Chapter 25. OperatorPKI [network.operator.openshift.io/v1] Description OperatorPKI is a simple certificate authority. It is not intended for external use - rather, it is internal to the network operator. The CNO creates a CA and a certificate signed by that CA. The certificate has both ClientAuth and ServerAuth extended usages enabled. A Secret called <name>-ca with two data keys: tls.key - the private key tls.crt - the CA certificate A ConfigMap called <name>-ca with a single data key: cabundle.crt - the CA certificate(s) A Secret called <name>-cert with two data keys: tls.key - the private key tls.crt - the certificate, signed by the CA The CA certificate will have a validity of 10 years, rotated after 9. The target certificate will have a validity of 6 months, rotated after 3 The CA certificate will have a CommonName of "<namespace>_<name>-ca@<timestamp>", where <timestamp> is the last rotation time. Type object Required spec 25.1. Specification Property Type Description apiVersion string APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources kind string Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds metadata ObjectMeta Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata spec object OperatorPKISpec is the PKI configuration. status object OperatorPKIStatus is not implemented. 25.1.1. .spec Description OperatorPKISpec is the PKI configuration. Type object Required targetCert Property Type Description targetCert object targetCert configures the certificate signed by the CA. It will have both ClientAuth and ServerAuth enabled 25.1.2. .spec.targetCert Description targetCert configures the certificate signed by the CA. It will have both ClientAuth and ServerAuth enabled Type object Required commonName Property Type Description commonName string commonName is the value in the certificate's CN 25.1.3. .status Description OperatorPKIStatus is not implemented. Type object 25.2. API endpoints The following API endpoints are available: /apis/network.operator.openshift.io/v1/operatorpkis GET : list objects of kind OperatorPKI /apis/network.operator.openshift.io/v1/namespaces/{namespace}/operatorpkis DELETE : delete collection of OperatorPKI GET : list objects of kind OperatorPKI POST : create an OperatorPKI /apis/network.operator.openshift.io/v1/namespaces/{namespace}/operatorpkis/{name} DELETE : delete an OperatorPKI GET : read the specified OperatorPKI PATCH : partially update the specified OperatorPKI PUT : replace the specified OperatorPKI 25.2.1. /apis/network.operator.openshift.io/v1/operatorpkis HTTP method GET Description list objects of kind OperatorPKI Table 25.1. HTTP responses HTTP code Reponse body 200 - OK OperatorPKIList schema 401 - Unauthorized Empty 25.2.2. /apis/network.operator.openshift.io/v1/namespaces/{namespace}/operatorpkis HTTP method DELETE Description delete collection of OperatorPKI Table 25.2. HTTP responses HTTP code Reponse body 200 - OK Status schema 401 - Unauthorized Empty HTTP method GET Description list objects of kind OperatorPKI Table 25.3. HTTP responses HTTP code Reponse body 200 - OK OperatorPKIList schema 401 - Unauthorized Empty HTTP method POST Description create an OperatorPKI Table 25.4. Query parameters Parameter Type Description dryRun string When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed fieldValidation string fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered. Table 25.5. Body parameters Parameter Type Description body OperatorPKI schema Table 25.6. HTTP responses HTTP code Reponse body 200 - OK OperatorPKI schema 201 - Created OperatorPKI schema 202 - Accepted OperatorPKI schema 401 - Unauthorized Empty 25.2.3. /apis/network.operator.openshift.io/v1/namespaces/{namespace}/operatorpkis/{name} Table 25.7. Global path parameters Parameter Type Description name string name of the OperatorPKI HTTP method DELETE Description delete an OperatorPKI Table 25.8. Query parameters Parameter Type Description dryRun string When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed Table 25.9. HTTP responses HTTP code Reponse body 200 - OK Status schema 202 - Accepted Status schema 401 - Unauthorized Empty HTTP method GET Description read the specified OperatorPKI Table 25.10. HTTP responses HTTP code Reponse body 200 - OK OperatorPKI schema 401 - Unauthorized Empty HTTP method PATCH Description partially update the specified OperatorPKI Table 25.11. Query parameters Parameter Type Description dryRun string When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed fieldValidation string fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered. Table 25.12. HTTP responses HTTP code Reponse body 200 - OK OperatorPKI schema 401 - Unauthorized Empty HTTP method PUT Description replace the specified OperatorPKI Table 25.13. Query parameters Parameter Type Description dryRun string When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed fieldValidation string fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered. Table 25.14. Body parameters Parameter Type Description body OperatorPKI schema Table 25.15. HTTP responses HTTP code Reponse body 200 - OK OperatorPKI schema 201 - Created OperatorPKI schema 401 - Unauthorized Empty

Commands:
More specifically, given an OperatorPKI with <name>, the CNO will manage: