Skip to content

[Bug] openshift-service-ca.crt ConfigMap not filtered during transform #27

Closed
Bug
Closed
[Bug] openshift-service-ca.crt ConfigMap not filtered during transform#27
Bug
Assignees
aufi
Labels
kind/bugCategorizes issue or PR as related to a bug.needs-priorityneeds-triageIndicates an issue or PR lacks a `triage/foo` label and requires one.

Description

@midays
midays
opened on Jun 8, 2026

Summary

crane export captures the openshift-service-ca.crt ConfigMap and
OpenShiftPlugin does not filter it out during transform. This ConfigMap
is OCP-managed, auto-created and populated by the service-ca operator
in every namespace. it is never created by the user.

Expected Behavior

openshift-service-ca.crt should be filtered out by OpenShiftPlugin
since it is OCP-specific, cluster-specific, and automatically recreated
by the target cluster's service-ca operator. This is analogous to how
KubernetesPlugin filters kube-root-ca.crt.

Actual Behavior

openshift-service-ca.crt passes through transform and appears in the
final output manifest, ready to be applied to the target cluster.

Risk

  • The cert data is injected at runtime via annotation
    (service.beta.openshift.io/inject-cabundle), so in most cases the
    exported ConfigMap is empty and applying it is harmless today
  • However if the ConfigMap carries data, applying it to the target would
    overwrite the target cluster's own service CA cert in that namespace,
    potentially breaking TLS for any workload relying on it for internal
    service communication

Steps to Reproduce

  1. Create a namespace on an OCP source cluster
  2. Run crane export
  3. Run crane transform (without OpenShiftPlugin stage — KubernetesPlugin only)
  4. Check output: openshift-service-ca.crt ConfigMap is present

Proposed Fix

Add openshift-service-ca.crt to the OpenShiftPlugin filter list.

Activity

  1. midays
    added this to Crane Developmenton Jun 8, 2026
  2. midays
    added the
    Bug
    issue type on Jun 8, 2026
  3. midays
    added
    kind/bugCategorizes issue or PR as related to a bug.
    on Jun 8, 2026
  4. github-project-automation
    moved this to Todo in Crane Developmenton Jun 8, 2026
  5. github-actions
    added
    needs-triageIndicates an issue or PR lacks a `triage/foo` label and requires one.
    on Jun 8, 2026

  6. github-actions commented on Jun 8, 2026

    @github-actions
    github-actionsBot
    on Jun 8, 2026 – with GitHub Actions

    This issue is currently awaiting triage.
    If contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.
    The triage/accepted label can be added by org members by writing /triage accepted in a comment.

  7. github-actions
    added
    needs-priority
    on Jun 8, 2026
  8. aufi
    added
    triage/acceptedIndicates an issue or PR is ready to be actively worked on.
    on Jun 11, 2026
  9. github-actions
    removed
    needs-triageIndicates an issue or PR lacks a `triage/foo` label and requires one.
    on Jun 11, 2026
  10. aufi
    added
    priority/majorImportant over the long term, but may not be staffed and/or may need multiple releases to complete.
    on Jun 11, 2026
  11. github-actions
    removed
    needs-priority
    on Jun 11, 2026

  12. aufi commented on Jun 12, 2026

    @aufi
    aufi
    on Jun 12, 2026
    Contributor

    Similar with #23

  13. istein1
    removed
    triage/acceptedIndicates an issue or PR is ready to be actively worked on.
    on Jun 12, 2026
  14. github-actions
    added
    needs-triageIndicates an issue or PR lacks a `triage/foo` label and requires one.
    on Jun 12, 2026
  15. istein1
    removed
    priority/majorImportant over the long term, but may not be staffed and/or may need multiple releases to complete.
    on Jun 12, 2026
  16. github-actions
    added
    needs-priority
    on Jun 12, 2026
  17. aufi
    self-assigned this
    on Jun 17, 2026
  18. aufi
    moved this from Todo to In progress in Crane Developmenton Jun 18, 2026
  19. aufi
    moved this from In progress to In review in Crane Developmenton Jun 18, 2026

  20. aufi commented on Jun 19, 2026

    @aufi
    aufi
    on Jun 19, 2026
    Contributor

    This issue looks to be caused by missing OpenShiftPlugin during the test, please re-test using tool based on crane-mta or install upstream OpenShift plugin for crane ($ crane plugin-manager add OpenShiftPlugin).

    Anyway added a PR for openshift plugin with a test checking those resources are removed: #32

  21. midays commented on Jun 22, 2026

    @midays
    midays
    on Jun 22, 2026
    Author

    issue already mentioned in #23

  22. midays
    closed this as completedon Jun 22, 2026
  23. github-project-automation
    moved this from In review to Done in Crane Developmenton Jun 22, 2026
  24. midays
    moved this from Done to No status in Crane Developmenton Jun 22, 2026
  25. stillalearner
    added a commit that references this issue on Jun 22, 2026

    Add tests for openshift-service-ce whiteout

    9a35878

  26. aufi commented on Jun 29, 2026

    @aufi
    aufi
    on Jun 29, 2026
    Contributor

    Fixed as part of #23

  27. aufi
    moved this to Done in Crane Developmenton Jun 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

kind/bugCategorizes issue or PR as related to a bug.needs-priorityneeds-triageIndicates an issue or PR lacks a `triage/foo` label and requires one.

Type

Bug

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions