Skip to content

feat: Handle how GridSite Trust Fingerprint Uses non-Colon-Separated Hex #34

Description

@mvazquezc

Problem:
The GridSite.spec.trust.certFingerprint field expects colon-separated hex (ab:cd:ef:...), not plain hex (abcdef...). The operator computes the fingerprint as:

digest.iter().map(|b| format!("{b:02x}")).collect::<Vec<_>>().join(":")

The fingerprint is a SHA-256 hash of the trimmed PEM string bytes (not DER). Using openssl x509 -fingerprint or sha256sum without
colon formatting produces a mismatch, and the site stays in Connecting with TrustPolicyMismatch.

Workaround: Compute fingerprints using the PEM from publicCertPem in the GridSite status, with colon-separated output:

CERT_PEM=$(oc get gridsite <name> -o jsonpath='{.status.publicCertPem}')
echo -n "$CERT_PEM" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' |  sha256sum | awk '{print $1}' | sed 's/\(..\)/\1:/g;s/:$//'

Proposed fix:
Document the fingerprint format in the CRD description. Consider also accepting plain hex (without colons) and normalizing internally.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions