CNTRLPLANE-2903: Add configurable PKI profile support by sanchezl · Pull Request #2127 · openshift/library-go

sanchezl · 2026-02-17T20:38:56Z

Overview

Adds configurable PKI profile support for enhancement #1882, using the API from openshift/api#2645.

PROOF: cluster-kube-apiserver-operator#2051 demonstrates the integration of these APIs into CKAO's cert rotation controllers.

`pkg/crypto` — Parameterized key generation and certificate creation

KeyConfig type supporting RSA (2048–8192 bit) and ECDSA (P-256/P-384/P-521)
GenerateKeyPair(KeyConfig) and SubjectKeyIDFromPublicKey() for algorithm-agnostic key generation
SubjectKeyIDFromPublicKey() uses truncated SHA-256 (first 160 bits per RFC 7093), consistent with Go 1.25+ (go.dev/issue/71746) and Let's Encrypt — FIPS-compatible, unlike the SHA-1 used by the legacy functions
Functional options API for certificate creation:
- NewSigningCertificate(name, keyConfig, ...opts) — self-signed root CA or intermediate CA via WithSigner
- CA.NewServerCertificate(hostnames, keyConfig, ...opts)
- CA.NewClientCertificate(userInfo, keyConfig, ...opts)
- CA.NewPeerCertificate(hostnames, userInfo, keyConfig, ...opts) — both ServerAuth + ClientAuth EKU
Options: WithLifetime, WithSubject, WithSigner, WithExtensions
ECDSA certs use DigitalSignature only (no KeyEncipherment); signature algorithm auto-detected from signing key

`pkg/pki` — Profile resolution

CertificateType enum: signer, serving, client, peer
DefaultPKIProfile() — RSA-2048 default, RSA-4096 for signers
PKIProfileProvider interface with StaticPKIProfileProvider (installer/tests) and ListerPKIProfileProvider (controllers)
ResolveCertificateConfig(provider, certType, name) → CertificateConfig{Key} — resolves effective key config from profile with category overrides
Peer type resolves to the stronger key using NIST security strength (GNFS formula for RSA, fixed for ECDSA)

`pkg/operator/certrotation` — Optional KeyConfig wiring

Added KeyConfig *crypto.KeyConfig field to RotatedSigningCASecret, ClientRotation, ServingRotation, SignerRotation
When KeyConfig is set, the new crypto.New*Certificate functions are used; when nil, existing behavior is preserved
Zero breaking changes — all existing callers are unaffected

Design

pkg/crypto has zero dependency on pkg/pki or configv1alpha1
Existing functions untouched — no breaking changes
Feature gate (ConfigurablePKI) checking is the caller's responsibility

openshift-ci · 2026-02-17T21:12:20Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sanchezl
Once this PR has been reviewed and has the lgtm label, please assign bertinatto for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2026-03-10T02:41:21Z

@sanchezl: This pull request references CNTRLPLANE-2903 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Overview

Adds configurable PKI profile support for enhancement #1882, using the API from openshift/api#2645.

pkg/crypto — Parameterized key generation and certificate creation

KeyConfig type supporting RSA (2048–8192 bit) and ECDSA (P-256/P-384/P-521)

GenerateKeyPair(KeyConfig) and SubjectKeyIDFromPublicKey() for algorithm-agnostic key generation

Functional options API for certificate creation:

NewSigningCertificate(name, keyConfig, ...opts) — self-signed root CA or intermediate CA via WithSigner

CA.NewServerCertificate(hostnames, keyConfig, ...opts)

CA.NewClientCertificate(userInfo, keyConfig, ...opts)

CA.NewPeerCertificate(hostnames, userInfo, keyConfig, ...opts) — both ServerAuth + ClientAuth EKU

Options: WithLifetime, WithSubject, WithSigner, WithExtensions

ECDSA certs use DigitalSignature only (no KeyEncipherment); signature algorithm auto-detected from signing key

pkg/pki — Profile resolution

CertificateType enum: signer, serving, client, peer

DefaultPKIProfile() — RSA-2048 default, RSA-4096 for signers

PKIProfileProvider interface with StaticPKIProfileProvider (installer/tests) and ListerPKIProfileProvider (controllers)

