After upgrading OpenShift from 4.9 to 4.10, the authentication operator does not clear the error message from the "Upgradeable" field regarding an invalid SAN certificate

Solution Verified - Updated -

Issue

  • After upgrading the cluster to 4.10.57, and after fixing the LDAP server certificate to include a Subject Alternative Name (SAN) section, we can still see the error in the operator status:

    $ oc get co authentication -o yaml
    ...
    status:
    conditions:
    - lastTransitionTime: "2023-05-22T15:42:37Z"
    message: 'InvalidProviderInvalidCertsUpgradeable: Server certificates without
      SAN detected: {provider="LDAP"}. These have to be replaced to include the respective
      hosts in their SAN extension and not rely on the Subject''s CN for the purpose of hostname verification.'
    reason: InvalidProviderInvalidCerts_InvalidCertsDetected
    status: "False"
    type: Upgradeable
    
  • The upgrade was forced, ignoring the the following message:

    Warning alert:
    This cluster should not be updated to 4.10. You can continue to update to patch releases in 4.9.
    
    Cluster operator authentication should not be upgraded between minor versions: 
    InvalidProviderInvalidCertsUpgradeable: Server certificates without SAN detected: {provider="LDAP"}. These have to be replaced to include the respective hosts in their SAN extension and not rely on the Subject's CN for the purpose of hostname verification.
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)

    • Upgrade from any 4.9 version to any 4.10 version (lower than 4.10.63).
    • Users authenticate externally to an LDAP server that, prior to the upgrade, does not have a valid SAN certificate.

    Check also solution Upgrade stuck in waiting exceeded 40 minutes for these operators: console for more scenarios affected by this issue.

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content