pki

func DefaultPKIProfile ¶

func DefaultPKIProfile() configv1alpha1.PKIProfile

DefaultPKIProfile returns the default PKI profile for OpenShift clusters. Currently uses RSA-4096 until all day-2 operators (CKAO, CKMO, etc.) support ECDSA certificate rotation. Once operator support lands, switch to ECDSA P-384 signers and ECDSA P-256 defaults to match the upstream library-go profile: https://github.com/openshift/library-go/blob/12d8376369b7c5b76f688d01089882ca28e351c3/pkg/pki/profile.go#L11-L26

func EffectiveSignerPKIConfig ¶

func EffectiveSignerPKIConfig(ic *types.InstallConfig) *types.PKIConfig

EffectiveSignerPKIConfig returns the effective PKI config for signer certificate generation.

• If ConfigurablePKI feature gate is disabled, returns nil (RSA-2048 legacy path).
• If user specified pki in install-config, returns that config unchanged.
• If pki is nil, returns a PKIConfig derived from DefaultPKIProfile().SignerCertificates.

func ValidateKeyConfig ¶

func ValidateKeyConfig(config types.KeyConfig, fldPath *field.Path) field.ErrorList

ValidateKeyConfig validates the KeyConfig structure.

func ValidatePKIConfig ¶

func ValidatePKIConfig(pkiConfig *types.PKIConfig, fldPath *field.Path) field.ErrorList

ValidatePKIConfig validates the PKI configuration. When pkiConfig is non-nil, signerCertificates must be fully specified.