this comment.
I think we should add ${namespace}/${secret_name} in case of failure too
There was a problem hiding this comment.
I think we're ok since it starts with Checking: ${description} (${namespace}/${secret_name}) above.
| "aggregator-signer|aggregator-client-signer|openshift-kube-apiserver-operator|tls.crt" | ||
| "etcd-signer|etcd-signer|openshift-etcd|tls.crt" | ||
| "etcd-metrics-signer|etcd-metrics-signer|openshift-etcd|tls.crt" | ||
| "etcd-metrics-signer|etcd-metric-signer|openshift-etcd|tls.crt" |
There was a problem hiding this comment.
Nit: the description still has the 's'
There was a problem hiding this comment.
The description should be okay since it doesn't affect the test, and technically it should be metrics-signer since it's plural.
|
/retest required |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: hasbro17, sanchezl The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest |
|
/pj-rehearse |
|
@sanchezl: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
Tests look okay now. None of the installer certs pass but that's expected since we're still waiting for openshift/installer#10595 to merge. The etcd-metric typo is fixed along with the more detailed summary table errors. { - OK
--- Checking: etcd-metrics-signer (openshift-etcd/etcd-metric-signer) ---
Algorithm: rsaEncryption - OK
Key param: Public-Key: (4096 bit) - OK
--- Checking PKI CR ---
Mode: Custom - OK
=============================================
PKI Verification Summary
=============================================
STATUS | CHECK | DETAIL
-------+-----------------------------------------------+-------
FAIL | root-ca | key: expected Public-Key: (4096 bit), got Public-Key: (2048 bit)
FAIL | kube-apiserver-to-kubelet-signer | key: expected Public-Key: (4096 bit), got Public-Key: (2048 bit)
FAIL | kube-apiserver-localhost-signer | key: expected Public-Key: (4096 bit), got Public-Key: (2048 bit)
FAIL | kube-apiserver-service-network-signer | key: expected Public-Key: (4096 bit), got Public-Key: (2048 bit)
FAIL | kube-apiserver-lb-signer | key: expected Public-Key: (4096 bit), got Public-Key: (2048 bit)
FAIL | kube-control-plane-signer | key: expected Public-Key: (4096 bit), got Public-Key: (2048 bit)
FAIL | aggregator-signer | key: expected Public-Key: (4096 bit), got Public-Key: (2048 bit)
PASS | etcd-signer | openshift-etcd/etcd-signer
PASS | etcd-metrics-signer | openshift-etcd/etcd-metric-signer
PASS | PKI CR | mode=Custom
Total: 10, Passed: 3, Failed: 7
============================================= |
|
/pj-rehearse ack |
|
@hasbro17: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
@hasbro17: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
208e27d
into
openshift:main
…ostics (openshift#82191) The etcd metrics signer secret is named "etcd-metric-signer" in the cluster-etcd-operator (pkg/tlshelpers/tlshelpers.go:40), not "etcd-metrics-signer". The name mismatch caused the PKI verification step to fail with "Could not find certificate from <stdin>". Also surface expected-vs-actual mismatch details in the summary table for failed checks instead of only showing the secret path, so failures can be diagnosed from the summary without scrolling through the full log. Assisted-by: Claude Code (Opus 4.6)
3 participants
Summary
etcd-metric-signer(
pkg/tlshelpers/tlshelpers.go:40), but the verification step was looking foretcd-metrics-signerTest plan
/test e2e-aws-ovn-pki-rsa-techpreviewon a cluster-etcd-operator or installer PR to confirm the etcd-metric-signer check passesSummary by CodeRabbit
Updates OpenShift installer PKI verification to use the operator-created
etcd-metric-signersecret, preventing false verification failures. Failed signer and PKI CR checks now report expected-versus-actual mismatch details in the summary table, improving troubleshooting for affected CI and installer validation jobs.