CNTRLPLANE-2012: Wire signer certs to read PKI config via SignerKeyParams

[hasbro17]

Summary

Part 3 of splitting #10396 into smaller PRs. Depends on #10593 and #10594.

Wires all 11 signer certificates to read PKI configuration for configurable key algorithms.

Problem

6 of these signers previously had zero dependencies — adding InstallConfig as a dependency would break agent-based installer (ABI) codepaths that generate signer certs without an install-config on disk (e.g.
agent create certificates used by set-node-zero.sh, node-joiner add-nodes). It would also pull in standard InstallConfig validation, rejecting configs that are valid under the agent flow's more lenient
OptionalInstallConfig rules (e.g. vSphere without credentials).

Solution

We introduce SignerKeyParams — a WritableAsset with zero dependencies that reads install-config.yaml via AssetBase.LoadFromFile (strict YAML, deprecated field conversion, defaults) and resolves the
effective PKI config via EffectiveSignerPKIConfig(). When no install-config is found, Load() returns (false, nil) so the asset store falls back to the state file between multi-step invocations (e.g.
create manifests followed by create cluster, where install-config.yaml is consumed after the first step). In the agent flow where neither file nor state exists, Generate() leaves PKIConfig nil
(RSA-2048).

SignerKeyParams is explicitly added to the Manifests and agent target asset lists so that its PKIConfig is persisted to the state file, ensuring correct key algorithms in multi-step flows where
install-config.yaml is consumed between commands.

6 previously zero-dep signers — now depend on SignerKeyParams:

• AdminKubeConfigSignerCertKey
• KubeAPIServerLocalhostSignerCertKey
• KubeAPIServerServiceNetworkSignerCertKey
• KubeAPIServerLBSignerCertKey
• RootCA
• KubeletBootstrapCertSigner

5 signers that already depended on InstallConfig — now use EffectiveSignerPKIConfig() to resolve the effective PKI config including feature gate defaults:

• KubeAPIServerToKubeletSignerCertKey
• AggregatorCA
• AggregatorSignerCertKey
• KubeControlPlaneSignerCertKey
• KubeletCSRSignerCertKey

With TechPreview enabled and no explicit pki config, all signer certs are generated with RSA-4096 (the current DefaultPKIProfile default). Without TechPreview, all certs remain RSA-2048.

PR chain

1. CNTRLPLANE-2012: Add PKI config types, validation, and CR manifest generation #10593 — PKI types, validation, CRD, feature gate, PKI CR manifest
2. CNTRLPLANE-2012: Refactor TLS cert generation to support configurable key algorithms #10594 — TLS engine refactoring
3. This PR — Wire signer certs + SignerKeyParams
4. Documentation

[openshift-ci-robot]

@hasbro17: This pull request references CNTRLPLANE-2012 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "5.0." or "openshift-5.0.", but it targets "openshift-4.22" instead.

Details

In response to this:

Summary

Part 3 of splitting #10396 into smaller PRs. Depends on #10593 and #10594.

Wires all 11 signer certificates to read PKI configuration for configurable key algorithms

Problem

The challenge is that 6 of these signers previously had zero dependencies — adding InstallConfig as a dependency
would break agent-based installer (ABI) codepaths that generate signer certs without an install-config on disk (e.g. agent create certificates used by set-node-zero.sh, node-joiner add-nodes). It would
also pull in standard InstallConfig validation, rejecting configs that are valid under the agent flow's more lenient OptionalInstallConfig rules (e.g. vSphere without credentials).

Solution

To solve this, we introduce SignerKeyParams — a WritableAsset with zero dependencies that reads install-config.yaml directly from disk, extracts only the PKI and FeatureSet fields, and resolves the
effective PKI config via EffectiveSignerPKIConfig(). When no install-config is present, it defaults to nil (RSA-2048).

