AUTH-296: Finish the removal of the root CA

[stlaz]

This PR does a couple of things in order to be able to finally remove the root CA:

1. generates serving certificates for the KAS
2. fixes the trust for ingress CA which caused the default router cert to be signed by the service-ca
3. removes the root CA and most of the original crypto code as that becomes unused

---

depends on:

• AUTH-296: work out etcd certificates #975
• AUTH-296: generate kubelet certs properly #981

[pmtk]

/retest-required

[stlaz]

/retest
this is rather odd

[openshift-ci]

@stlaz: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/periodic-ocp-4.13-images	700e744	link	true	/test periodic-ocp-4.13-images

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[stlaz]

The errors turned out to be because of the changes to assets locations, should be fixed now

[dhellmann]

Should this name match the change in service-internal.yaml?

[stlaz]

it shouldn't, these are two different secrets

[oglok]

This is more aligned with what OCP has, right?

An OCP 4.12 cluster has the following objects:

 oc --kubeconfig kubeconfig-clusterbot get secret router-certs-default -n openshift-ingress
NAME                   TYPE                DATA   AGE
router-certs-default   kubernetes.io/tls   2      41m

[root@maxwell ~]# oc --kubeconfig kubeconfig-clusterbot get svc router-internal-default -n openshift-ingress -o yaml
apiVersion: v1
kind: Service
metadata:
  annotations:
    service.alpha.openshift.io/serving-cert-secret-name: router-metrics-certs-default
    service.alpha.openshift.io/serving-cert-signed-by: openshift-service-serving-signer@1667219307
    service.beta.openshift.io/serving-cert-signed-by: openshift-service-serving-signer@1667219307
  creationTimestamp: "2022-10-31T12:29:41Z"
  labels:
    ingresscontroller.operator.openshift.io/owning-ingresscontroller: default
  name: router-internal-default
  namespace: openshift-ingress
  ownerReferences:
  - apiVersion: apps/v1
    controller: true
    kind: Deployment
    name: router-default
    uid: 158f6632-1e72-42e1-a455-e3412ac5666a
  resourceVersion: "9123"
  uid: daded2dc-55fd-41b1-b690-a46e11a5b171
spec:
  clusterIP: 172.30.158.236
  clusterIPs:
  - 172.30.158.236
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: http
  - name: https
    port: 443
    protocol: TCP
    targetPort: https
  - name: metrics
    port: 1936
    protocol: TCP
    targetPort: 1936
  selector:
    ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
  sessionAffinity: None
  type: ClusterIP
status:
  loadBalancer: {}

[stlaz]

Yes, OCP separates the trust for external (routes) and internal cluster services.

In OCP, for the router, we use the internal router port to scrape metrics from, and so on the service network we use the service-ca-signed certificate, as that is the certificate Prometheus should trust for these purposes.

Service-CA should only ever sign the internal services so that services running in the cluster can choose to only trust the internal cluster traffic. The external router interface is signed by a different certificate that, unlike the service-ca cert, should appear in the end-user trust bundle.

[oglok]

@stlaz could you please rebase?

[stlaz]

@oglok done! 👍

[oglok]

Ok, PR has been reviewed and tested. Great work @stlaz ! Glad to be merging this important milestone!

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: oglok, stlaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [oglok,stlaz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment