This is a cache of https://docs.openshift.com/container-platform/4.10/security/certificate_types_descriptions/machine-config-operator-certificates.html. It is a snapshot of the page at 2024-11-25T16:20:21.382+0000.
Machine Config Operator certificates - Certificate types and descriptions | Security and compliance | OpenShift Container Platform 4.10
    OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history
×

Machine Config Operator certificates

Purpose

Machine Config Operator certificates are used to secure connections between the Red Hat Enterprise Linux CoreOS (RHCOS) nodes and the Machine Config Server.

Currently, there is no supported way to block or restrict the machine config server endpoint. The machine config server must be exposed to the network so that newly-provisioned machines, which have no existing configuration or state, are able to fetch their configuration. In this model, the root of trust is the certificate signing requests (CSR) endpoint, which is where the kubelet sends its certificate signing request for approval to join the cluster. Because of this, machine configs should not be used to distribute sensitive information, such as secrets and certificates.

To ensure that the machine config server endpoints, ports 22623 and 22624, are secured in bare metal scenarios, customers must configure proper network policies.
Additional resources

Management

These certificates are managed by the system and not the user.

Expiration

This CA is valid for 10 years.

The issued serving certificates are valid for 10 years.

Customization

You cannot customize the Machine Config Operator certificates.