6 previously zero-dep signers — now depend on SignerKeyParams:

• AdminKubeConfigSignerCertKey
• KubeAPIServerLocalhostSignerCertKey
• KubeAPIServerLBSignerCertKey
• RootCA
• KubeletBootstrapCertSigner

5 signers that already depended on InstallConfig — now use EffectiveSignerPKIConfig() to resolve the effective PKI config including feature gate defaults:

• KubeAPIServerToKubeletSignerCertKey
• AggregatorCA
• AggregatorSignerCertKey
• KubeControlPlaneSignerCertKey
• KubeletCSRSignerCertKey

With TechPreview enabled and no explicit pki config, all signer certs are generated with RSA-4096 (the current DefaultPKIProfile default). Without TechPreview, all certs remain RSA-2048.

PR chain

1. CNTRLPLANE-2012: Add PKI config types, validation, and CR manifest generation #10593 — PKI types, validation, CRD, feature gate, PKI CR manifest
2. CNTRLPLANE-2012: Refactor TLS cert generation to support configurable key algorithms #10594 — TLS engine refactoring
3. This PR — Wire signer certs + SignerKeyParams
4. Documentation

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds a feature-gated pki install-config surface, generates a PKI manifest from the resolved signer settings, generalizes TLS key generation for RSA and ECDSA, and updates signer asset call sites and tests to pass PKI config through.

Changes

Configurable PKI and TLS generation

Layer / File(s)	Summary
PKI schema and validation data/data/install.openshift.io_installconfigs.yaml, pkg/types/installconfig.go, pkg/types/pki/validation.go, pkg/types/validation/*, pkg/explain/printer_test.go	Adds the feature-gated pki install-config schema, public PKI types, field validation, and the matching feature-gate and printer updates.
Default signer config and manifest output pkg/types/pki/defaults.go, pkg/types/pki/defaults_test.go, pkg/asset/tls/signerkey_params.go, pkg/asset/manifests/pki.go, pkg/asset/manifests/operators.go, pkg/asset/manifests/pki_test.go	Adds default PKI profile helpers, resolves effective signer PKI config from install-config.yaml, and emits cluster-pki-02-config.yaml through the operator manifest asset.
PEM and certificate helpers pkg/asset/tls/utils.go, pkg/asset/tls/keypair.go, pkg/asset/tls/tls.go, pkg/asset/tls/utils_test.go, pkg/asset/tls/tls_test.go	Updates key generation, PEM conversion, and self-signed certificate creation for RSA and ECDSA keys, with unit coverage for the new code paths.
Certificate asset wrappers pkg/asset/tls/certkey.go, pkg/asset/tls/boundsasigningkey.go, pkg/asset/imagebased/configimage/ingressoperatorsigner.go, pkg/asset/tls/certkey_test.go	Updates signed and self-signed cert assets to use the new key handling, adds RSA-only parsing for bound service account keys, and checks PEM encoding errors in the ingress operator signer asset.
Signer asset wiring pkg/asset/tls/root.go, pkg/asset/tls/kubecontrolplane.go, pkg/asset/tls/kubelet.go, pkg/asset/tls/apiserver.go, pkg/asset/tls/adminkubeconfig.go, pkg/asset/tls/aggregator.go, pkg/asset/tls/ironictls.go, pkg/asset/ignition/machine/*_test.go	Updates signer assets to read SignerKeyParams, remove explicit key usages, pass PKI config into self-signed generation, and adjust ignition tests for the new root CA parents.

Sequence Diagram(s)

PKI manifest generation

sequenceDiagram
  participant Manifests
  participant PKIConfiguration
  participant InstallConfig
  participant EffectiveSignerPKIConfig
  participant DefaultPKIProfile
  Manifests->>PKIConfiguration: Generate(...)
  PKIConfiguration->>InstallConfig: load installconfig.InstallConfig
  PKIConfiguration->>EffectiveSignerPKIConfig: resolve signer PKIConfig
  EffectiveSignerPKIConfig->>DefaultPKIProfile: derive default signer values
  Manifests->>PKIConfiguration: Files()

Loading

Signer certificate generation

sequenceDiagram
  participant RootCA
  participant SignerKeyParams
  participant SelfSignedCertKey
  participant GenerateSelfSignedCertificate
  participant PrivateKeyToPem
  RootCA->>SignerKeyParams: read PKIConfig
  RootCA->>SelfSignedCertKey: Generate(..., PKIConfig)
  SelfSignedCertKey->>GenerateSelfSignedCertificate: create key and certificate
  SelfSignedCertKey->>PrivateKeyToPem: encode generated key

Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~90+ minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
No-Weak-Crypto	❌ Error	FAIL: the PR touches code paths that use sha1.Sum (pkg/asset/tls/tls.go:237), which is on the weak-crypto denylist.	Replace SHA-1-based subject-key-id hashing with an approved alternative or add an explicit exception if SHA-1 is intentional.
Docstring Coverage	⚠️ Warning	Docstring coverage is 56.60% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo titles were added; the new tests use static t.Run names like PKI config present with TechPreviewNoUpgrade - passes and RSA 4096.
Test Structure And Quality	✅ Passed	No Ginkgo tests were added or changed; the modified tests are standard Go unit tests, so the Ginkgo-specific quality checks are not applicable.
Microshift Test Compatibility	✅ Passed	PR changes are unit tests and assets only; no new Ginkgo/e2e specs or MicroShift-unsupported APIs/features were added in the touched files.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the changed tests are plain Go unit tests under pkg/* using testing.T, with no SNO-unsafe assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Only PKI/crypto plumbing was added; I found no new pod specs, replicas, affinities, tolerations, node selectors, or topology-spread constraints.
Ote Binary Stdout Contract	✅ Passed	No stdout writes or suite hooks were added in main/init/TestMain/BeforeSuite paths; the only fmt.Println is inside a unit test body.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The modified tests are plain testing.T unit tests; no Ginkgo It/Describe/When, IPv4 literals, or external-host/network calls were found in the changed files.
Container-Privileges	✅ Passed	Touched files are PKI/TLS/schema changes; targeted searches found no privileged:true, hostPID/Network/IPC, SYS_ADMIN, allowPrivilegeEscalation:true, or runAsUser:0 in the PR paths.
No-Sensitive-Data-In-Logs	✅ Passed	No new logs print secrets; added debug/warn messages only emit generic parse/generation errors, and new PKI files contain no logging.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: wiring signer certs to read PKI config through SignerKeyParams.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[hasbro17]

/hold

Blocked by #10593 and #10594

Also need to retest and check the ABI codepaths for the SignerKeyParams dependency (Integration tests should show that) and see if the new signers generate correctly.

[hasbro17]

/test e2e-aws-ovn-pki-default-techpreview
/test e2e-aws-ovn-pki-rsa-techpreview

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/types/pki/defaults.go`:
- Around line 36-53: EffectiveSignerPKIConfig currently returns ic.PKI before
checking the ConfigurablePKI feature gate, allowing user PKI to be honored even
when the gate is off; change the logic in EffectiveSignerPKIConfig so it first
checks ic.Enabled(features.FeatureGateConfigurablePKI) and if the gate is
disabled return nil, and only when the gate is enabled honor ic.PKI (return it)
or fall back to the default SignerCertificates config; update references in
EffectiveSignerPKIConfig to enforce the gate-first behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b8a25289-d43e-4637-8509-4498d6ba55cf

📥 Commits

Reviewing files that changed from the base of the PR and between d3fba60 and 0e262ca.

⛔ Files ignored due to path filters (1)

• pkg/types/zz_generated.deepcopy.go is excluded by !**/zz_generated*

📒 Files selected for processing (39)

