OCPBUGS-62792: Fix self-signed serving cert using 30ns lifetime instead of 30 days by jubittajohn · Pull Request #2155 · openshift/library-go

jubittajohn · 2026-04-08T18:29:07Z

library-go crypto MakeSelfSignedCA and MakeServerCert were updated to use time.Duration instead of days, Update MakeServerCert() call in AddDefaultRotationToConfig() to reflect this change (#1943 that introduced this change)

Signed-off-by: jubittajohn <jujohn@redhat.com>

openshift-ci-robot · 2026-04-08T18:29:14Z

@jubittajohn: This pull request references Jira Issue OCPBUGS-62792, which is invalid:

expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

library-go crypto MakeSelfSignedCA and MakeServerCert were updated to use time.Duration instead of days, MakeServerCert() call in AddDefaultRotationToConfig() to reflect this change

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-04-08T18:29:22Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e931fcf3-684b-4819-bfe9-ba41acd3af80

📥 Commits

Reviewing files that changed from the base of the PR and between 12d8376 and 13b8307.

📒 Files selected for processing (1)

pkg/controller/controllercmd/cmd.go

Walkthrough

Updated certificate validity duration in AddDefaultRotationToConfig from an ambiguous hard-coded value to an explicit 30-day time duration using time.Hour*24*30. Reordered the k8s.io/utils/clock import relative to other imports. No functional behavior changes to control flow or exported APIs.

Changes

Cohort / File(s)	Summary
Certificate generation duration clarification `pkg/controller/controllercmd/cmd.go`	Modified self-signed serving certificate validity from hard-coded `30` to explicit `time.Hour2430` for clarity. Reordered `k8s.io/utils/clock` import relative to standard library imports.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

p0lyn0mial · 2026-04-09T10:49:51Z

/assign @sanchezl

sanchezl

/lgtm

sanchezl · 2026-04-10T00:42:15Z

/jira refresh

openshift-ci-robot · 2026-04-10T00:42:22Z

@sanchezl: This pull request references Jira Issue OCPBUGS-62792, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.22.0) matches configured target version for branch (4.22.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @wangke19

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-04-10T00:42:25Z

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: wangke19.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

@sanchezl: This pull request references Jira Issue OCPBUGS-62792, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)

bug target version (4.22.0) matches configured target version for branch (4.22.0)

bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @wangke19

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

sanchezl · 2026-04-10T00:48:38Z

/retitle OCPBUGS-62792: Fix self-signed serving cert using 30ns lifetime instead of 30 days

p0lyn0mial · 2026-04-13T08:51:16Z

 			config.ServingInfo.KeyFile = filepath.Join(temporaryCertDir, "tls.key")
 			// nothing can trust this, so we don't really care about hostnames
-			servingCert, err := ca.MakeServerCert(sets.New("localhost"), 30)
+			servingCert, err := ca.MakeServerCert(sets.New("localhost"), time.Hour*24*30)


nice find!

the bug is real, yet no one has complained. I think this might be because the self-signed path almost never occurs in real clusters. When it does happen, I think the self-signed certificate only needs to last until the real certificate arrives.

worth adding a unit test ?

should we backport ?

please don't forget to bump the operators.

p0lyn0mial · 2026-04-13T08:52:49Z

/lgtm

openshift-ci · 2026-04-13T08:53:17Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jubittajohn, p0lyn0mial, sanchezl

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [p0lyn0mial]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-04-13T09:28:32Z

@jubittajohn: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-04-13T09:33:34Z

@jubittajohn: Jira Issue OCPBUGS-62792: Some pull requests linked via external trackers have merged:

openshift/library-go#2155

The following pull request, linked via external tracker, has not merged:

openshift/cluster-kube-apiserver-operator#2098 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-62792 has not been moved to the MODIFIED state.

Details

In response to this:

library-go crypto MakeSelfSignedCA and MakeServerCert were updated to use time.Duration instead of days, Update MakeServerCert() call in AddDefaultRotationToConfig() to reflect this change (#1943 that introduced this change)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

update MakeServerCert to use time.Duration instead of days

13b8307

Signed-off-by: jubittajohn <jujohn@redhat.com>

openshift-ci Bot requested review from bertinatto and deads2k April 8, 2026 18:29

openshift-ci Bot assigned sanchezl Apr 9, 2026

This was referenced Apr 9, 2026

OCPBUGS-62792: Fix self-signed serving cert using 30ns lifetime instead of 30 days openshift/cluster-kube-apiserver-operator#2098

Closed

Update MakeServerCert() call to use time.Duration (4.19) #2158

Merged

sanchezl approved these changes Apr 10, 2026

View reviewed changes

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 10, 2026

sanchezl approved these changes Apr 10, 2026

View reviewed changes

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Apr 10, 2026

openshift-ci Bot changed the title ~~OCPBUGS-62792: Update MakeServerCert() call in AddDefaultRotationToConfig() to use time.Duration instead of days~~ OCPBUGS-62792: Fix self-signed serving cert using 30ns lifetime instead of 30 days Apr 10, 2026

p0lyn0mial reviewed Apr 13, 2026

View reviewed changes

openshift-ci Bot assigned p0lyn0mial Apr 13, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 13, 2026

openshift-merge-bot Bot merged commit d2db42c into openshift:master Apr 13, 2026
5 checks passed

jubittajohn mentioned this pull request Apr 27, 2026

OCPBUGS-84536: Update MakeServerCert to use time.Duration instead of days #2183

Merged

Conversation

jubittajohn commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Apr 8, 2026

Uh oh!

coderabbitai Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

p0lyn0mial commented Apr 9, 2026

Uh oh!

sanchezl left a comment

Choose a reason for hiding this comment

Uh oh!

sanchezl commented Apr 10, 2026

Uh oh!

openshift-ci-robot commented Apr 10, 2026

Uh oh!

openshift-ci Bot commented Apr 10, 2026

Uh oh!

sanchezl commented Apr 10, 2026

Uh oh!

p0lyn0mial Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

p0lyn0mial commented Apr 13, 2026

Uh oh!

openshift-ci Bot commented Apr 13, 2026

Uh oh!

openshift-ci Bot commented Apr 13, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jubittajohn commented Apr 8, 2026 •

edited

Loading

coderabbitai Bot commented Apr 8, 2026 •

edited

Loading

p0lyn0mial Apr 13, 2026 •

edited

Loading