Skip to content

Feature Request: Handle how GridSite Trust Fingerprint Uses non-Colon-Separated Hex #134

Description

@mvazquezc

Problem:
The GridSite.spec.trust.certFingerprint field expects colon-separated hex (ab:cd:ef:...), not plain hex (abcdef...). The operator computes the fingerprint as:

digest.iter().map(|b| format!("{b:02x}")).collect::<Vec<_>>().join(":")

The fingerprint is a SHA-256 hash of the trimmed PEM string bytes (not DER). Using openssl x509 -fingerprint or sha256sum without
colon formatting produces a mismatch, and the site stays in Connecting with TrustPolicyMismatch.

Workaround: Compute fingerprints using the PEM from publicCertPem in the GridSite status, with colon-separated output:

CERT_PEM=$(oc get gridsite <name> -o jsonpath='{.status.publicCertPem}')
echo -n "$CERT_PEM" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' |  sha256sum | awk '{print $1}' | sed 's/\(..\)/\1:/g;s/:$//'

Proposal:
Document the fingerprint format in the CRD description. Consider also accepting plain hex (without colons) and normalizing internally.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions