From 62715b26f99829b3c2789688c6fe893ec4aec2ab Mon Sep 17 00:00:00 2001 From: Francesco Pantano Date: Tue, 7 Jul 2026 09:19:21 +0200 Subject: [PATCH] Use ECDSA P-256 private keys for cert-manager certificates Switch all cert-manager Certificate resources from the default RSA algorithm to ECDSA P-256. This applies to webhook serving certs, metrics server certs, and all operator bindata certificates. The sync-bindata.sh script is updated accordingly. Co-Authored-By: Claude Opus 4.6 Signed-off-by: Francesco Pantano --- bindata/operator/infra-operator-webhooks.yaml | 3 +++ bindata/operator/openstack-baremetal-operator-webhooks.yaml | 3 +++ bindata/operator/operator.yaml | 6 ++++++ bindata/rbac/barbican-operator-rbac.yaml | 3 +++ bindata/rbac/cinder-operator-rbac.yaml | 3 +++ bindata/rbac/designate-operator-rbac.yaml | 3 +++ bindata/rbac/glance-operator-rbac.yaml | 3 +++ bindata/rbac/heat-operator-rbac.yaml | 3 +++ bindata/rbac/horizon-operator-rbac.yaml | 3 +++ bindata/rbac/infra-operator-rbac.yaml | 3 +++ bindata/rbac/ironic-operator-rbac.yaml | 3 +++ bindata/rbac/keystone-operator-rbac.yaml | 3 +++ bindata/rbac/manila-operator-rbac.yaml | 3 +++ bindata/rbac/mariadb-operator-rbac.yaml | 3 +++ bindata/rbac/neutron-operator-rbac.yaml | 3 +++ bindata/rbac/nova-operator-rbac.yaml | 3 +++ bindata/rbac/octavia-operator-rbac.yaml | 3 +++ bindata/rbac/openstack-baremetal-operator-rbac.yaml | 3 +++ bindata/rbac/ovn-operator-rbac.yaml | 3 +++ bindata/rbac/swift-operator-rbac.yaml | 3 +++ bindata/rbac/telemetry-operator-rbac.yaml | 3 +++ bindata/rbac/test-operator-rbac.yaml | 3 +++ bindata/rbac/watcher-operator-rbac.yaml | 3 +++ config/certmanager/certificate-metrics.yaml | 3 +++ config/certmanager/certificate-webhook.yaml | 3 +++ hack/sync-bindata.sh | 6 ++++++ 26 files changed, 84 insertions(+) diff --git a/bindata/operator/infra-operator-webhooks.yaml b/bindata/operator/infra-operator-webhooks.yaml index 3e31d057b3..91860c09f6 100644 --- a/bindata/operator/infra-operator-webhooks.yaml +++ b/bindata/operator/infra-operator-webhooks.yaml @@ -37,6 +37,9 @@ spec: issuerRef: kind: Issuer name: infra-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: infra-operator-webhook-server-cert --- apiVersion: admissionregistration.k8s.io/v1 diff --git a/bindata/operator/openstack-baremetal-operator-webhooks.yaml b/bindata/operator/openstack-baremetal-operator-webhooks.yaml index 53c50169ca..86177b24f7 100644 --- a/bindata/operator/openstack-baremetal-operator-webhooks.yaml +++ b/bindata/operator/openstack-baremetal-operator-webhooks.yaml @@ -37,6 +37,9 @@ spec: issuerRef: kind: Issuer name: openstack-baremetal-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: openstack-baremetal-operator-webhook-server-cert --- apiVersion: admissionregistration.k8s.io/v1 diff --git a/bindata/operator/operator.yaml b/bindata/operator/operator.yaml index ee1e0ed724..0eb08e2e29 100644 --- a/bindata/operator/operator.yaml +++ b/bindata/operator/operator.yaml @@ -157,6 +157,9 @@ spec: issuerRef: kind: Issuer name: openstack-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: metrics-server-cert --- apiVersion: cert-manager.io/v1 @@ -174,6 +177,9 @@ spec: issuerRef: kind: Issuer name: openstack-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: webhook-server-cert --- apiVersion: cert-manager.io/v1 diff --git a/bindata/rbac/barbican-operator-rbac.yaml b/bindata/rbac/barbican-operator-rbac.yaml index 15ce727667..c682f5f60a 100644 --- a/bindata/rbac/barbican-operator-rbac.yaml +++ b/bindata/rbac/barbican-operator-rbac.yaml @@ -359,4 +359,7 @@ spec: issuerRef: kind: Issuer name: barbican-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: barbican-operator-metrics-server-cert diff --git a/bindata/rbac/cinder-operator-rbac.yaml b/bindata/rbac/cinder-operator-rbac.yaml index 9d5efab729..5bf71e2b43 100644 --- a/bindata/rbac/cinder-operator-rbac.yaml +++ b/bindata/rbac/cinder-operator-rbac.yaml @@ -372,4 +372,7 @@ spec: issuerRef: kind: Issuer name: cinder-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: