[OSDOCS-14647]: Config custom API server cert for a hosted cluster #97081

lahinson · 2025-08-04T16:07:41Z

Version(s): 4.17+

Issue: https://issues.redhat.com/browse/OSDOCS-14647

Link to docs preview:

Configuring a custom API server certificate in a hosted cluster: https://97081--ocpdocs-pr.netlify.app/openshift-enterprise/latest/hosted_control_planes/hcp-deploy/hcp-deploy-aws.html#hcp-custom-cert_hcp-deploy-aws (this module is included in the "Deploying HCP" sections for AWS, bare metal, OpenShift Virtualization, and non-bare-metal)
Adding API server certificates: https://97081--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/certificates/api-server
Creating an AWS S3 bucket and OIDC secret: https://97081--ocpdocs-pr.netlify.app/openshift-enterprise/latest/hosted_control_planes/hcp-deploy/hcp-deploy-aws.html#hcp-aws-create-secret-s3_hcp-deploy-aws (no content changes - only formatting changes)

QE review:

QE has approved this change.

Additional information: This PR adds a procedure about configuring a custom API server certificate for a hosted cluster. It also corrects a few minor formatting issues ahead of the DITA migration.

ocpdocs-previewbot · 2025-08-04T16:31:21Z

🤖 Wed Aug 13 13:42:38 - Prow CI generated the docs preview:

https://97081--ocpdocs-pr.netlify.app/openshift-enterprise/latest/hosted_control_planes/hcp-deploy/hcp-deploy-aws.html
https://97081--ocpdocs-pr.netlify.app/openshift-enterprise/latest/hosted_control_planes/hcp-deploy/hcp-deploy-bm.html
https://97081--ocpdocs-pr.netlify.app/openshift-enterprise/latest/hosted_control_planes/hcp-deploy/hcp-deploy-non-bm.html
https://97081--ocpdocs-pr.netlify.app/openshift-enterprise/latest/hosted_control_planes/hcp-deploy/hcp-deploy-virt.html
https://97081--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/certificates/api-server.html

jparrill

dropped some comments. Thanks!

modules/hcp-custom-cert.adoc

modules/hcp-aws-create-secret-s3.adoc

jparrill

/lgtm

jiezhao16 · 2025-08-12T18:47:08Z

/lgtm

jeana-redhat

Noticed a typo while scanning - nothing here blocks merge so you can choose how you'd like to proceed with that :)

/remove-label merge-review-in-progress
/remove-label merge-review-needed

jeana-redhat · 2025-08-12T20:20:24Z

modules/hcp-aws-create-secret-s3.adoc

Out of scope (existing content) but at some point step 1 should probably be split into four substeps with a short explanation of what each command is doing.

Agree. I'll make a note of that.

jeana-redhat · 2025-08-12T20:21:36Z

modules/hcp-custom-cert.adoc

+* You created a Kubernetes secret that contains your custom certificate in the management cluster. The secret contains the following keys:
+
+ ** `tls.crt`: The certificate
+ ** `tls.key`: They private key


Typo

Suggested change

** `tls.key`: They private key

** `tls.key`: The private key

Oh my goodness. Thank you!

jeana-redhat · 2025-08-12T20:22:29Z

modules/hcp-custom-cert.adoc

+ ** `tls.crt`: The certificate
+ ** `tls.key`: They private key
+
+* If your `HostedCluster` configuration includes a service publishing strategy that uses a load balancer, ensure that the Subject Alternative Names (SANs) of the certificate do not conflict with the internal API endpoint (`api-int`). The internal API endpoint is automatically created and managed by your platform. If you use the same hostname in both the custom certificate and the internal API endpoint, routing conflictcs can occur. The only exception to this rule is when you use {aws-short} as the provider with either Private or PublicAndPrivate configurations. In those cases, the SAN conflict is managed by the platform.


Are these literals?

Suggested change

* If your `HostedCluster` configuration includes a service publishing strategy that uses a load balancer, ensure that the Subject Alternative Names (SANs) of the certificate do not conflict with the internal API endpoint (`api-int`). The internal API endpoint is automatically created and managed by your platform. If you use the same hostname in both the custom certificate and the internal API endpoint, routing conflictcs can occur. The only exception to this rule is when you use {aws-short} as the provider with either Private or PublicAndPrivate configurations. In those cases, the SAN conflict is managed by the platform.

* If your `HostedCluster` configuration includes a service publishing strategy that uses a load balancer, ensure that the Subject Alternative Names (SANs) of the certificate do not conflict with the internal API endpoint (`api-int`). The internal API endpoint is automatically created and managed by your platform. If you use the same hostname in both the custom certificate and the internal API endpoint, routing conflictcs can occur. The only exception to this rule is when you use {aws-short} as the provider with either `Private` or `PublicAndPrivate` configurations. In those cases, the SAN conflict is managed by the platform.

Another good catch. Yes -- they should be in monospace font. Will fix.

openshift-ci · 2025-08-13T13:33:34Z

New changes are detected. LGTM label has been removed.

openshift-ci · 2025-08-13T13:44:02Z

@lahinson: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

lahinson · 2025-08-13T13:52:57Z

/cherrypick enterprise-4.17

lahinson · 2025-08-13T13:53:04Z

/cherrypick enterprise-4.18

lahinson · 2025-08-13T13:53:10Z

/cherrypick enterprise-4.19

lahinson · 2025-08-13T13:53:17Z

/cherrypick enterprise-4.20

openshift-cherrypick-robot · 2025-08-13T13:53:42Z

@lahinson: #97081 failed to apply on top of branch "enterprise-4.17":

Applying: Config custom API server cert for a hosted cluster
.git/rebase-apply/patch:170: trailing whitespace.
To configure a custom certificate for the API server, specify the certificate details in the `spec.configuration.apiServer` section of your `HostedCluster` configuration. 
warning: 1 line adds whitespace errors.
Using index info to reconstruct a base tree...
M	hosted_control_planes/hcp-deploy/hcp-deploy-aws.adoc
M	hosted_control_planes/hcp-deploy/hcp-deploy-bm.adoc
M	hosted_control_planes/hcp-deploy/hcp-deploy-non-bm.adoc
M	hosted_control_planes/hcp-deploy/hcp-deploy-virt.adoc
M	security/certificates/api-server.adoc
Falling back to patching base and 3-way merge...
Auto-merging security/certificates/api-server.adoc
CONFLICT (content): Merge conflict in security/certificates/api-server.adoc
Auto-merging hosted_control_planes/hcp-deploy/hcp-deploy-virt.adoc
Auto-merging hosted_control_planes/hcp-deploy/hcp-deploy-non-bm.adoc
CONFLICT (content): Merge conflict in hosted_control_planes/hcp-deploy/hcp-deploy-non-bm.adoc
Auto-merging hosted_control_planes/hcp-deploy/hcp-deploy-bm.adoc
Auto-merging hosted_control_planes/hcp-deploy/hcp-deploy-aws.adoc
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 Config custom API server cert for a hosted cluster

In response to this:

/cherrypick enterprise-4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2025-08-13T13:53:48Z

@lahinson: #97081 failed to apply on top of branch "enterprise-4.18":

Applying: Config custom API server cert for a hosted cluster
.git/rebase-apply/patch:170: trailing whitespace.
To configure a custom certificate for the API server, specify the certificate details in the `spec.configuration.apiServer` section of your `HostedCluster` configuration. 
warning: 1 line adds whitespace errors.
Using index info to reconstruct a base tree...
M	hosted_control_planes/hcp-deploy/hcp-deploy-aws.adoc
M	hosted_control_planes/hcp-deploy/hcp-deploy-bm.adoc
M	hosted_control_planes/hcp-deploy/hcp-deploy-non-bm.adoc
M	hosted_control_planes/hcp-deploy/hcp-deploy-virt.adoc
Falling back to patching base and 3-way merge...
Auto-merging hosted_control_planes/hcp-deploy/hcp-deploy-virt.adoc
Auto-merging hosted_control_planes/hcp-deploy/hcp-deploy-non-bm.adoc
CONFLICT (content): Merge conflict in hosted_control_planes/hcp-deploy/hcp-deploy-non-bm.adoc
Auto-merging hosted_control_planes/hcp-deploy/hcp-deploy-bm.adoc
Auto-merging hosted_control_planes/hcp-deploy/hcp-deploy-aws.adoc
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 Config custom API server cert for a hosted cluster

In response to this:

/cherrypick enterprise-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2025-08-13T13:53:59Z

@lahinson: new pull request created: #97502

In response to this:

/cherrypick enterprise-4.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2025-08-13T13:54:03Z

@lahinson: new pull request created: #97503

In response to this:

/cherrypick enterprise-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Aug 4, 2025

lahinson force-pushed the osdocs-14647-hcp-custom-certificates branch 2 times, most recently from 40dc9de to ecdd664 Compare August 4, 2025 18:04

lahinson added this to the Continuous Release milestone Aug 4, 2025

lahinson added branch/enterprise-4.1 branch/enterprise-4.17 branch/enterprise-4.19 branch/enterprise-4.20 labels Aug 4, 2025

openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 4, 2025

lahinson added branch/enterprise-4.18 and removed branch/enterprise-4.1 labels Aug 4, 2025

lahinson force-pushed the osdocs-14647-hcp-custom-certificates branch 2 times, most recently from aa97552 to 593c073 Compare August 7, 2025 16:25