• data/data/install.openshift.io_installconfigs.yaml
• pkg/asset/ignition/machine/arbiter_ignition_customizations_test.go
• pkg/asset/ignition/machine/arbiter_test.go
• pkg/asset/ignition/machine/master_ignition_customizations_test.go
• pkg/asset/ignition/machine/master_test.go
• pkg/asset/ignition/machine/worker_ignition_customizations_test.go
• pkg/asset/ignition/machine/worker_test.go
• pkg/asset/imagebased/configimage/ingressoperatorsigner.go
• pkg/asset/manifests/operators.go
• pkg/asset/manifests/pki.go
• pkg/asset/manifests/pki_test.go
• pkg/asset/tls/adminkubeconfig.go
• pkg/asset/tls/aggregator.go
• pkg/asset/tls/apiserver.go
• pkg/asset/tls/boundsasigningkey.go
• pkg/asset/tls/certkey.go
• pkg/asset/tls/certkey_test.go
• pkg/asset/tls/ironictls.go
• pkg/asset/tls/keypair.go
• pkg/asset/tls/kubecontrolplane.go
• pkg/asset/tls/kubelet.go
• pkg/asset/tls/root.go
• pkg/asset/tls/signerkey_params.go
• pkg/asset/tls/tls.go
• pkg/asset/tls/tls_test.go
• pkg/asset/tls/utils.go
• pkg/asset/tls/utils_test.go
• pkg/explain/printer_test.go
• pkg/types/defaults/installconfig.go
• pkg/types/installconfig.go
• pkg/types/pki/conversion.go
• pkg/types/pki/defaults.go
• pkg/types/pki/defaults_test.go
• pkg/types/pki/validation.go
• pkg/types/pki/validation_test.go
• pkg/types/validation/featuregate_test.go
• pkg/types/validation/featuregates.go
• pkg/types/validation/installconfig.go
• pkg/types/validation/installconfig_test.go

[hasbro17]

/test e2e-aws-ovn-pki-default-techpreview
/test e2e-aws-ovn-pki-rsa-techpreview

[hasbro17]

Okay the e2e tests pass now:
https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_installer/10595/pull-ci-openshift-installer-main-e2e-aws-ovn-pki-rsa-techpreview/2062305090953285632

So the SignerKeyParams helps walk the line between IPI and ABI for those signers.

[hasbro17]

/test e2e-aws-ovn-pki-default-techpreview
/test e2e-aws-ovn-pki-rsa-techpreview

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/asset/manifests/pki.go`:
- Around line 42-48: The Generate method on PKIConfiguration exits early when
the FeatureGateConfigurablePKI is disabled but doesn't clear previously
generated state; ensure you reset p.FileList (e.g., set to nil or an empty
slice) before the early return in PKIConfiguration.Generate so stale PKI
manifests aren't retained across runs when the feature gate is off.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2313bdbb-b13e-49c2-89f3-c0d815a13343

📥 Commits

Reviewing files that changed from the base of the PR and between 0a3fbe6 and 9d66374.

⛔ Files ignored due to path filters (1)

• pkg/types/zz_generated.deepcopy.go is excluded by !**/zz_generated*

📒 Files selected for processing (40)

• data/data/install.openshift.io_installconfigs.yaml
• pkg/asset/ignition/machine/arbiter_ignition_customizations_test.go
• pkg/asset/ignition/machine/arbiter_test.go
• pkg/asset/ignition/machine/master_ignition_customizations_test.go
• pkg/asset/ignition/machine/master_test.go
• pkg/asset/ignition/machine/worker_ignition_customizations_test.go
• pkg/asset/ignition/machine/worker_test.go
• pkg/asset/imagebased/configimage/ingressoperatorsigner.go
• pkg/asset/manifests/operators.go
• pkg/asset/manifests/pki.go
• pkg/asset/manifests/pki_test.go
• pkg/asset/tls/adminkubeconfig.go
• pkg/asset/tls/aggregator.go
• pkg/asset/tls/apiserver.go
• pkg/asset/tls/boundsasigningkey.go
• pkg/asset/tls/certkey.go
• pkg/asset/tls/certkey_test.go
• pkg/asset/tls/ironictls.go
• pkg/asset/tls/keypair.go
• pkg/asset/tls/kubecontrolplane.go
• pkg/asset/tls/kubelet.go
• pkg/asset/tls/root.go
• pkg/asset/tls/signerkey_params.go
• pkg/asset/tls/tls.go
• pkg/asset/tls/tls_test.go
• pkg/asset/tls/utils.go
• pkg/asset/tls/utils_test.go
• pkg/explain/printer_test.go
• pkg/types/defaults/installconfig.go
• pkg/types/installconfig.go
• pkg/types/pki/conversion.go
• pkg/types/pki/conversion_test.go
• pkg/types/pki/defaults.go
• pkg/types/pki/defaults_test.go
• pkg/types/pki/validation.go
• pkg/types/pki/validation_test.go
• pkg/types/validation/featuregate_test.go
• pkg/types/validation/featuregates.go
• pkg/types/validation/installconfig.go
• pkg/types/validation/installconfig_test.go

