Skip to content

Use MLDSA65 algorithm in cert-manager Certificate manifests - #1122

Merged
openshift-merge-bot[bot] merged 1 commit into
openstack-k8s-operators:mainfrom
danpawlik:change-cipher
Oct 29, 2026
Merged

Use MLDSA65 algorithm in cert-manager Certificate manifests#1122
openshift-merge-bot[bot] merged 1 commit into
openstack-k8s-operators:mainfrom
danpawlik:change-cipher

Conversation

@danpawlik

@danpawlik danpawlik commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

With this commit, cipher and key exchange algorithm is more PQC safe.

Related-To: OSPRH-28427
Depends-On: #1117
Depends-On: infrawatch/feature-verification-tests#476

@danpawlik
Use MLDSA65 algorithm in cert-manager Certificate manifests
8e92cfa 
With this commit, cipher and key exchange algorithm is more PQC safe.

Related-To: OSPRH-28427
Depends-On: openstack-k8s-operators#1117

Signed-off-by: Daniel Pawlik <dpawlik@redhat.com>
@openshift-ci
openshift-ci Bot requested review from elfiesmelfie and stuggi October 27, 2026 17:49
@coderabbitai

coderabbitai Bot commented Oct 27, 2026

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Central YAML (base), Organization UI (inherited)
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: b7223f28-a816-45d4-affb-7702b5ff78f3
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@centosinfra-prod-github-app

centosinfra-prod-github-app Bot commented Oct 28, 2026

Copy link
Copy Markdown

Build succeeded (check pipeline).
https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/10188f67e999434ea8088cdf24a69a02

✔️ s2i-openstack-container-content-provider SUCCESS in 12h 19m 48s
✔️ s2i-deployment-test-telemetry SUCCESS in 2h 19m 48s
✔️ telemetry-operator-multinode-cloudkitty-rhoso-19 SUCCESS in 1h 35m 57s
✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 01m 06s
✔️ telemetry-operator-multinode-default-telemetry SUCCESS in 1h 28m 04s
✔️ telemetry-openstack-meta-content-provider-master SUCCESS in 22m 12s

Warning:
File ansible/tmp/ecc91779a49b4c8487b099c9283b5cb0 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job telemetry-operator-multinode-default-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/4624100280584651bb17d266dbe4334b found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job telemetry-operator-multinode-default-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/ecc91779a49b4c8487b099c9283b5cb0 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job telemetry-operator-multinode-default-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/4624100280584651bb17d266dbe4334b found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job telemetry-operator-multinode-default-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/ecc91779a49b4c8487b099c9283b5cb0 found in build home directory during playbook review.rdoproject.org/config/playbooks/crc/print-machineconfigpool.yaml for job telemetry-operator-multinode-default-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File .ssh/known_hosts.old found in build home directory during playbook review.rdoproject.org/config/playbooks/base-minimal/post-logs.yaml for job telemetry-operator-multinode-default-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/ee09d2ac4b86495086c9aac983482423 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job telemetry-operator-multinode-cloudkitty-rhoso-19. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/802e2eb82b3e40ab8eebd4e63efcf5e7 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job telemetry-operator-multinode-cloudkitty-rhoso-19. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/ee09d2ac4b86495086c9aac983482423 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job telemetry-operator-multinode-cloudkitty-rhoso-19. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/802e2eb82b3e40ab8eebd4e63efcf5e7 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job telemetry-operator-multinode-cloudkitty-rhoso-19. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/ee09d2ac4b86495086c9aac983482423 found in build home directory during playbook review.rdoproject.org/config/playbooks/crc/print-machineconfigpool.yaml for job telemetry-operator-multinode-cloudkitty-rhoso-19. Add to preserve-home-paths if safe, or otherwise remove.
File .ssh/known_hosts.old found in build home directory during playbook review.rdoproject.org/config/playbooks/base-minimal/post-logs.yaml for job telemetry-operator-multinode-cloudkitty-rhoso-19. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/ffa54c86b1e643a1bac0a8c5bee249c3 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job s2i-deployment-test-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/90490144e72340f2a115bfbc635dad48 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job s2i-deployment-test-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/ffa54c86b1e643a1bac0a8c5bee249c3 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job s2i-deployment-test-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/90490144e72340f2a115bfbc635dad48 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job s2i-deployment-test-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/ffa54c86b1e643a1bac0a8c5bee249c3 found in build home directory during playbook review.rdoproject.org/config/playbooks/crc/print-machineconfigpool.yaml for job s2i-deployment-test-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File .ssh/known_hosts.old found in build home directory during playbook review.rdoproject.org/config/playbooks/base-minimal/post-logs.yaml for job s2i-deployment-test-telemetry. Add to preserve-home-paths if safe, or otherwise remove.
File .ssh/config found in build home directory during playbook github.com/openstack-k8s-operators/s2i-openstack-containers/playbooks/container-ci/zuul/pre.yaml for job s2i-openstack-container-content-provider. Add to preserve-home-paths if safe, or otherwise remove.