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 7, 2025

lahinson force-pushed the osdocs-14647-hcp-custom-certificates branch from 593c073 to 76aa0c4 Compare August 7, 2025 17:01

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 7, 2025

lahinson force-pushed the osdocs-14647-hcp-custom-certificates branch from 76aa0c4 to 887bc67 Compare August 7, 2025 17:31

jparrill reviewed Aug 11, 2025

View reviewed changes

modules/hcp-custom-cert.adoc Outdated Show resolved Hide resolved

modules/hcp-aws-create-secret-s3.adoc Outdated Show resolved Hide resolved

lahinson force-pushed the osdocs-14647-hcp-custom-certificates branch from 887bc67 to e6ddc01 Compare August 11, 2025 14:22

jparrill approved these changes Aug 11, 2025

View reviewed changes

openshift-ci bot assigned jparrill Aug 11, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 11, 2025

lahinson force-pushed the osdocs-14647-hcp-custom-certificates branch from e6ddc01 to 283a802 Compare August 11, 2025 15:10

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 11, 2025

lahinson force-pushed the osdocs-14647-hcp-custom-certificates branch from 283a802 to 7c126f1 Compare August 11, 2025 15:19

openshift-ci bot assigned jiezhao16 Aug 12, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 12, 2025

lahinson added the merge-review-needed Signifies that the merge review team needs to review this PR label Aug 12, 2025

jeana-redhat added the merge-review-in-progress Signifies that the merge review team is reviewing this PR label Aug 12, 2025

jeana-redhat approved these changes Aug 12, 2025

View reviewed changes

openshift-ci bot removed merge-review-in-progress Signifies that the merge review team is reviewing this PR merge-review-needed Signifies that the merge review team needs to review this PR labels Aug 12, 2025

[OSDOCS-14647]: Config custom API server cert for a hosted cluster

a6d71b6

lahinson force-pushed the osdocs-14647-hcp-custom-certificates branch from 7c126f1 to a6d71b6 Compare August 13, 2025 13:33

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 13, 2025

lahinson merged commit 942e32f into openshift:main Aug 13, 2025
2 checks passed

openshift-cherrypick-robot mentioned this pull request Aug 13, 2025

[enterprise-4.19] [OSDOCS-14647]: Config custom API server cert for a hosted cluster #97502

Merged

openshift-cherrypick-robot mentioned this pull request Aug 13, 2025

[enterprise-4.20] [OSDOCS-14647]: Config custom API server cert for a hosted cluster #97503

Merged

This was referenced Aug 13, 2025

[enterprise-4.17][OSDOCS-14647]: Config custom API server cert for a hosted cluster #97515

Merged

[enterprise-4.18][OSDOCS-14647]: Config custom API server cert for a hosted cluster #97517

Merged

[OSDOCS-14647]: Config custom API server cert for a hosted cluster #97081

[OSDOCS-14647]: Config custom API server cert for a hosted cluster #97081

Uh oh!

Conversation

lahinson commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jparrill left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jparrill left a comment

Choose a reason for hiding this comment

Uh oh!

jiezhao16 commented Aug 12, 2025

Uh oh!

jeana-redhat left a comment

Choose a reason for hiding this comment

Uh oh!

jeana-redhat Aug 12, 2025

Choose a reason for hiding this comment

Uh oh!

lahinson Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

jeana-redhat Aug 12, 2025

Choose a reason for hiding this comment

Uh oh!

lahinson Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

jeana-redhat Aug 12, 2025

Choose a reason for hiding this comment

Uh oh!

lahinson Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Aug 13, 2025

Uh oh!

openshift-ci bot commented Aug 13, 2025

Uh oh!

Uh oh!

lahinson commented Aug 13, 2025

Uh oh!

lahinson commented Aug 13, 2025

Uh oh!

lahinson commented Aug 13, 2025

Uh oh!

lahinson commented Aug 13, 2025

Uh oh!

openshift-cherrypick-robot commented Aug 13, 2025

Uh oh!

openshift-cherrypick-robot commented Aug 13, 2025

Uh oh!

openshift-cherrypick-robot commented Aug 13, 2025

Uh oh!

openshift-cherrypick-robot commented Aug 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

lahinson commented Aug 4, 2025 •

edited

Loading

ocpdocs-previewbot commented Aug 4, 2025 •

edited

Loading