ResolveCertificateConfig(provider, certType, name) → CertificateConfig{Key} — resolves effective key config from profile with category overrides

Peer type resolves to the stronger key using NIST security strength (GNFS formula for RSA, fixed for ECDSA)

pkg/operator/certrotation — Optional KeyConfig wiring

Added KeyConfig *crypto.KeyConfig field to RotatedSigningCASecret, ClientRotation, ServingRotation, SignerRotation

When KeyConfig is set, the new crypto.New*Certificate functions are used; when nil, existing behavior is preserved

Zero breaking changes — all existing callers are unaffected

Design

pkg/crypto has zero dependency on pkg/pki or configv1alpha1

Existing functions untouched — no breaking changes

Feature gate (ConfigurablePKI) checking is the caller's responsibility

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-03-10T15:32:22Z

@sanchezl: This pull request references CNTRLPLANE-2903 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Overview

Adds configurable PKI profile support for enhancement #1882, using the API from openshift/api#2645.

PROOF: cluster-kube-apiserver-operator#2051 demonstrates the integration of these APIs into CKAO's cert rotation controllers.

pkg/crypto — Parameterized key generation and certificate creation

KeyConfig type supporting RSA (2048–8192 bit) and ECDSA (P-256/P-384/P-521)

GenerateKeyPair(KeyConfig) and SubjectKeyIDFromPublicKey() for algorithm-agnostic key generation

Functional options API for certificate creation:

NewSigningCertificate(name, keyConfig, ...opts) — self-signed root CA or intermediate CA via WithSigner

CA.NewServerCertificate(hostnames, keyConfig, ...opts)

CA.NewClientCertificate(userInfo, keyConfig, ...opts)

CA.NewPeerCertificate(hostnames, userInfo, keyConfig, ...opts) — both ServerAuth + ClientAuth EKU

Options: WithLifetime, WithSubject, WithSigner, WithExtensions

ECDSA certs use DigitalSignature only (no KeyEncipherment); signature algorithm auto-detected from signing key

pkg/pki — Profile resolution

CertificateType enum: signer, serving, client, peer

DefaultPKIProfile() — RSA-2048 default, RSA-4096 for signers

PKIProfileProvider interface with StaticPKIProfileProvider (installer/tests) and ListerPKIProfileProvider (controllers)

ResolveCertificateConfig(provider, certType, name) → CertificateConfig{Key} — resolves effective key config from profile with category overrides

Peer type resolves to the stronger key using NIST security strength (GNFS formula for RSA, fixed for ECDSA)

pkg/operator/certrotation — Optional KeyConfig wiring

Added KeyConfig *crypto.KeyConfig field to RotatedSigningCASecret, ClientRotation, ServingRotation, SignerRotation

When KeyConfig is set, the new crypto.New*Certificate functions are used; when nil, existing behavior is preserved

Zero breaking changes — all existing callers are unaffected

Design

pkg/crypto has zero dependency on pkg/pki or configv1alpha1

Existing functions untouched — no breaking changes

Feature gate (ConfigurablePKI) checking is the caller's responsibility

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

hasbro17 · 2026-03-10T16:29:24Z

pkg/pki/profile.go

+func DefaultPKIProfile() configv1alpha1.PKIProfile {
+	return configv1alpha1.PKIProfile{
+		Defaults: configv1alpha1.DefaultCertificateConfig{
+			Key: configv1alpha1.KeyConfig{
+				Algorithm: configv1alpha1.KeyAlgorithmRSA,
+				RSA:       configv1alpha1.RSAKeyConfig{KeySize: 2048},
+			},
+		},
+		SignerCertificates: configv1alpha1.CertificateConfig{
+			Key: configv1alpha1.KeyConfig{
+				Algorithm: configv1alpha1.KeyAlgorithmRSA,
+				RSA:       configv1alpha1.RSAKeyConfig{KeySize: 4096},
+			},
+		},
+	}
+}


Since this wasn't in the enhancement, can we make these defaults more apparent/explicit? I'll have to align the installer to use these defaults as well.