✅ Files skipped from review due to trivial changes (5)

• pkg/asset/ignition/machine/arbiter_test.go
• pkg/explain/printer_test.go
• pkg/types/defaults/installconfig.go
• pkg/asset/manifests/pki_test.go
• pkg/types/validation/featuregates.go

🚧 Files skipped from review as they are similar to previous changes (30)

• pkg/asset/imagebased/configimage/ingressoperatorsigner.go
• pkg/asset/tls/ironictls.go
• pkg/asset/tls/utils_test.go
• pkg/asset/ignition/machine/worker_test.go
• pkg/asset/ignition/machine/master_test.go
• pkg/types/validation/featuregate_test.go
• pkg/asset/ignition/machine/arbiter_ignition_customizations_test.go
• pkg/types/validation/installconfig_test.go
• pkg/types/validation/installconfig.go
• pkg/types/pki/validation.go
• pkg/types/pki/defaults.go
• pkg/types/pki/defaults_test.go
• pkg/asset/tls/boundsasigningkey.go
• pkg/types/installconfig.go
• data/data/install.openshift.io_installconfigs.yaml
• pkg/asset/tls/keypair.go
• pkg/asset/tls/kubecontrolplane.go
• pkg/asset/tls/apiserver.go
• pkg/asset/tls/certkey.go
• pkg/asset/tls/tls_test.go
• pkg/asset/tls/adminkubeconfig.go
• pkg/asset/tls/signerkey_params.go
• pkg/asset/tls/kubelet.go
• pkg/asset/tls/aggregator.go
• pkg/asset/ignition/machine/worker_ignition_customizations_test.go
• pkg/asset/tls/utils.go
• pkg/asset/tls/root.go
• pkg/asset/tls/certkey_test.go
• pkg/types/pki/validation_test.go
• pkg/asset/tls/tls.go

[hasbro17]

/test e2e-aws-ovn-pki-default-techpreview
/test e2e-aws-ovn-pki-rsa-techpreview

[hasbro17]

/test e2e-aws-ovn-pki-default-techpreview
/test e2e-aws-ovn-pki-rsa-techpreview

[tthvo]

/hold cancel

[openshift-ci]

@hasbro17: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-metal-ovn-two-node-arbiter	c665423	link	false	/test e2e-metal-ovn-two-node-arbiter
ci/prow/e2e-metal-single-node-live-iso	c665423	link	false	/test e2e-metal-single-node-live-iso
ci/prow/e2e-metal-ipi-ovn-dualstack	c665423	link	false	/test e2e-metal-ipi-ovn-dualstack
ci/prow/e2e-metal-ipi-ovn	c665423	link	false	/test e2e-metal-ipi-ovn
ci/prow/e2e-aws-ovn-pki-default-techpreview	0b7b63e	link	false	/test e2e-aws-ovn-pki-default-techpreview
ci/prow/e2e-azure-ovn-techpreview	0b7b63e	link	false	/test e2e-azure-ovn-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[zaneb]

/lgtm
/hold cancel

[openshift-merge-bot]

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

[hasbro17]

CI Verification Summary:

Job results

Job	Build	Result	Related to PR?
e2e-azure-ovn-techpreview	2079988549255434240	FAILED	No
e2e-aws-ovn-pki-default-techpreview	2079988539159744512	FAILED	Expected

Analysis

e2e-azure-ovn-techpreview — NOT caused by this PR

The cluster installed successfully with TechPreviewNoUpgrade featureSet — all pre-phase steps and installation passed. This means the PR's new TechPreview behavior (RSA-4096 signers via EffectiveSignerPKIConfig) executed correctly.

The single blocking failure is [sig-network-edge][Feature:Router] The HAProxy router with Dynamic Config Manager should maintain steady PID usage after scale-out and scale-in operations — a router PID stability test unrelated to PKI. The 11 informing failures are 10 [Feature:NetworkSegmentation] OVN flakes plus 1 cluster-config-operator status check. None involve TLS, certificates, signers, or PKI.

