OCPBUGS-105321: pki: switch to ECDSA defaults and thread PKI profile to leaf certs by sanchezl · Pull Request #10743 · openshift/installer

sanchezl · 2026-08-06T00:12:34Z

Why

When ConfigurablePKI is enabled, the installer's DefaultPKIProfile() returns a hardcoded RSA-4096 placeholder instead of library-go's defaults (ECDSA P-256 / P-384). Leaf certs also ignore the PKI profile entirely and always generate RSA-2048. This diverges from what day-2 operators (CKAO, CKMO) expect when they read the PKI CR for certificate rotation.

What

Replace the local DefaultPKIProfile() with library-go's version
Extend SignerKeyParams to carry a full PKIProfile + ConfigurablePKIEnabled
Thread key resolution through to all 25 cert assets (11 signers, 14 leaves) via library-go's ResolveCertificateConfig

Why this is safe

Zero blast radius for default installs. Every cert asset has a clear feature-gate guard:

if !pkiCfg.ConfigurablePKIEnabled {
    // Legacy path — identical to pre-change code, including explicit KeyUsages
    return c.SelfSignedCertKey.Generate(ctx, cfg, "name", nil)
}
// Library-go path — only runs when ConfigurablePKI is enabled

When the feature gate is off (all production installs today), the existing hand-rolled crypto runs unchanged. The new library-go path only executes under TechPreview/CustomNoUpgrade with ConfigurablePKI explicitly enabled.

Agent flow preserved. SignerKeyParams remains zero-dependency — agent create certificates continues to work without install-config on disk, generating RSA-2048 certs via the legacy path. This pattern was established in PR #10595 after review by zaneb, tthvo, and andfasano (see PR #10595 discussion).

Easy to cull. When ConfigurablePKI is promoted to always-on, the legacy branches and the old GenerateSignedCertificate() / PrivateKey() functions can be deleted in one sweep. No behavioral dependencies between the two paths.

Design decisions from prior PRs

This PR builds on the stacked PRs #10594 and #10595 (both merged). Key decisions inherited:

Zero-dependency SignerKeyParams (PR CNTRLPLANE-2012: Wire signer certs to read PKI config via SignerKeyParams #10595, zaneb's review): avoids pulling InstallConfig validation into agent flows
AssetBase.LoadFromFile (PR CNTRLPLANE-2012: Wire signer certs to read PKI config via SignerKeyParams #10595, tthvo's feedback): strict YAML parsing without platform validation
Target list registration (PR CNTRLPLANE-2012: Wire signer certs to read PKI config via SignerKeyParams #10595, zaneb's catch): SignerKeyParams in Manifests and agentManifestsTarget for multi-step state persistence
Not in agentCertificatesTarget (PR CNTRLPLANE-2012: Wire signer certs to read PKI config via SignerKeyParams #10595, zaneb): "install-config is not an input to this command"
Accepted day-0 gap (CNTRLPLANE-3856): agent UI certs start RSA-2048, converge via day-2 rotation

Commit walkthrough

The commits are ordered to build incrementally:

vendor: bump library-go — vendor-only, no functional changes
pki: replace local DefaultPKIProfile with library-go — pkg/types/pki/defaults.go only, small
pki: extend SignerKeyParams — signerkey_params.go + all signer asset dependency updates
tls: add resolveKeyGen helpers — single new file, 24 lines
tls: add library-go code path to SelfSignedCertKey and SignedCertKey — core engine change in certkey.go
tls: wire feature-gate branches — bulk mechanical change, same pattern in every cert asset
tls: fix cert types for library-go path — JournalCertKey → Peer (serves HTTPS and authenticates curl client with same cert), AdminKubeConfigClientCertKey → Client only (drops legacy ServerAuth — verified on live cluster including localhost-recovery), dead code removal

Commit 6 is the largest but entirely mechanical — each asset follows the same pattern from commit 5. Review one asset (e.g., root.go) and spot-check the rest.