cinder-operator-metrics-server-cert diff --git a/bindata/rbac/designate-operator-rbac.yaml b/bindata/rbac/designate-operator-rbac.yaml index 0c1fe0106f..e42e147652 100644 --- a/bindata/rbac/designate-operator-rbac.yaml +++ b/bindata/rbac/designate-operator-rbac.yaml @@ -422,4 +422,7 @@ spec: issuerRef: kind: Issuer name: designate-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: designate-operator-metrics-server-cert diff --git a/bindata/rbac/glance-operator-rbac.yaml b/bindata/rbac/glance-operator-rbac.yaml index 6a360a01dd..bcbe7838a5 100644 --- a/bindata/rbac/glance-operator-rbac.yaml +++ b/bindata/rbac/glance-operator-rbac.yaml @@ -388,4 +388,7 @@ spec: issuerRef: kind: Issuer name: glance-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: glance-operator-metrics-server-cert diff --git a/bindata/rbac/heat-operator-rbac.yaml b/bindata/rbac/heat-operator-rbac.yaml index fb81df3f83..c91bfc8fc6 100644 --- a/bindata/rbac/heat-operator-rbac.yaml +++ b/bindata/rbac/heat-operator-rbac.yaml @@ -361,4 +361,7 @@ spec: issuerRef: kind: Issuer name: heat-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: heat-operator-metrics-server-cert diff --git a/bindata/rbac/horizon-operator-rbac.yaml b/bindata/rbac/horizon-operator-rbac.yaml index e47ce70f0b..f0d64fc321 100644 --- a/bindata/rbac/horizon-operator-rbac.yaml +++ b/bindata/rbac/horizon-operator-rbac.yaml @@ -312,4 +312,7 @@ spec: issuerRef: kind: Issuer name: horizon-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: horizon-operator-metrics-server-cert diff --git a/bindata/rbac/infra-operator-rbac.yaml b/bindata/rbac/infra-operator-rbac.yaml index acad599601..a369361ac1 100644 --- a/bindata/rbac/infra-operator-rbac.yaml +++ b/bindata/rbac/infra-operator-rbac.yaml @@ -539,4 +539,7 @@ spec: issuerRef: kind: Issuer name: infra-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: infra-operator-metrics-server-cert diff --git a/bindata/rbac/ironic-operator-rbac.yaml b/bindata/rbac/ironic-operator-rbac.yaml index 56c095de9b..95586fc118 100644 --- a/bindata/rbac/ironic-operator-rbac.yaml +++ b/bindata/rbac/ironic-operator-rbac.yaml @@ -385,4 +385,7 @@ spec: issuerRef: kind: Issuer name: ironic-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: ironic-operator-metrics-server-cert diff --git a/bindata/rbac/keystone-operator-rbac.yaml b/bindata/rbac/keystone-operator-rbac.yaml index 25bc1d624f..288702e54b 100644 --- a/bindata/rbac/keystone-operator-rbac.yaml +++ b/bindata/rbac/keystone-operator-rbac.yaml @@ -395,4 +395,7 @@ spec: issuerRef: kind: Issuer name: keystone-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: keystone-operator-metrics-server-cert diff --git a/bindata/rbac/manila-operator-rbac.yaml b/bindata/rbac/manila-operator-rbac.yaml index dfeddea638..a72d8541bf 100644 --- a/bindata/rbac/manila-operator-rbac.yaml +++ b/bindata/rbac/manila-operator-rbac.yaml @@ -371,4 +371,7 @@ spec: issuerRef: kind: Issuer name: manila-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: manila-operator-metrics-server-cert diff --git a/bindata/rbac/mariadb-operator-rbac.yaml b/bindata/rbac/mariadb-operator-rbac.yaml index 3306b85c2b..616259934a 100644 --- a/bindata/rbac/mariadb-operator-rbac.yaml +++ b/bindata/rbac/mariadb-operator-rbac.yaml @@ -333,4 +333,7 @@ spec: issuerRef: kind: Issuer name: mariadb-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: mariadb-operator-metrics-server-cert diff --git a/bindata/rbac/neutron-operator-rbac.yaml b/bindata/rbac/neutron-operator-rbac.yaml index 9c47fd11e6..ffb052deb8 100644 --- a/bindata/rbac/neutron-operator-rbac.yaml +++ b/bindata/rbac/neutron-operator-rbac.yaml @@ -366,4 +366,7 @@ spec: issuerRef: kind: Issuer name: neutron-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: neutron-operator-metrics-server-cert diff --git a/bindata/rbac/nova-operator-rbac.yaml b/bindata/rbac/nova-operator-rbac.yaml index 180e3dbbd4..47b98f0dec 100644 --- a/bindata/rbac/nova-operator-rbac.yaml +++ b/bindata/rbac/nova-operator-rbac.yaml @@ -431,4 +431,7 @@ spec: issuerRef: kind: Issuer name: nova-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: nova-operator-metrics-server-cert diff --git a/bindata/rbac/octavia-operator-rbac.yaml b/bindata/rbac/octavia-operator-rbac.yaml index f25fb8a070..03f6e9779b 100644 --- a/bindata/rbac/octavia-operator-rbac.yaml +++ b/bindata/rbac/octavia-operator-rbac.yaml @@ -416,4 +416,7 @@ spec: issuerRef: kind: Issuer name: octavia-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: octavia-operator-metrics-server-cert diff --git a/bindata/rbac/openstack-baremetal-operator-rbac.yaml b/bindata/rbac/openstack-baremetal-operator-rbac.yaml index 4e512281c6..01741afb8f 100644 --- a/bindata/rbac/openstack-baremetal-operator-rbac.yaml +++ b/bindata/rbac/openstack-baremetal-operator-rbac.yaml @@ -328,4 +328,7 @@ spec: issuerRef: kind: Issuer name: openstack-baremetal-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: openstack-baremetal-operator-metrics-server-cert diff --git a/bindata/rbac/ovn-operator-rbac.yaml b/bindata/rbac/ovn-operator-rbac.yaml index 2e133574fd..a21f1a6295 100644 --- a/bindata/rbac/ovn-operator-rbac.yaml +++ b/bindata/rbac/ovn-operator-rbac.yaml @@ -355,4 +355,7 @@ spec: issuerRef: kind: Issuer name: ovn-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: ovn-operator-metrics-server-cert diff --git a/bindata/rbac/swift-operator-rbac.yaml b/bindata/rbac/swift-operator-rbac.yaml index eb00e35d64..6ecb187365 100644 --- a/bindata/rbac/swift-operator-rbac.yaml +++ b/bindata/rbac/swift-operator-rbac.yaml @@ -417,4 +417,7 @@ spec: issuerRef: kind: Issuer name: swift-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: swift-operator-metrics-server-cert diff --git a/bindata/rbac/telemetry-operator-rbac.yaml b/bindata/rbac/telemetry-operator-rbac.yaml index 42f3f85964..ebe61ac62c 100644 --- a/bindata/rbac/telemetry-operator-rbac.yaml +++ b/bindata/rbac/telemetry-operator-rbac.yaml @@ -555,4 +555,7 @@ spec: issuerRef: kind: Issuer name: telemetry-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: telemetry-operator-metrics-server-cert diff --git a/bindata/rbac/test-operator-rbac.yaml b/bindata/rbac/test-operator-rbac.yaml index ae2f9fad73..c41596d9a3 100644 --- a/bindata/rbac/test-operator-rbac.yaml +++ b/bindata/rbac/test-operator-rbac.yaml @@ -261,4 +261,7 @@ spec: issuerRef: kind: Issuer name: test-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: test-operator-metrics-server-cert diff --git a/bindata/rbac/watcher-operator-rbac.yaml b/bindata/rbac/watcher-operator-rbac.yaml index 83cee7afc0..77a5ff2569 100644 --- a/bindata/rbac/watcher-operator-rbac.yaml +++ b/bindata/rbac/watcher-operator-rbac.yaml @@ -387,4 +387,7 @@ spec: issuerRef: kind: Issuer name: watcher-operator-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: watcher-operator-metrics-server-cert diff --git a/config/certmanager/certificate-metrics.yaml b/config/certmanager/certificate-metrics.yaml index 7a9f5d4af5..ef26dbb145 100644 --- a/config/certmanager/certificate-metrics.yaml +++ b/config/certmanager/certificate-metrics.yaml @@ -17,4 +17,7 @@ spec: issuerRef: kind: Issuer name: selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: metrics-server-cert diff --git a/config/certmanager/certificate-webhook.yaml b/config/certmanager/certificate-webhook.yaml index 832a2a6730..afb5639d01 100644 --- a/config/certmanager/certificate-webhook.yaml +++ b/config/certmanager/certificate-webhook.yaml @@ -17,4 +17,7 @@ spec: issuerRef: kind: Issuer name: selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: webhook-server-cert diff --git a/hack/sync-bindata.sh b/hack/sync-bindata.sh index bcf721f005..9dc1cc42f3 100755 --- a/hack/sync-bindata.sh +++ b/hack/sync-bindata.sh @@ -87,6 +87,9 @@ spec: issuerRef: kind: Issuer name: $OPERATOR_NAME-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: $OPERATOR_NAME-webhook-server-cert --- apiVersion: admissionregistration.k8s.io/v1 @@ -341,6 +344,9 @@ spec: issuerRef: kind: Issuer name: $OPERATOR_NAME-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 secretName: $OPERATOR_NAME-metrics-server-cert EOF_CAT