Common name in kubernetes certificates is invalid
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Magnum |
In Progress
|
Undecided
|
Spyros Trigazis | ||
Bug Description
In kubernetes with atomic we have a set of certificates that we use in three places:
1. etcd
2. kubernetes apiserver
3. kubernetes service accounts
In order to make service accounts work we need to set the common name properly in the certificates.
example failure for a service running in a cluster which failed:
Caused by: javax.net.
certificate: sha1/IP/
DN: CN=kubernetes.
Reference cert configuration in CoreOS docs:
https:/
We need similar changes in CoreOS drivers and openSUSE.
http://
http://
| Changed in magnum: | |
| assignee: | nobody → Mathieu Velten (matmaul) |
| status: | New → In Progress |
| Changed in magnum: | |
| assignee: | Mathieu Velten (matmaul) → Spyros Trigazis (strigazi) |
| OpenStack Infra (hudson-openstack) wrote Fix merged to magnum (master) | #1 |
| OpenStack Infra (hudson-openstack) wrote Fix proposed to magnum (stable/ocata) | #2 |
| OpenStack Infra (hudson-openstack) wrote Fix merged to magnum (stable/ocata) | #3 |
| tags: | added: in-stable-ocata |
Reviewed: https:/
Committed: https:/
Submitter: Jenkins
Branch: master
commit a7ab475cd0917ff
Author: Mathieu Velten <email address hidden>
Date: Mon Jul 17 10:53:21 2017 +0200
Use kubernetes service name in cert request
In kubernetes with atomic we have a set of certificates that we use in
three places:
1. etcd
2. kubernetes apiserver
3. kubernetes service accounts
In order to make service accounts work we need to set the common name
properly in the certificates.
Partial-Bug: #1705694
Change-Id: I04ed3bba938f0d