Use ECDSA P-256 private keys for cert-manager certificates

fmount · claude · fmount · commit 62715b26f998 · 2026-07-07T09:19:21.000+02:00
Switch all cert-manager Certificate resources from the default RSA
algorithm to ECDSA P-256. This applies to webhook serving certs,
metrics server certs, and all operator bindata certificates. The
sync-bindata.sh script is updated accordingly.

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
Signed-off-by: Francesco Pantano &lt;fpantano@redhat.com&gt;
diff --git a/bindata/operator/infra-operator-webhooks.yaml b/bindata/operator/infra-operator-webhooks.yaml
@@ -37,6 +37,9 @@ spec:
   issuerRef:
     kind: Issuer
     name: infra-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: infra-operator-webhook-server-cert
 ---
 apiVersion: admissionregistration.k8s.io/v1
diff --git a/bindata/operator/openstack-baremetal-operator-webhooks.yaml b/bindata/operator/openstack-baremetal-operator-webhooks.yaml
@@ -37,6 +37,9 @@ spec:
   issuerRef:
     kind: Issuer
     name: openstack-baremetal-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: openstack-baremetal-operator-webhook-server-cert
 ---
 apiVersion: admissionregistration.k8s.io/v1
diff --git a/bindata/operator/operator.yaml b/bindata/operator/operator.yaml
@@ -157,6 +157,9 @@ spec:
   issuerRef:
     kind: Issuer
     name: openstack-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: metrics-server-cert
 ---
 apiVersion: cert-manager.io/v1
@@ -174,6 +177,9 @@ spec:
   issuerRef:
     kind: Issuer
     name: openstack-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: webhook-server-cert
 ---
 apiVersion: cert-manager.io/v1
diff --git a/bindata/rbac/barbican-operator-rbac.yaml b/bindata/rbac/barbican-operator-rbac.yaml
@@ -359,4 +359,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: barbican-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: barbican-operator-metrics-server-cert
diff --git a/bindata/rbac/cinder-operator-rbac.yaml b/bindata/rbac/cinder-operator-rbac.yaml
@@ -372,4 +372,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: cinder-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: cinder-operator-metrics-server-cert
diff --git a/bindata/rbac/designate-operator-rbac.yaml b/bindata/rbac/designate-operator-rbac.yaml
@@ -422,4 +422,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: designate-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: designate-operator-metrics-server-cert
diff --git a/bindata/rbac/glance-operator-rbac.yaml b/bindata/rbac/glance-operator-rbac.yaml
@@ -388,4 +388,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: glance-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: glance-operator-metrics-server-cert
diff --git a/bindata/rbac/heat-operator-rbac.yaml b/bindata/rbac/heat-operator-rbac.yaml
@@ -361,4 +361,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: heat-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: heat-operator-metrics-server-cert
diff --git a/bindata/rbac/horizon-operator-rbac.yaml b/bindata/rbac/horizon-operator-rbac.yaml
@@ -312,4 +312,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: horizon-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: horizon-operator-metrics-server-cert
diff --git a/bindata/rbac/infra-operator-rbac.yaml b/bindata/rbac/infra-operator-rbac.yaml
@@ -539,4 +539,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: infra-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: infra-operator-metrics-server-cert
diff --git a/bindata/rbac/ironic-operator-rbac.yaml b/bindata/rbac/ironic-operator-rbac.yaml
@@ -385,4 +385,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: ironic-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: ironic-operator-metrics-server-cert
diff --git a/bindata/rbac/keystone-operator-rbac.yaml b/bindata/rbac/keystone-operator-rbac.yaml
@@ -395,4 +395,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: keystone-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: keystone-operator-metrics-server-cert
diff --git a/bindata/rbac/manila-operator-rbac.yaml b/bindata/rbac/manila-operator-rbac.yaml
@@ -371,4 +371,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: manila-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: manila-operator-metrics-server-cert
diff --git a/bindata/rbac/mariadb-operator-rbac.yaml b/bindata/rbac/mariadb-operator-rbac.yaml
@@ -333,4 +333,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: mariadb-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: mariadb-operator-metrics-server-cert
diff --git a/bindata/rbac/neutron-operator-rbac.yaml b/bindata/rbac/neutron-operator-rbac.yaml
@@ -366,4 +366,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: neutron-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: neutron-operator-metrics-server-cert
diff --git a/bindata/rbac/nova-operator-rbac.yaml b/bindata/rbac/nova-operator-rbac.yaml
@@ -431,4 +431,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: nova-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: nova-operator-metrics-server-cert
diff --git a/bindata/rbac/octavia-operator-rbac.yaml b/bindata/rbac/octavia-operator-rbac.yaml
@@ -416,4 +416,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: octavia-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: octavia-operator-metrics-server-cert
diff --git a/bindata/rbac/openstack-baremetal-operator-rbac.yaml b/bindata/rbac/openstack-baremetal-operator-rbac.yaml
@@ -328,4 +328,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: openstack-baremetal-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: openstack-baremetal-operator-metrics-server-cert
diff --git a/bindata/rbac/ovn-operator-rbac.yaml b/bindata/rbac/ovn-operator-rbac.yaml
@@ -355,4 +355,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: ovn-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: ovn-operator-metrics-server-cert
diff --git a/bindata/rbac/swift-operator-rbac.yaml b/bindata/rbac/swift-operator-rbac.yaml
@@ -417,4 +417,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: swift-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: swift-operator-metrics-server-cert
diff --git a/bindata/rbac/telemetry-operator-rbac.yaml b/bindata/rbac/telemetry-operator-rbac.yaml
@@ -555,4 +555,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: telemetry-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: telemetry-operator-metrics-server-cert
diff --git a/bindata/rbac/test-operator-rbac.yaml b/bindata/rbac/test-operator-rbac.yaml
@@ -261,4 +261,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: test-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: test-operator-metrics-server-cert
diff --git a/bindata/rbac/watcher-operator-rbac.yaml b/bindata/rbac/watcher-operator-rbac.yaml
@@ -387,4 +387,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: watcher-operator-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: watcher-operator-metrics-server-cert
diff --git a/config/certmanager/certificate-metrics.yaml b/config/certmanager/certificate-metrics.yaml
@@ -17,4 +17,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: metrics-server-cert
diff --git a/config/certmanager/certificate-webhook.yaml b/config/certmanager/certificate-webhook.yaml
@@ -17,4 +17,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: webhook-server-cert
diff --git a/hack/sync-bindata.sh b/hack/sync-bindata.sh
@@ -87,6 +87,9 @@ spec:
   issuerRef:
     kind: Issuer
     name: $OPERATOR_NAME-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: $OPERATOR_NAME-webhook-server-cert
 ---
 apiVersion: admissionregistration.k8s.io/v1
@@ -341,6 +344,9 @@ spec:
   issuerRef:
     kind: Issuer
     name: $OPERATOR_NAME-selfsigned-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   secretName: $OPERATOR_NAME-metrics-server-cert
 EOF_CAT
 