Test plan

Unit tests pass (tls, manifests, pki, configimage, ignition/machine)
Build passes (hack/build.sh)
agent create certificates integration test passes without install-config
Feature gate OFF: legacy RSA-2048 path unchanged (unit tests)
Feature gate ON: payload verification (pending)
Reviewer sign-off

Summary by CodeRabbit

New Features
- Added configurable PKI support across cluster, signer, client, and certificate authority generation.
- Supports configurable RSA and ECDSA key profiles, including custom signer settings.
- Preserves existing RSA-2048 certificate generation when configurable PKI is disabled.
Bug Fixes
- Improved certificate profile resolution and error reporting.
Tests
- Expanded coverage for legacy generation and configurable RSA-4096 and ECDSA P-384 certificates.

openshift-merge-bot · 2026-08-06T00:12:37Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

coderabbitai · 2026-08-06T00:12:43Z

📝 Walkthrough

Walkthrough

Changes

Configurable PKI now flows from effective profiles through SignerKeyParams into library-go certificate generators. TLS assets, PKI manifests, and the ingress signer preserve legacy RSA-2048 generation when the feature is disabled. Tests cover disabled PKI, default ECDSA P-384, RSA-4096, and RSA-2048 profiles.

Configurable PKI integration

Layer / File(s)	Summary
PKI profile and certificate contracts `pkg/types/pki/defaults.go`, `pkg/types/pki/defaults_test.go`, `pkg/asset/tls/signerkey_params.go`, `pkg/asset/tls/tls.go`, `go.mod`	`SignerKeyParams` now stores the effective PKI profile and feature state. `CertCfg` now records certificate type. Dependency versions support the library-go PKI APIs. Tests cover legacy and configurable defaults.
Generator-based certificate engine `pkg/asset/tls/certkey.go`, `pkg/asset/tls/certnames.go`, `pkg/asset/tls/certkey_test.go`	Certificate generation accepts optional library-go key generators. Nil generators retain legacy behavior. Tests cover RSA-4096, ECDSA P-384, and legacy RSA-2048 generation.
TLS asset migration `pkg/asset/tls/*.go`	TLS assets resolve signer, serving, peer, and client generators from `SignerKeyParams`. Disabled configurable PKI retains explicit legacy certificate settings.
Manifest and ingress integration `pkg/asset/manifests/pki.go`, `pkg/asset/manifests/pki_test.go`, `pkg/asset/imagebased/configimage/ingressoperatorsigner.go`	PKI manifest generation uses effective profiles. The ingress signer resolves configured signer key generators. Tests use signer parameters directly.

Estimated code review effort: 4 (Complex) | ~60 minutes

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 58.82% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: switching PKI defaults to ECDSA and propagating the PKI profile to leaf certificates.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Changed tests use static Test names and table-driven t.Run labels; no Ginkgo Describe, Context, When, or It titles contain dynamic values.
Test Structure And Quality	✅ Passed	The changed tests use standard testing/testify, not Ginkgo; they create no cluster resources and use no Eventually or Consistently waits, so these Ginkgo-specific checks are not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added. The PR adds only standard Go tests using testing and testify, so MicroShift API compatibility checks do not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added. The only changed tests are ordinary Go Test functions in three package unit-test files, with no node or HA assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The complete diff changes only Go TLS/PKI code and vendored PKI helpers; it adds no workload scheduling fields, node constraints, affinity, topology spread, replicas, or PDBs.
Ote Binary Stdout Contract	✅ Passed	The PR adds no main/init/TestMain/Ginkgo suite setup or stdout writes; the only added klog call is in a vendored library function, and no OTE binary exists in this repository.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds only standard Go unit tests; no new Ginkgo It/Describe/Context/When tests or IPv4/external-network assumptions were found.
No-Weak-Crypto	✅ Passed	The PR adds no MD5/SHA1/DES/RC4/Blowfish/ECB usage or secret comparisons; new key generation uses library-go RSA/ECDSA with rand.Reader, while existing SHA-1 helpers are unchanged.
Container-Privileges	✅ Passed	The full PR diff adds no container or Kubernetes manifest privilege settings; no privileged:true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation:true changes were found.
No-Sensitive-Data-In-Logs	✅ Passed	Added logs contain only generic TLS error strings; the vendor log emits a cipher name. No passwords, tokens, keys, certificates, hostnames, or customer data are logged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-08-06T00:13:18Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

sanchezl · 2026-08-06T00:13:39Z

/test all

openshift-ci · 2026-08-06T00:17:55Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign sadasu for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sanchezl · 2026-08-06T02:19:23Z

/test all

sanchezl · 2026-08-06T02:19:46Z

/pipeline required

openshift-merge-bot · 2026-08-06T02:19:49Z

Scheduling required tests:
/test e2e-azure-nat-gateway-single-zone

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-byo-subnet-role-security-groups
/test e2e-aws-default-config
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-metal-assisted
/test e2e-metal-ipi-ovn
/test e2e-metal-ipi-ovn-dualstack
/test e2e-metal-ipi-ovn-ipv6
/test e2e-metal-ipi-ovn-swapped-hosts
/test e2e-metal-ipi-ovn-virtualmedia
/test e2e-metal-ovn-two-node-arbiter
/test e2e-metal-ovn-two-node-fencing
/test e2e-metal-single-node-live-iso
/test e2e-vsphere-multi-vcenter-ovn
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-devpreview
/test e2e-vsphere-ovn-disk-setup-techpreview
/test e2e-vsphere-ovn-hybrid-env
/test e2e-vsphere-ovn-techpreview
/test e2e-vsphere-ovn-zones
/test e2e-aws-ovn

sanchezl · 2026-08-06T02:39:22Z

/test all

sanchezl · 2026-08-06T02:39:23Z

/pipeline required

openshift-merge-bot · 2026-08-06T02:39:26Z

Scheduling required tests:
/test e2e-azure-nat-gateway-single-zone

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-byo-subnet-role-security-groups
/test e2e-aws-default-config
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-metal-assisted
/test e2e-metal-ipi-ovn
/test e2e-metal-ipi-ovn-dualstack
/test e2e-metal-ipi-ovn-ipv6
/test e2e-metal-ipi-ovn-swapped-hosts
/test e2e-metal-ipi-ovn-virtualmedia
/test e2e-metal-ovn-two-node-arbiter
/test e2e-metal-ovn-two-node-fencing
/test e2e-metal-single-node-live-iso
/test e2e-vsphere-multi-vcenter-ovn
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-devpreview
/test e2e-vsphere-ovn-disk-setup-techpreview
/test e2e-vsphere-ovn-hybrid-env
/test e2e-vsphere-ovn-techpreview
/test e2e-vsphere-ovn-zones
/test e2e-aws-ovn

sanchezl · 2026-08-06T04:26:03Z

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-techpreview

sanchezl · 2026-08-06T04:26:06Z

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-10-techpreview

sanchezl · 2026-08-06T04:26:09Z

/payload-job e2e-metal-ipi-ovn-upgrade-rhcos9-techpreview

openshift-ci · 2026-08-06T04:26:10Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f047f400-914e-11f1-8e35-4bb42ad1a5c4-0

openshift-ci · 2026-08-06T04:26:11Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-10-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f1dfab00-914e-11f1-83c2-8d141c46cd05-0

sanchezl · 2026-08-06T04:26:12Z

/payload-job e2e-metal-ipi-ovn-upgrade-rhcos9-10-techpreview

openshift-ci · 2026-08-06T04:26:14Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

e2e-metal-ipi-ovn-upgrade-rhcos9-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f3b02540-914e-11f1-86a2-b0b4d2ce1f86-0

sanchezl · 2026-08-06T04:26:15Z

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-fips

openshift-ci · 2026-08-06T04:26:16Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

e2e-metal-ipi-ovn-upgrade-rhcos9-10-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f554fba0-914e-11f1-82cf-c1f8829a801b-0

sanchezl · 2026-08-06T04:26:18Z

/payload-job periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview

openshift-ci · 2026-08-06T04:26:19Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-fips

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f745a810-914e-11f1-9a6b-7a95cb0904d2-0

sanchezl · 2026-08-06T04:26:21Z

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-single-node-techpreview

openshift-ci · 2026-08-06T04:26:22Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f8b11ef0-914e-11f1-90de-25ab253cf8e2-0

sanchezl · 2026-08-06T04:26:24Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-aws-usgov-ipi-custom-dns-mini-perm-tp-f7

sanchezl · 2026-08-06T04:26:27Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-aws-c2s-ipi-disc-priv-fips-f28-tp-longduration-cloud

sanchezl · 2026-08-06T04:26:30Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-short-cert-rotation-f7

sanchezl · 2026-08-07T14:46:09Z

/test e2e-aws-ovn

openshift-ci · 2026-08-07T18:41:43Z

@sanchezl: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-metal-ovn-two-node-arbiter	`b7623bc`	link	false	`/test e2e-metal-ovn-two-node-arbiter`
ci/prow/e2e-aws-ovn-edge-zones	`b7623bc`	link	false	`/test e2e-aws-ovn-edge-zones`
ci/prow/e2e-vsphere-ovn-zones	`b7623bc`	link	false	`/test e2e-vsphere-ovn-zones`
ci/prow/e2e-aws-ovn-fips	`b7623bc`	link	false	`/test e2e-aws-ovn-fips`
ci/prow/e2e-metal-ovn-two-node-fencing	`b7623bc`	link	false	`/test e2e-metal-ovn-two-node-fencing`
ci/prow/e2e-vsphere-multi-vcenter-ovn	`b7623bc`	link	false	`/test e2e-vsphere-multi-vcenter-ovn`
ci/prow/e2e-vsphere-ovn-techpreview	`b7623bc`	link	false	`/test e2e-vsphere-ovn-techpreview`
ci/prow/e2e-metal-ipi-ovn-swapped-hosts	`b7623bc`	link	false	`/test e2e-metal-ipi-ovn-swapped-hosts`
ci/prow/e2e-aws-ovn-single-node	`b7623bc`	link	false	`/test e2e-aws-ovn-single-node`
ci/prow/e2e-metal-ipi-ovn-virtualmedia	`b7623bc`	link	false	`/test e2e-metal-ipi-ovn-virtualmedia`
ci/prow/e2e-vsphere-ovn-devpreview	`b7623bc`	link	false	`/test e2e-vsphere-ovn-devpreview`
ci/prow/e2e-metal-single-node-live-iso	`b7623bc`	link	false	`/test e2e-metal-single-node-live-iso`
ci/prow/e2e-metal-ipi-ovn-dualstack	`b7623bc`	link	false	`/test e2e-metal-ipi-ovn-dualstack`
ci/prow/e2e-vsphere-ovn-hybrid-env	`b7623bc`	link	false	`/test e2e-vsphere-ovn-hybrid-env`
ci/prow/e2e-vsphere-ovn-disk-setup-techpreview	`b7623bc`	link	false	`/test e2e-vsphere-ovn-disk-setup-techpreview`
ci/prow/e2e-aws-default-config	`b7623bc`	link	false	`/test e2e-aws-default-config`
ci/prow/e2e-aws-ovn-heterogeneous	`b7623bc`	link	false	`/test e2e-aws-ovn-heterogeneous`
ci/prow/e2e-aws-ovn-shared-vpc-edge-zones	`b7623bc`	link	false	`/test e2e-aws-ovn-shared-vpc-edge-zones`
ci/prow/e2e-vsphere-ovn	`b7623bc`	link	true	`/test e2e-vsphere-ovn`
ci/prow/e2e-metal-assisted	`b7623bc`	link	false	`/test e2e-metal-assisted`
ci/prow/e2e-aws-ovn-imdsv2	`b7623bc`	link	false	`/test e2e-aws-ovn-imdsv2`
ci/prow/e2e-aws-byo-subnet-role-security-groups	`b7623bc`	link	false	`/test e2e-aws-byo-subnet-role-security-groups`
ci/prow/e2e-aws-ovn-shared-vpc-custom-security-groups	`b7623bc`	link	false	`/test e2e-aws-ovn-shared-vpc-custom-security-groups`
ci/prow/e2e-metal-ipi-ovn-ipv6	`b7623bc`	link	true	`/test e2e-metal-ipi-ovn-ipv6`
ci/prow/e2e-metal-ipi-ovn	`b7623bc`	link	false	`/test e2e-metal-ipi-ovn`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

sanchezl · 2026-08-07T18:49:32Z

/retest

sanchezl · 2026-08-07T18:49:33Z

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-techpreview

sanchezl · 2026-08-07T18:49:36Z

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-10-techpreview

sanchezl · 2026-08-07T18:49:39Z

/payload-job e2e-metal-ipi-ovn-upgrade-rhcos9-techpreview

sanchezl · 2026-08-07T18:49:43Z

/payload-job e2e-metal-ipi-ovn-upgrade-rhcos9-10-techpreview

sanchezl · 2026-08-07T18:49:46Z

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-fips

sanchezl · 2026-08-07T18:49:49Z

/payload-job periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview

sanchezl · 2026-08-07T18:49:52Z

/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-single-node-techpreview

sanchezl · 2026-08-07T18:49:55Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-aws-usgov-ipi-custom-dns-mini-perm-tp-f7

