From b62de8c3f8312dd3a1001107c808fcec35ee502c Mon Sep 17 00:00:00 2001 From: Francesco Pantano Date: Tue, 7 Jul 2026 09:19:21 +0200 Subject: [PATCH] Use ECDSA P-256 private keys for cert-manager certificates Switch all cert-manager Certificate resources from the default RSA algorithm to ECDSA P-256. This applies to webhook serving certs, metrics server certs, and all operator bindata certificates. The sync-bindata.sh script is updated accordingly. Co-Authored-By: Claude Opus 4.6 Signed-off-by: Francesco Pantano --- bindata/operator/infra-operator-webhooks.yaml | 3 +++ bindata/operator/openstack-baremetal-operator-webhooks.yaml | 3 +++ bindata/services/barbican-operator-services.yaml | 3 +++ bindata/services/cinder-operator-services.yaml | 3 +++ bindata/services/designate-operator-services.yaml | 3 +++ bindata/services/glance-operator-services.yaml | 3 +++ bindata/services/heat-operator-services.yaml | 3 +++ bindata/services/horizon-operator-services.yaml | 3 +++ bindata/services/infra-operator-services.yaml | 3 +++ bindata/services/ironic-operator-services.yaml | 3 +++ bindata/services/keystone-operator-services.yaml | 3 +++ bindata/services/manila-operator-services.yaml | 3 +++ bindata/services/mariadb-operator-services.yaml | 3 +++ bindata/services/neutron-operator-services.yaml | 3 +++ bindata/services/nova-operator-services.yaml | 3 +++ bindata/services/octavia-operator-services.yaml | 3 +++ bindata/services/openstack-baremetal-operator-services.yaml | 3 +++ bindata/services/ovn-operator-services.yaml | 3 +++ bindata/services/swift-operator-services.yaml | 3 +++ bindata/services/telemetry-operator-services.yaml | 3 +++ bindata/services/test-operator-services.yaml | 3 +++ bindata/services/watcher-operator-services.yaml | 3 +++ hack/sync-bindata.sh | 6 ++++++ 23 files changed, 72 insertions(+) diff --git a/bindata/operator/infra-operator-webhooks.yaml b/bindata/operator/infra-operator-webhooks.yaml index 3e31d057b3..91860c09f6 100644 --- a/bindata/operator/infra-operator-webhooks.yaml +++ b/bindata/operator/infra-operator-webhooks.yaml @@ -37,6 +37,9 @@ spec: issuerRef: kind: Issuer name: infra-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: infra-operator-webhook-server-cert --- apiVersion: admissionregistration.k8s.io/v1 diff --git a/bindata/operator/openstack-baremetal-operator-webhooks.yaml b/bindata/operator/openstack-baremetal-operator-webhooks.yaml index 53c50169ca..86177b24f7 100644 --- a/bindata/operator/openstack-baremetal-operator-webhooks.yaml +++ b/bindata/operator/openstack-baremetal-operator-webhooks.yaml @@ -37,6 +37,9 @@ spec: issuerRef: kind: Issuer name: openstack-baremetal-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: openstack-baremetal-operator-webhook-server-cert --- apiVersion: admissionregistration.k8s.io/v1 diff --git a/bindata/services/barbican-operator-services.yaml b/bindata/services/barbican-operator-services.yaml index b4ad6e0e89..bf43d4f10d 100644 --- a/bindata/services/barbican-operator-services.yaml +++ b/bindata/services/barbican-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: barbican-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: barbican-operator-metrics-server-cert diff --git a/bindata/services/cinder-operator-services.yaml b/bindata/services/cinder-operator-services.yaml index 83c1b4360d..ce02802b7c 100644 --- a/bindata/services/cinder-operator-services.yaml +++ b/bindata/services/cinder-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: cinder-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: cinder-operator-metrics-server-cert diff --git a/bindata/services/designate-operator-services.yaml b/bindata/services/designate-operator-services.yaml index d40d62a8c1..ae48a01119 100644 --- a/bindata/services/designate-operator-services.yaml +++ b/bindata/services/designate-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: designate-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: designate-operator-metrics-server-cert diff --git a/bindata/services/glance-operator-services.yaml b/bindata/services/glance-operator-services.yaml index 06cd81dfe3..e443b0b217 100644 --- a/bindata/services/glance-operator-services.yaml +++ b/bindata/services/glance-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: glance-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: glance-operator-metrics-server-cert diff --git a/bindata/services/heat-operator-services.yaml b/bindata/services/heat-operator-services.yaml index 72e5a54ff0..b0b8e5921c 100644 --- a/bindata/services/heat-operator-services.yaml +++ b/bindata/services/heat-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: heat-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: heat-operator-metrics-server-cert diff --git a/bindata/services/horizon-operator-services.yaml b/bindata/services/horizon-operator-services.yaml index 3afcc63772..1209a21372 100644 --- a/bindata/services/horizon-operator-services.yaml +++ b/bindata/services/horizon-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: horizon-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: horizon-operator-metrics-server-cert diff --git a/bindata/services/infra-operator-services.yaml b/bindata/services/infra-operator-services.yaml index d8bed1e344..c128e66fd6 100644 --- a/bindata/services/infra-operator-services.yaml +++ b/bindata/services/infra-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: infra-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: infra-operator-metrics-server-cert diff --git a/bindata/services/ironic-operator-services.yaml