OCPBUGS-61221-63545# Ensure new keypairs are not generated and public-key-file flag is used where appropriate #101095

sslocket · 2025-10-27T13:57:11Z

Version(s):

4.16+

Issues:

https://issues.redhat.com/browse/OCPBUGS-61221
https://issues.redhat.com/browse/OCPBUGS-63545

Link to docs preview:

Rotating AWS OIDC bound service account signer keys -- https://101095--ocpdocs-pr.netlify.app/openshift-enterprise/latest/post_installation_configuration/changing-cloud-credentials-configuration.html#rotating-bound-service-keys_key-rotation-aws
Rotating Google Cloud bound service account signer keys -- https://101095--ocpdocs-pr.netlify.app/openshift-enterprise/latest/updating/preparing_for_updates/preparing-manual-creds-update.html#cco-ccoctl-upgrading_preparing-manual-creds-update
Rotating Azure OIDC bound service account signer keys -- https://101095--ocpdocs-pr.netlify.app/openshift-enterprise/latest/post_installation_configuration/changing-cloud-credentials-configuration.html#rotating-bound-service-keys_key-rotation-azure
Updating cloud provider resources with the Cloud Credential Operator utility -- https://101095--ocpdocs-pr.netlify.app/openshift-enterprise/latest/updating/preparing_for_updates/preparing-manual-creds-update.html#cco-ccoctl-upgrading_preparing-manual-creds-update

QE review:

QE has approved this change.

Additional information:

ocpdocs-previewbot · 2025-10-27T14:19:15Z

🤖 Wed Nov 05 20:53:34 - Prow CI generated the docs preview:

https://101095--ocpdocs-pr.netlify.app/openshift-enterprise/latest/post_installation_configuration/changing-cloud-credentials-configuration.html
https://101095--ocpdocs-pr.netlify.app/openshift-enterprise/latest/updating/preparing_for_updates/preparing-manual-creds-update.html

ocpdocs-vale-bot · 2025-10-27T14:20:49Z

modules/cco-ccoctl-upgrading.adoc

+<5> Specify the path to the output directory.
+<6> Specify the path to the `serviceaccount-signer.public` file that you extracted from the cluster.
+<7> Optional: By default, the `ccoctl` utility stores the OpenID Connect (OIDC) configuration files in a public S3 bucket and uses the S3 URL as the public OIDC endpoint. To store the OIDC configuration in a private S3 bucket that is accessed by the IAM identity provider through a public CloudFront distribution URL instead, use the `--create-private-s3-bucket` parameter.
 ====


🤖 [error] AsciiDocDITA.TaskExample: Examples are allowed only once in DITA tasks.

ocpdocs-vale-bot · 2025-10-27T14:20:50Z

modules/cco-ccoctl-upgrading.adoc

+<5> Specify the path to the output directory.
+<6> Specify the path to the `serviceaccount-signer.public` file that you extracted from the cluster.
+<7> Optional: By default, the `ccoctl` utility stores the OpenID Connect (OIDC) configuration files in a public S3 bucket and uses the S3 URL as the public OIDC endpoint. To store the OIDC configuration in a private S3 bucket that is accessed by the IAM identity provider through a public CloudFront distribution URL instead, use the `--create-private-s3-bucket` parameter.
 ====


🤖 [error] AsciiDocDITA.ExampleBlock: Examples can not be inside of other blocks in DITA.

jstuever · 2025-10-27T16:32:08Z

lgtm

sslocket · 2025-10-27T17:17:53Z

@jianping-shu PTAL when you can.

jianping-shu · 2025-10-28T02:55:51Z

Will test the updated procedure after the PR of OCPBUGS-63541 is merged.

jianping-shu · 2025-11-03T09:30:55Z

@sslocket @jstuever I had some review and testing.
My comments:
(1)For Rotating OIDC keys, either putting the serviceaccount-signer.public into the output_dir or specifying the public-key-file, the ccoctl command will work. I think it is good to make the changes to make the ccoctl cmds consistent in the documents.
(2)One error is "ccoctl azure create-managed-identities" doesn't have the parameter of "--public-key-file", I think the "ccoctl azure create-all" shall replace it, right?