@openshift-ci

openshift-ci Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danpawlik, vyzigold

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the lgtm label Oct 29, 2026
@stuggi

stuggi commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

just a not, I don't think the cert-manager we have currently available already supports MLDSA65. it just merged 2 weeks ago in cert-manager cert-manager/cert-manager#9469 . also Kubernetes API server needs Go 1.27

@openshift-merge-bot
openshift-merge-bot Bot merged commit ac92ef5 into openstack-k8s-operators:main Oct 29, 2026
8 checks passed
@vyzigold

vyzigold commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

just a not, I don't think the cert-manager we have currently available already supports MLDSA65. it just merged 2 weeks ago in cert-manager cert-manager/cert-manager#9469 . also Kubernetes API server needs Go 1.27

@stuggi How did we pass through tests though? Are the config/certmanager/* files actually used anywhere? Should we revert?

@stuggi

stuggi commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

just a not, I don't think the cert-manager we have currently available already supports MLDSA65. it just merged 2 weeks ago in cert-manager cert-manager/cert-manager#9469 . also Kubernetes API server needs Go 1.27

@stuggi How did we pass through tests though? Are the config/certmanager/* files actually used anywhere? Should we revert?

those would only be used if you install telemetry-operator as standalone. the certs issued for deployment via the openstack-operator are like here openstack-k8s-operators/openstack-operator#1973 in the openstack-op and sync-bindata.sh

If you check the cert from this PR CI run it uses

spec:
  dnsNames:
  - telemetry-operator-metrics-service.openstack-operators.svc
  - telemetry-operator-metrics-service.openstack-operators.svc.cluster.local
  issuerRef:
    kind: Issuer
    name: telemetry-operator-selfsigned-issuer
  privateKey:
    algorithm: ECDSA
    size: 256
  secretName: telemetry-operator-metrics-server-cert

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/logs/7c2/rdoproject.org/7c27765e2e2c4ec694b030f9c5718c35/controller/ci-framework-data/logs/openstack-must-gather/quay-io-openstack-k8s-operators-openstack-must-gather-sha256-6655773b8ec1097ace0030caea0c1ae3b8935991036a3ad0c4071072e2841702/namespaces/openstack-operators/cert/telemetry-operator-metrics-certs.yaml

@danpawlik

danpawlik commented Oct 30, 2026

Copy link
Copy Markdown
Contributor Author

@stuggi From the task:

No released cert-manager accepts MLDSA65 yet: up to v1.20 the privateKey.algorithm enum only allows RSA, ECDSA and Ed25519. ML-DSA support is being worked on in [1]. The certmanager component is also not part of the config/default kustomization, so these manifests have no runtime effect until both change.

[1] cert-manager/cert-manager#9469

@danpawlik

danpawlik commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

aha, it might fail in standalone deployment when certmanager overlay is used. Agree. Let's revert.

@danpawlik

danpawlik commented Oct 30, 2026

Copy link
Copy Markdown
Contributor Author

/revert

@danpawlik

danpawlik commented Oct 30, 2026

Copy link
Copy Markdown
Contributor Author

Revert done #1124

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vyzigold vyzigold vyzigold approved these changes
@elfiesmelfie elfiesmelfie Awaiting requested review from elfiesmelfie
@stuggi stuggi Awaiting requested review from stuggi
@jlarriba jlarriba Awaiting requested review from jlarriba

Assignees

@vyzigold vyzigold

Labels

approved lgtm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@danpawlik @stuggi @vyzigold