Key material inside a cluster

The following objects are stored in the openshift-machine-config-operator namespace:

  • The Machine Config Server (MCS) certificate authority (CA) bundle is stored as the machine-config-server-ca config map. The MCS CA bundle stores all valid CAs for the MachineConfigServer TLS certificate.

  • The MCS CA signing key is stored as the machine-config-server-ca secret. The MCS CA signing key is used to sign the MachineConfigServer TLS certificate.

  • The MCS certificate is stored as the machine-config-server-tls secret, which contains the MachineConfigServer TLS certificate and key.

The machine-config-server-ca config map is used in the following ways:

  • The certificate controller updates the *-user-data secrets in the openshift-machine-api namespace any time the machine-config-server-ca configmap is updated.

  • The Machine Config Operator renders the master-user-data-managed and worker-user-data-managed secrets from the machine-config-server-ca configmap.

↑ Up: Machine Config Operator certificates reference | ⌂ Home: OpenShift Container Platform | Next: Management →