Result: 2364 pass, 1 blocking fail (router PID), 11 informing fail (OVN + CCO), 2193 skip.

e2e-aws-ovn-pki-default-techpreview — Expected failure

The cluster installed successfully. The PKI verification step correctly detected that all 7 installer-managed signers are using RSA-4096 instead of ECDSA P-384:

FAIL   | root-ca                                       | expected ECDSA P-384, got RSA-4096
FAIL   | kube-apiserver-to-kubelet-signer              | expected ECDSA P-384, got RSA-4096
FAIL   | kube-apiserver-localhost-signer               | expected ECDSA P-384, got RSA-4096
FAIL   | kube-apiserver-service-network-signer         | expected ECDSA P-384, got RSA-4096
FAIL   | kube-apiserver-lb-signer                      | expected ECDSA P-384, got RSA-4096
FAIL   | kube-control-plane-signer                     | expected ECDSA P-384, got RSA-4096
FAIL   | aggregator-signer                             | expected ECDSA P-384, got RSA-4096
PASS   | etcd-signer
PASS   | etcd-metrics-signer
PASS   | PKI CR (mode=Default)

This is expected. The test expects DefaultPKIProfile() to return ECDSA P-384 (matching the upstream library-go profile), but it intentionally returns RSA-4096 until all day-2 operators (CKAO, CKMO, etc.) support ECDSA certificate rotation. Once operator support lands, DefaultPKIProfile() will switch to ECDSA P-384/P-256 and this test will pass.

Notable improvement from the previous run: both etcd-signer and etcd-metrics-signer now PASS, confirming that the etcd operator fix (cluster-etcd-operator#1648) and the CI test name fix (openshift/release#82191) are working.

Conclusion

• No failures are caused by this PR. The installer's signer wiring works correctly — TechPreview clusters install successfully with RSA-4096 signers.
• The e2e-azure-ovn-techpreview failure is unrelated networking test flakiness (router PID stability, OVN network segmentation).
• The pki-default-techpreview failure is expected until DefaultPKIProfile() switches from RSA-4096 to ECDSA P-384.
• Both etcd signer checks now pass, confirming the external fixes from the previous run are merged.

[tthvo]

/test e2e-aws-ovn-fips

[tthvo]

/test e2e-metal-assisted
/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-single-node-techpreview
/payoad-job periodic-ci-openshift-openshift-tests-private-release-5.0-multi-nightly-aws-eusc-ipi-fips-tp-arm-f7
/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-aws-usgov-ipi-custom-dns-mini-perm-tp-f7

[openshift-ci]

@tthvo: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-single-node-techpreview
• periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-aws-usgov-ipi-custom-dns-mini-perm-tp-f7

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/8ffd5070-86e2-11f1-93bc-ba626c5e1ade-0

[tthvo]

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-aws-c2s-ipi-disc-priv-fips-f28-tp-longduration-cloud

[openshift-ci]

@tthvo: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-aws-c2s-ipi-disc-priv-fips-f28-tp-longduration-cloud

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f040b760-86e2-11f1-908e-2997670f77fa-0

[tthvo]

/test e2e-aws-eusc-techpreview

[tthvo]

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-short-cert-rotation-f7
/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-ipi-proxy-fips-regen-cert-f14

[openshift-ci]

@tthvo: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-short-cert-rotation-f7
• periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-ipi-proxy-fips-regen-cert-f14

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/dec86810-86e3-11f1-8f7e-9a6867363117-0

[tthvo]

/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-short-cert-rotation-f7
/payload-job periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-ipi-proxy-fips-regen-cert-f14

[openshift-ci]

@tthvo: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-short-cert-rotation-f7
• periodic-ci-openshift-openshift-tests-private-release-5.0-amd64-nightly-vsphere-ipi-proxy-fips-regen-cert-f14

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/b2a12640-86ee-11f1-87c1-6f93223ce9a6-0

[hasbro17]

CI Verification Summary:

Job results

Job	FeatureSet	Build	Result	Related to PR?
e2e-aws-ovn-fips	Default	2080407795626151936	FAILED	No
e2e-aws-eusc-techpreview	TechPreview	2080415142893326336	FAILED	No

Analysis

e2e-aws-ovn-fips — NOT caused by this PR

Default featureSet with FIPS enabled — the PR produces zero behavior change (all signers get nil pkiConfig → RSA-2048, identical to main). Cluster installed successfully.