jianping-shu · 2025-11-03T09:32:40Z

modules/cco-ccoctl-upgrading.adoc

-  --dnszone-resource-group-name <azure_dns_zone_resourcegroup_name> \// <5>
-  --installation-resource-group-name "${AZURE_INSTALL_RG}" <6>
+  --output-dir=<path_to_ccoctl_output_dir> \// <2>
+  --public-key-file=<path_to_ccoctl_output_dir>/serviceaccount-signer.public \// <3>


There's the place for comment (2)

This is correct, the ccoctl azure create-managed-identities does not have a --public-key-file parameter because it is not doing anything with the public keys. I didn't catch that it was a different command. We can remove the documentation of this parameter in this section.

sslocket · 2025-11-04T00:41:20Z

@sslocket @jstuever I had some review and testing. My comments: (1)For Rotating OIDC keys, either putting the serviceaccount-signer.public into the output_dir or specifying the public-key-file, the ccoctl command will work. I think it is good to make the changes to make the ccoctl cmds consistent in the documents. (2)One error is "ccoctl azure create-managed-identities" doesn't have the parameter of "--public-key-file", I think the "ccoctl azure create-all" shall replace it, right?

@jstuever Is there any robustness advantage to including the --public-key-file flag in addition to --output-dir in these commands, or is it just completely redundant as I believe @jianping-shu is suggesting?

jianping-shu · 2025-11-04T01:43:07Z

It might be a good ides to keep the original "ccoctl azure create-managed-identities".
Because "ccoctl azure create-all" supports many parameters for resource names, it shall use the every parameters exactly same to those of the first run, which will need more edit changes.

jstuever · 2025-11-04T18:08:41Z

With the changes I made to ccoctl, the --public-key-file parameter will skip the code that generates a new key. The key generation code generates a new key when the private key does not exist. However, for security best practices, we don't want to force the users to download the private key from their cluster. The --public-key-file enables us to skip the key generation, removing the dependency on the private key altogether. As a result, the --public-key-file is required when only supplying the public key in order to avoid generating a new keypair. This can be demonstrated by deleting the private key in between invocations with and without the --public-key-file parameter specified.

openshift/cloud-credential-operator#933

sslocket · 2025-11-05T01:34:18Z

@jianping-shu I've pushed the suggested revisions.

jianping-shu · 2025-11-05T06:25:23Z

LGTM

sslocket · 2025-11-05T19:22:59Z

/label merge-review-needed

jeana-redhat

One nit but not required to fix for merge, excellent work!

/remove-label merge-review-in-progress
/remove-label merge-review-needed

jeana-redhat · 2025-11-05T19:37:53Z

modules/cco-ccoctl-upgrading.adoc

the new command steps should end with "by running the following command:"

…-key-file flag is used where appropriate

openshift-ci · 2025-11-05T20:54:58Z

@sslocket: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jeana-redhat · 2025-11-05T20:58:13Z

/cherrypick enterprise-4.21
/cherrypick enterprise-4.20
/cherrypick enterprise-4.19
/cherrypick enterprise-4.18
/cherrypick enterprise-4.17
/cherrypick enterprise-4.16

openshift-cherrypick-robot · 2025-11-05T20:58:58Z

@jeana-redhat: #101095 failed to apply on top of branch "enterprise-4.16":

Applying: OCPBUGS-61221-63545: Ensure new keypairs are not generated and public-key-file flag is used where appropriate
Using index info to reconstruct a base tree...
A	modules/rotating-bound-service-keys.adoc
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): modules/rotating-bound-service-keys.adoc deleted in HEAD and modified in OCPBUGS-61221-63545: Ensure new keypairs are not generated and public-key-file flag is used where appropriate. Version OCPBUGS-61221-63545: Ensure new keypairs are not generated and public-key-file flag is used where appropriate of modules/rotating-bound-service-keys.adoc left in tree.
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 OCPBUGS-61221-63545: Ensure new keypairs are not generated and public-key-file flag is used where appropriate