So rather than defining it in two places, maybe the default key sizes and algo for signer/leaf certs can live in the API as a const as the source of truth and I can consume it from there (until I can get the installer to switch over to library-go's crypto pkg).
E.g:
https://github.com/openshift/api/blob/0608f61fdd6bd966ba0ded180a6f49005e30ae2f/config/v1alpha1/types_pki.go#L248-L256

For unblocking the installer now: since this PR is still in review, feel free to duplicate the default values directly in the installer for now.

Introduce utilities for creating signing, server, client, and peer certificates. Include support for configurable key algorithms, customizable subjects, lifetimes, and extensions. Add comprehensive unit tests to validate all functionality.

Introduce PKI profile utilities to manage certificate configurations, including resolution, key strength comparisons, and API conversions. Add comprehensive unit tests to validate all functionality.

openshift-ci · 2026-03-11T16:02:11Z

@sanchezl: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-03-11T16:56:37Z

@sanchezl: This pull request references CNTRLPLANE-2903 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Overview

Adds configurable PKI profile support for enhancement #1882, using the API from openshift/api#2645.

PROOF: cluster-kube-apiserver-operator#2051 demonstrates the integration of these APIs into CKAO's cert rotation controllers.

pkg/crypto — Parameterized key generation and certificate creation

KeyConfig type supporting RSA (2048–8192 bit) and ECDSA (P-256/P-384/P-521)

GenerateKeyPair(KeyConfig) and SubjectKeyIDFromPublicKey() for algorithm-agnostic key generation

SubjectKeyIDFromPublicKey() uses truncated SHA-256 (first 160 bits per RFC 7093), consistent with Go 1.25+ (go.dev/issue/71746) and Let's Encrypt — FIPS-compatible, unlike the SHA-1 used by the legacy functions

Functional options API for certificate creation:

NewSigningCertificate(name, keyConfig, ...opts) — self-signed root CA or intermediate CA via WithSigner

CA.NewServerCertificate(hostnames, keyConfig, ...opts)

CA.NewClientCertificate(userInfo, keyConfig, ...opts)

CA.NewPeerCertificate(hostnames, userInfo, keyConfig, ...opts) — both ServerAuth + ClientAuth EKU

Options: WithLifetime, WithSubject, WithSigner, WithExtensions

ECDSA certs use DigitalSignature only (no KeyEncipherment); signature algorithm auto-detected from signing key

pkg/pki — Profile resolution

CertificateType enum: signer, serving, client, peer

DefaultPKIProfile() — RSA-2048 default, RSA-4096 for signers

PKIProfileProvider interface with StaticPKIProfileProvider (installer/tests) and ListerPKIProfileProvider (controllers)

ResolveCertificateConfig(provider, certType, name) → CertificateConfig{Key} — resolves effective key config from profile with category overrides

Peer type resolves to the stronger key using NIST security strength (GNFS formula for RSA, fixed for ECDSA)

pkg/operator/certrotation — Optional KeyConfig wiring

Added KeyConfig *crypto.KeyConfig field to RotatedSigningCASecret, ClientRotation, ServingRotation, SignerRotation

When KeyConfig is set, the new crypto.New*Certificate functions are used; when nil, existing behavior is preserved

Zero breaking changes — all existing callers are unaffected

Design

pkg/crypto has zero dependency on pkg/pki or configv1alpha1

Existing functions untouched — no breaking changes

Feature gate (ConfigurablePKI) checking is the caller's responsibility

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sanchezl changed the title ~~vendor: bump openshift/api and client-go for pki-config~~ WIP: PROOF: bump openshift/api and client-go for pki-config Feb 17, 2026

sanchezl force-pushed the pki-config branch from 34ab734 to 9b14e4f Compare February 17, 2026 21:04

sanchezl force-pushed the pki-config branch 2 times, most recently from 9aba308 to d3568d4 Compare March 5, 2026 16:57