b/bindata/services/ironic-operator-services.yaml index 9d88b63f95..61a3a8606a 100644 --- a/bindata/services/ironic-operator-services.yaml +++ b/bindata/services/ironic-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: ironic-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: ironic-operator-metrics-server-cert diff --git a/bindata/services/keystone-operator-services.yaml b/bindata/services/keystone-operator-services.yaml index 5cd9b0ce9a..f60ec287a3 100644 --- a/bindata/services/keystone-operator-services.yaml +++ b/bindata/services/keystone-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: keystone-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: keystone-operator-metrics-server-cert diff --git a/bindata/services/manila-operator-services.yaml b/bindata/services/manila-operator-services.yaml index 0158e86ed6..b25b2cdac8 100644 --- a/bindata/services/manila-operator-services.yaml +++ b/bindata/services/manila-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: manila-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: manila-operator-metrics-server-cert diff --git a/bindata/services/mariadb-operator-services.yaml b/bindata/services/mariadb-operator-services.yaml index 3438f47d8c..79f8628ae7 100644 --- a/bindata/services/mariadb-operator-services.yaml +++ b/bindata/services/mariadb-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: mariadb-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: mariadb-operator-metrics-server-cert diff --git a/bindata/services/neutron-operator-services.yaml b/bindata/services/neutron-operator-services.yaml index 78d7cf42ae..a515ff5872 100644 --- a/bindata/services/neutron-operator-services.yaml +++ b/bindata/services/neutron-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: neutron-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: neutron-operator-metrics-server-cert diff --git a/bindata/services/nova-operator-services.yaml b/bindata/services/nova-operator-services.yaml index 3c4ac3444e..c312e63527 100644 --- a/bindata/services/nova-operator-services.yaml +++ b/bindata/services/nova-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: nova-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: nova-operator-metrics-server-cert diff --git a/bindata/services/octavia-operator-services.yaml b/bindata/services/octavia-operator-services.yaml index cf6d9b13c7..2cb6e2cd90 100644 --- a/bindata/services/octavia-operator-services.yaml +++ b/bindata/services/octavia-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: octavia-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: octavia-operator-metrics-server-cert diff --git a/bindata/services/openstack-baremetal-operator-services.yaml b/bindata/services/openstack-baremetal-operator-services.yaml index 10004c5094..380bc6fc59 100644 --- a/bindata/services/openstack-baremetal-operator-services.yaml +++ b/bindata/services/openstack-baremetal-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: openstack-baremetal-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: openstack-baremetal-operator-metrics-server-cert diff --git a/bindata/services/ovn-operator-services.yaml b/bindata/services/ovn-operator-services.yaml index 59f1c4236f..9bd437f1c3 100644 --- a/bindata/services/ovn-operator-services.yaml +++ b/bindata/services/ovn-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: ovn-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: ovn-operator-metrics-server-cert diff --git a/bindata/services/swift-operator-services.yaml b/bindata/services/swift-operator-services.yaml index cbd7a7a53b..2b910200d3 100644 --- a/bindata/services/swift-operator-services.yaml +++ b/bindata/services/swift-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: swift-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: swift-operator-metrics-server-cert diff --git a/bindata/services/telemetry-operator-services.yaml b/bindata/services/telemetry-operator-services.yaml index 8849fc5d42..cab9914636 100644 --- a/bindata/services/telemetry-operator-services.yaml +++ b/bindata/services/telemetry-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: telemetry-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: telemetry-operator-metrics-server-cert diff --git a/bindata/services/test-operator-services.yaml b/bindata/services/test-operator-services.yaml index 2e5abf650a..81187e549c 100644 --- a/bindata/services/test-operator-services.yaml +++ b/bindata/services/test-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: test-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: test-operator-metrics-server-cert diff --git a/bindata/services/watcher-operator-services.yaml b/bindata/services/watcher-operator-services.yaml index 11aed6adf5..35bfa74eb2 100644 --- a/bindata/services/watcher-operator-services.yaml +++ b/bindata/services/watcher-operator-services.yaml @@ -52,4 +52,7 @@ spec: issuerRef: kind: Issuer name: watcher-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: watcher-operator-metrics-server-cert diff --git a/hack/sync-bindata.sh b/hack/sync-bindata.sh index 108161f7f1..7604a45381 100755 --- a/hack/sync-bindata.sh +++ b/hack/sync-bindata.sh @@ -91,6 +91,9 @@ spec: issuerRef: kind: Issuer name: $OPERATOR_NAME-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: $OPERATOR_NAME-webhook-server-cert --- apiVersion: admissionregistration.k8s.io/v1 @@ -229,6 +232,9 @@ spec: issuerRef: kind: Issuer name: $OPERATOR_NAME-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: $OPERATOR_NAME-metrics-server-cert EOF_CAT