In response to this:

/cherrypick enterprise-4.21
/cherrypick enterprise-4.20
/cherrypick enterprise-4.19
/cherrypick enterprise-4.18
/cherrypick enterprise-4.17
/cherrypick enterprise-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jeana-redhat · 2025-11-05T20:59:17Z

/cherrypick enterprise-4.21
/cherrypick enterprise-4.20

jeana-redhat · 2025-11-05T20:59:48Z

/cherrypick enterprise-4.19
/cherrypick enterprise-4.18

jeana-redhat · 2025-11-05T20:59:54Z

/cherrypick enterprise-4.17

openshift-cherrypick-robot · 2025-11-05T21:00:15Z

@jeana-redhat: new pull request created: #101840

In response to this:

/cherrypick enterprise-4.21
/cherrypick enterprise-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2025-11-05T21:00:38Z

@jeana-redhat: #101095 failed to apply on top of branch "enterprise-4.17":

Applying: OCPBUGS-61221-63545: Ensure new keypairs are not generated and public-key-file flag is used where appropriate
Using index info to reconstruct a base tree...
A	modules/rotating-bound-service-keys.adoc
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): modules/rotating-bound-service-keys.adoc deleted in HEAD and modified in OCPBUGS-61221-63545: Ensure new keypairs are not generated and public-key-file flag is used where appropriate. Version OCPBUGS-61221-63545: Ensure new keypairs are not generated and public-key-file flag is used where appropriate of modules/rotating-bound-service-keys.adoc left in tree.
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 OCPBUGS-61221-63545: Ensure new keypairs are not generated and public-key-file flag is used where appropriate

In response to this:

/cherrypick enterprise-4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2025-11-05T21:00:45Z

@jeana-redhat: new pull request created: #101841

In response to this:

/cherrypick enterprise-4.19
/cherrypick enterprise-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2025-11-05T21:01:11Z

@jeana-redhat: new pull request created: #101842

In response to this:

/cherrypick enterprise-4.21
/cherrypick enterprise-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2025-11-05T21:01:44Z

@jeana-redhat: new pull request created: #101843

In response to this:

/cherrypick enterprise-4.19
/cherrypick enterprise-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Oct 27, 2025

sslocket force-pushed the OCPBUGS-61221 branch from 1c2afa1 to bcd9057 Compare October 27, 2025 14:08

ocpdocs-vale-bot reviewed Oct 27, 2025

View reviewed changes

sslocket force-pushed the OCPBUGS-61221 branch from bcd9057 to c9d46bb Compare October 27, 2025 15:21

sslocket changed the title ~~OCPBUGS-61221# Ensure ccoctl uses the cluster's actual bound service account signing key~~ OCPBUGS-61221-63545# Ensure new keypairs are not generated and public-key-file flag is used where appropriate Oct 27, 2025

sslocket force-pushed the OCPBUGS-61221 branch from c9d46bb to 7ee2c28 Compare October 27, 2025 15:31

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 1, 2025

jianping-shu reviewed Nov 3, 2025

View reviewed changes

sslocket force-pushed the OCPBUGS-61221 branch from 7ee2c28 to 481db37 Compare November 5, 2025 00:25

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 5, 2025

sslocket force-pushed the OCPBUGS-61221 branch from 481db37 to be3cbe6 Compare November 5, 2025 01:14

sslocket force-pushed the OCPBUGS-61221 branch from be3cbe6 to dcf5553 Compare November 5, 2025 19:09

openshift-ci bot added the merge-review-needed Signifies that the merge review team needs to review this PR label Nov 5, 2025

jeana-redhat added the merge-review-in-progress Signifies that the merge review team is reviewing this PR label Nov 5, 2025

jeana-redhat approved these changes Nov 5, 2025

View reviewed changes

modules/cco-ccoctl-upgrading.adoc

Copy link

Contributor

jeana-redhat Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the new command steps should end with "by running the following command:"