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 5, 2026

sanchezl force-pushed the pki-config branch 2 times, most recently from 0632ccd to baa0195 Compare March 5, 2026 21:45

sanchezl changed the title ~~WIP: PROOF: bump openshift/api and client-go for pki-config~~ WIP: Add configurable PKI profile support Mar 5, 2026

sanchezl marked this pull request as ready for review March 9, 2026 15:49

openshift-ci bot requested review from bertinatto and hexfusion March 9, 2026 15:50

sanchezl mentioned this pull request Mar 10, 2026

CNTRLPLANE-2935: Enable configurable PKI for managed certificate rotation openshift/cluster-kube-apiserver-operator#2051

Open

sanchezl changed the title ~~WIP: Add configurable PKI profile support~~ CNTRLPLANE-2903: Add configurable PKI profile support Mar 10, 2026

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 10, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 10, 2026

hasbro17 reviewed Mar 10, 2026

View reviewed changes

sanchezl added 4 commits March 11, 2026 11:33

vendor: bump openshift/api and client-go for pki-config

d05a71b

pki: add PKI profile management with resolution and tests

de9ffd6

Introduce PKI profile utilities to manage certificate configurations, including resolution, key strength comparisons, and API conversions. Add comprehensive unit tests to validate all functionality.

certrotation: add support for configurable key algorithm and size

3b025b4

sanchezl force-pushed the pki-config branch from baa0195 to 3b025b4 Compare March 11, 2026 15:33

sanchezl mentioned this pull request Mar 12, 2026

CNTRLPLANE-2947: Enable configurable PKI for signing CA and serving certificates openshift/service-ca-operator#327

Open

Conversation

sanchezl commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

pkg/crypto — Parameterized key generation and certificate creation

pkg/pki — Profile resolution

pkg/operator/certrotation — Optional KeyConfig wiring

Design

Uh oh!

openshift-ci bot commented Feb 17, 2026

Uh oh!

openshift-ci-robot commented Mar 10, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

pkg/crypto — Parameterized key generation and certificate creation

pkg/pki — Profile resolution

pkg/operator/certrotation — Optional KeyConfig wiring

Design

Uh oh!

openshift-ci-robot commented Mar 10, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

pkg/crypto — Parameterized key generation and certificate creation

pkg/pki — Profile resolution

pkg/operator/certrotation — Optional KeyConfig wiring

Design

Uh oh!

hasbro17 Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

sanchezl Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Mar 11, 2026

Uh oh!

openshift-ci-robot commented Mar 11, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

pkg/crypto — Parameterized key generation and certificate creation

pkg/pki — Profile resolution

pkg/operator/certrotation — Optional KeyConfig wiring

Design

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sanchezl commented Feb 17, 2026 •

edited

Loading

`pkg/crypto` — Parameterized key generation and certificate creation

`pkg/pki` — Profile resolution

`pkg/operator/certrotation` — Optional KeyConfig wiring

openshift-ci-robot commented Mar 10, 2026 •

edited by openshift-ci bot

Loading

`pkg/crypto` — Parameterized key generation and certificate creation

`pkg/pki` — Profile resolution

`pkg/operator/certrotation` — Optional KeyConfig wiring

openshift-ci-robot commented Mar 10, 2026 •

edited by openshift-ci bot

Loading

`pkg/crypto` — Parameterized key generation and certificate creation

`pkg/pki` — Profile resolution

`pkg/operator/certrotation` — Optional KeyConfig wiring

openshift-ci-robot commented Mar 11, 2026 •

edited by openshift-ci bot

Loading

`pkg/crypto` — Parameterized key generation and certificate creation

`pkg/pki` — Profile resolution

`pkg/operator/certrotation` — Optional KeyConfig wiring