Category	Count	Blocking?	Related to PR?
[sig-network][Feature:tap] tap interface creation	1	Yes	No
[Feature:NetworkSegmentation] OVN UDN flakes	10	No	No
[sig-cli] oc extract rhel8/rhel9	1	No	No

Result: 2224 pass, 1 blocking fail (tap interface), 11 informing fail, 2124 skip.

The blocking failure is should create a pod with a tap interface — a CNI tap device test unrelated to TLS or PKI.

e2e-aws-eusc-techpreview — NOT caused by this PR

TechPreview featureSet on AWS EU Sovereign Cloud — the PR's new behavior applies (RSA-4096 signers). Cluster installed successfully, confirming signer wiring works correctly under TechPreview.

Category	Count	Blocking?	Related to PR?
[cloud-provider-aws-e2e-openshift] NLB SecurityGroup tests	4	Yes	No
[Feature:NetworkSegmentation] OVN UDN flakes	10	No	No
cluster-config-operator status check	1	No	No
[sig-cli] oc extract rhel8/rhel9	1	No	No

Result: 2341 pass, 4 blocking fail (AWS NLB SecurityGroup), 12 informing fail, 2233 skip.

All 4 blocking failures are [OCPFeatureGate:AWSServiceLBNetworkSecurityGroup] NLB security group tests from the cloud-controller-manager operator — an AWS-specific feature unrelated to PKI or certificates.

Conclusion

• No failures are caused by this PR. Both clusters installed successfully. The Default featureSet job confirms zero behavior change (RSA-2048). The TechPreview job confirms the new RSA-4096 signer behavior works correctly.
• e2e-aws-ovn-fips failed on a tap interface networking test.
• e2e-aws-eusc-techpreview failed on AWS NLB SecurityGroup tests (cloud-provider-aws feature gate).
• Both jobs share the same informing [Feature:NetworkSegmentation] OVN flakes seen across all CI runs.

[tthvo]

/verified by CI

Latest e2e results look good, including FIPS-enabled environments. Thanks a lot for your patience and hard work 🚀 👍

Notes: About the payload testing above:

• https://pr-payload-tests.ci.openshift.org/runs/ci/dec86810-86e3-11f1-8f7e-9a6867363117-0: Single-node TP install completed successfully with default RSA-4096. The us-gov job used CustomNoUpgrade without enable PKI feature gate and fell back to RSA-2048 as expected.
• https://pr-payload-tests.ci.openshift.org/runs/ci/f040b760-86e2-11f1-908e-2997670f77fa-0: The job ran without using this PR change so it used RSA-2048. Thus, it's not applicable for verification.
• https://pr-payload-tests.ci.openshift.org/runs/ci/b2a12640-86ee-11f1-87c1-6f93223ce9a6-0: The 2 jobs failed to build so they are not applicable. However, as we can confirm he behavior of cert generation in default cluster to be RSA-2048 from presubmit, we are fine with their results.

[openshift-ci-robot]

@tthvo: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Latest e2e results look good, including FIPS-enabled environments. Thanks a lot for your patience and hard work 🚀 👍

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tthvo]

/test e2e-azure-nat-gateway-single-zone
/tide refresh

[tthvo]

Let's run some more while tide reruns required tests :D

/payload-job periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-rhcos10-fips-techpreview-serial-1of2

[openshift-ci]

@tthvo: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-rhcos10-fips-techpreview-serial-1of2

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f408dfe0-8a38-11f1-815d-a8e0eda3b8fb-0

[tthvo]

/payload-job periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-rhcos10-fips-techpreview-serial-2of2

[openshift-ci]

@tthvo: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-5.0-e2e-gcp-ovn-rhcos10-fips-techpreview-serial-2of2

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/40ce8000-8a39-11f1-9ed0-0219622250a3-0

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 25d6f5e and 2 for PR HEAD 0b7b63e in total

[tthvo]

This periodic e2e-gcp-ovn-rhcos10-fips-techpreview-serial-2of2 completed the install successfully with the new PKI RSA-4096 default in FIPS 👍