Add Explicit Private Key Stanzas for Metrics and Webhook Services Configured with Cert Manager - #649
Add Explicit Private Key Stanzas for Metrics and Webhook Services Configured with Cert Manager#649subecho wants to merge 3 commits into
Conversation
This patch adds an explicit private key stanza for generating the private key for the metrics service. This will, eventually, be replaced by quantum-safe algorithms and sizes when those become available.
This patch adds an explicit private key stanza for generating the private key for the webhook service. This will, as with the metrics service, be replaced by quantum-safe algorithms and sizes when those become available.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: subecho The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
we could make this change in the infra-operator, but to change this in the product we need openstack-k8s-operators/openstack-operator#1973 . best we sync with @fmount when he is back from pto on which size we use. |
Makes sense to me! I was using the recommendations from the PQC scans that we did a while ago which looks to be the same ones being utilized in openstack-k8s-operators/openstack-operator#1973. Happy to help out however I can! Thanks @stuggi! |
Hey @subecho thanks for this. In theory this change makes sense because aligns the OLM deployment part of infra-operator w/ the final configuration we want to achieve. |
3 participants
Previously, we did not specify the parameters of the private keys that would generated for the Metrics and Webhook services in the Infra Operator, relying instead on whatever the defaults might be.
As we move towards enabling post-quantum safety in our operators, we are starting by explicitly stating what the private key algorithm and key size shall be. This is to ensure that the keys are exactly what we want them to be and to provide an easy-to-configure place to change the algorithm and key size should the need arise (such as when quantum safe algorithms become available to use for generating private keys.)