CNTRLPLANE-1751: Configurable PKI for OpenShift Internal Certificates by sanchezl · Pull Request #1882 · openshift/enhancements

Commits on Oct 29, 2025

Add PKI configuration enhancement
sanchezl
committed
Enhance PKI configuration validation using CEL rules for key parameters and certificate overrides. Replace webhooks with in-process validation for improved performance and simplicity.
sanchezl
committed
Refactor PKI key configuration to use RSA/ECDSA-specific subfields and enforce validation rules with unions and CEL.
sanchezl
committed
Refactor PKI configuration to use `CertificateConfig` for improved structure, extensibility, and clarity.
sanchezl
committed

Commits on Oct 30, 2025

Commits on Nov 18, 2025

Enhance PKI configuration proposal with improved metric coverage, clarified upgrade scenarios, and refined operational guidance.
sanchezl
committed

Commits on Dec 1, 2025

Fix lint errors.
sanchezl
committed

Commits on Dec 2, 2025

Commits on Dec 3, 2025

Expand PKI configuration enhancement to include the service-ca-operator's special behavior, future extensibility with dynamic certificate registration, and proposed validation framework.
sanchezl
committed

Commits on Dec 9, 2025

Commits on Dec 10, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CNTRLPLANE-1751: Configurable PKI for OpenShift Internal Certificates#1882

CNTRLPLANE-1751: Configurable PKI for OpenShift Internal Certificates#1882
sanchezl wants to merge 22 commits intoopenshift:masterfrom
sanchezl:custom-pki

Commits on Oct 29, 2025

Add PKI configuration enhancement

Enhance PKI configuration validation using CEL rules for key parameters and certificate overrides. Replace webhooks with in-process validation for improved performance and simplicity.

Refactor PKI key configuration to use RSA/ECDSA-specific subfields and enforce validation rules with unions and CEL.

Refactor PKI configuration to use `CertificateConfig` for improved structure, extensibility, and clarity.

Commits on Oct 30, 2025

Clarify that the enhancement does not deprecate or remove existing features. Add details about configuring cryptographic parameters while maintaining defaults.

Promote PKI configuration API to `v1`, update compatibility level to GA, and refine graduation criteria for OpenShift 4.21 release

Commits on Nov 18, 2025

Enhance PKI configuration proposal with improved metric coverage, clarified upgrade scenarios, and refined operational guidance.

Commits on Dec 1, 2025

Fix lint errors.

Commits on Dec 2, 2025

Enhance PKI configuration with expanded well-known certificate names and updated validation rules.

Refine PKI configuration XValidation rule by formatting well-known certificate names as a list for improved diffs.

Commits on Dec 3, 2025

Expand PKI configuration enhancement to include the service-ca-operator's special behavior, future extensibility with dynamic certificate registration, and proposed validation framework.

Commits on Dec 9, 2025

Update internal PKI config enhancement with additional reviewers and approvers

Adjust PKI enhancement to use "target OpenShift release" placeholders instead of specific version numbers for flexibility.

Commits on Dec 10, 2025

Add details on relationships to existing certificate configuration features.

clarify how to return to defaults

Add XValidation rule to enforce PKI singleton name constraint.

Make `Key` field in `CertificateConfig` optional.

Remove unused `status` field and subresource annotation from PKI configuration.

use the preferred CEL pattern for KeyConfig discriminated union

Commits on Dec 15, 2025

Introduce `type` field in PKI configuration. Adjust validation rules and update relevant documentation accordingly.

Commits on Jan 13, 2026

Update PKI enhancement to introduce `spec.policy` structure, adjust API fields, and refine validation rules

Commits on Jan 27, 2026

restructure PKI API and introduce PKICertificateDefinition