openshift-ci bot removed merge-review-in-progress Signifies that the merge review team is reviewing this PR merge-review-needed Signifies that the merge review team needs to review this PR labels Nov 5, 2025

jeana-redhat added the branch/enterprise-4.16 label Nov 5, 2025

jeana-redhat added branch/enterprise-4.17 branch/enterprise-4.18 branch/enterprise-4.19 branch/enterprise-4.20 branch/enterprise-4.21 labels Nov 5, 2025

jeana-redhat added this to the Continuous Release milestone Nov 5, 2025

OCPBUGS-61221-63545: Ensure new keypairs are not generated and public…

24e23de

…-key-file flag is used where appropriate

sslocket force-pushed the OCPBUGS-61221 branch from dcf5553 to 24e23de Compare November 5, 2025 20:38

jeana-redhat merged commit e0a9066 into openshift:main Nov 5, 2025
2 checks passed

openshift-cherrypick-robot mentioned this pull request Nov 5, 2025

[enterprise-4.20] OCPBUGS-61221-63545# Ensure new keypairs are not generated and public-key-file flag is used where appropriate #101840

Merged

openshift-cherrypick-robot mentioned this pull request Nov 5, 2025

[enterprise-4.18] OCPBUGS-61221-63545# Ensure new keypairs are not generated and public-key-file flag is used where appropriate #101841

Merged

openshift-cherrypick-robot mentioned this pull request Nov 5, 2025

[enterprise-4.21] OCPBUGS-61221-63545# Ensure new keypairs are not generated and public-key-file flag is used where appropriate #101842

Merged

openshift-cherrypick-robot mentioned this pull request Nov 5, 2025

[enterprise-4.19] OCPBUGS-61221-63545# Ensure new keypairs are not generated and public-key-file flag is used where appropriate #101843

Merged

jeana-redhat mentioned this pull request Nov 6, 2025

fix snippet render issue (no OSDOCS issue) #101912

Merged

OCPBUGS-61221-63545# Ensure new keypairs are not generated and public-key-file flag is used where appropriate #101095

OCPBUGS-61221-63545# Ensure new keypairs are not generated and public-key-file flag is used where appropriate #101095

Uh oh!

Conversation

sslocket commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-vale-bot Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

ocpdocs-vale-bot Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

jstuever commented Oct 27, 2025

Uh oh!

sslocket commented Oct 27, 2025

Uh oh!

jianping-shu commented Oct 28, 2025

Uh oh!

jianping-shu commented Nov 3, 2025

Uh oh!

jianping-shu Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

jstuever Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

sslocket commented Nov 4, 2025

Uh oh!

jianping-shu commented Nov 4, 2025

Uh oh!

jstuever commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sslocket commented Nov 5, 2025

Uh oh!

jianping-shu commented Nov 5, 2025

Uh oh!

sslocket commented Nov 5, 2025

Uh oh!

jeana-redhat left a comment

Choose a reason for hiding this comment

Uh oh!

jeana-redhat Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Nov 5, 2025

Uh oh!

Uh oh!

jeana-redhat commented Nov 5, 2025

Uh oh!

openshift-cherrypick-robot commented Nov 5, 2025

Uh oh!

jeana-redhat commented Nov 5, 2025

Uh oh!

jeana-redhat commented Nov 5, 2025

Uh oh!

jeana-redhat commented Nov 5, 2025

Uh oh!

openshift-cherrypick-robot commented Nov 5, 2025

Uh oh!

openshift-cherrypick-robot commented Nov 5, 2025

Uh oh!

openshift-cherrypick-robot commented Nov 5, 2025

Uh oh!

openshift-cherrypick-robot commented Nov 5, 2025

Uh oh!

openshift-cherrypick-robot commented Nov 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

sslocket commented Oct 27, 2025 •

edited

Loading

ocpdocs-previewbot commented Oct 27, 2025 •

edited

Loading

jstuever commented Nov 4, 2025 •

edited

Loading