sanchezl · 2026-08-07T18:49:58Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-aws-c2s-ipi-disc-priv-fips-f28-tp-longduration-cloud

sanchezl · 2026-08-07T18:50:01Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-short-cert-rotation-f7

sanchezl · 2026-08-07T18:50:05Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-ipi-proxy-fips-regen-cert-f14

sanchezl · 2026-08-07T18:50:08Z

/payload-job periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-rhcos10-fips-techpreview-serial-1of2

sanchezl · 2026-08-07T18:50:11Z

/payload-job periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-rhcos10-fips-techpreview-serial-2of2

openshift-ci · 2026-08-07T18:53:35Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-aws-c2s-ipi-disc-priv-fips-f28-tp-longduration-cloud

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/cacb8f00-9290-11f1-8487-cf3a1805c877-0

openshift-ci · 2026-08-07T18:53:35Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-short-cert-rotation-f7

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/cc444c50-9290-11f1-9665-04dd09631bb0-0

openshift-ci · 2026-08-07T18:53:36Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-rhcos10-fips-techpreview-serial-2of2

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/d2bca3c0-9290-11f1-93a9-ea984056802f-0

openshift-ci · 2026-08-07T18:53:36Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/bb4fc870-9290-11f1-880f-d771e4579bed-0

openshift-ci · 2026-08-07T18:53:36Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-single-node-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/c69a1a50-9290-11f1-975a-d2e2f14e9831-0

openshift-ci · 2026-08-07T18:53:37Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

e2e-metal-ipi-ovn-upgrade-rhcos9-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/bf6ccac0-9290-11f1-9e4d-6d96c80d7ffc-0

openshift-ci · 2026-08-07T18:53:37Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-aws-usgov-ipi-custom-dns-mini-perm-tp-f7

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/c8ef7c00-9290-11f1-94d0-692d5cbb577d-0

openshift-ci · 2026-08-07T18:53:38Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-ipi-proxy-fips-regen-cert-f14

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/ce51a880-9290-11f1-8534-9d3be7d1c4e2-0

openshift-ci · 2026-08-07T18:53:38Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

e2e-metal-ipi-ovn-upgrade-rhcos9-10-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/c1165c10-9290-11f1-925b-81da9ff1cfcf-0

openshift-ci · 2026-08-07T18:53:38Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-fips

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/c365ca50-9290-11f1-9b7e-dc981939baf2-0

openshift-ci · 2026-08-07T18:53:39Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips-rhcos9-10-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/bd6b7c80-9290-11f1-8dd1-93b85b95cdd7-0

openshift-ci · 2026-08-07T18:53:39Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-rhcos10-fips-techpreview-serial-1of2

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/d09f4200-9290-11f1-9196-c620fcae606f-0

openshift-ci · 2026-08-07T18:53:40Z

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/c4dc16a0-9290-11f1-8f47-a0fd447535ac-0

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 6, 2026

sanchezl force-pushed the pki-ecdsa-defaults branch from 06ad91c to 9f4aa80 Compare August 6, 2026 02:18

sanchezl force-pushed the pki-ecdsa-defaults branch from 9f4aa80 to 65df21c Compare August 6, 2026 02:36

coderabbitai Bot mentioned this pull request Aug 7, 2026

no-jira: vendor: update o/api to the latest after several Feature promotions to default #10746

Merged

Uh oh!

Conversation

sanchezl commented Aug 6, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Why this is safe

Design decisions from prior PRs

Commit walkthrough

Test plan

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Aug 6, 2026

Uh oh!

coderabbitai Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

openshift-ci Bot commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 6, 2026

Uh oh!

sanchezl commented Aug 7, 2026

Uh oh!

openshift-ci Bot commented Aug 7, 2026

Uh oh!

sanchezl commented Aug 7, 2026

Uh oh!

sanchezl commented Aug 7, 2026

Uh oh!

sanchezl commented Aug 7, 2026

Uh oh!

sanchezl commented Aug 6, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading