okd 4.9.0-0.okd-2022-01-29-035536 certificate is valid for api-int not oauth-openshift.apps

[adynetro]

I've installed okd 4.9.0-0.okd-2022-01-29-035536 on proxmox using coreos 34.20210626.3.1 image. All went fine but oauth co went degraded due an invalid certificate which does not include dns entry for oauth-openshiftt.apps.*

NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE MESSAGE
authentication 4.9.0-0.okd-2022-01-29-035536 False False True 65m OAuthServerRouteEndpointAccessibleControllerAvailable: Get "https://oauth-openshift.apps.okd.dorneean.wan/healthz": x509: certificate is valid for api-int.okd.dorneean.wan, not oauth-openshift.apps.okd.dorneean.wan
baremetal 4.9.0-0.okd-2022-01-29-035536 True False False 62m
cloud-controller-manager 4.9.0-0.okd-2022-01-29-035536 True False False 67m
cloud-credential 4.9.0-0.okd-2022-01-29-035536 True False False 69m
cluster-autoscaler 4.9.0-0.okd-2022-01-29-035536 True False False 64m
config-operator 4.9.0-0.okd-2022-01-29-035536 True False False 66m
console 4.9.0-0.okd-2022-01-29-035536 False True False 56m DeploymentAvailable: 0 replicas available for console deployment...
csi-snapshot-controller 4.9.0-0.okd-2022-01-29-035536 True False False 64m
dns 4.9.0-0.okd-2022-01-29-035536 True False False 62m
etcd 4.9.0-0.okd-2022-01-29-035536 True False False 62m
image-registry 4.9.0-0.okd-2022-01-29-035536 True False False 57m
ingress 4.9.0-0.okd-2022-01-29-035536 True False True 56m The "default" ingress controller reports Degraded=True: DegradedConditions: One or more other status conditions indicate a degraded state: CanaryChecksSucceeding=False (CanaryChecksRepetitiveFailures: Canary route checks for the default ingress controller are failing)
insights 4.9.0-0.okd-2022-01-29-035536 True False False 58m
kube-apiserver 4.9.0-0.okd-2022-01-29-035536 True False False 60m
kube-controller-manager 4.9.0-0.okd-2022-01-29-035536 True False False 62m
kube-scheduler 4.9.0-0.okd-2022-01-29-035536 True False False 61m
kube-storage-version-migrator 4.9.0-0.okd-2022-01-29-035536 True False False 62m
machine-api 4.9.0-0.okd-2022-01-29-035536 True False False 62m
machine-approver 4.9.0-0.okd-2022-01-29-035536 True False False 64m
machine-config 4.9.0-0.okd-2022-01-29-035536 True False False 64m
marketplace 4.9.0-0.okd-2022-01-29-035536 True False False 64m
monitoring 4.9.0-0.okd-2022-01-29-035536 True False False 54m
network 4.9.0-0.okd-2022-01-29-035536 True False False 62m
node-tuning 4.9.0-0.okd-2022-01-29-035536 True False False 62m
openshift-apiserver 4.9.0-0.okd-2022-01-29-035536 True False False 57m
openshift-controller-manager 4.9.0-0.okd-2022-01-29-035536 True False False 61m
openshift-samples 4.9.0-0.okd-2022-01-29-035536 True False False 57m
operator-lifecycle-manager 4.9.0-0.okd-2022-01-29-035536 True False False 62m
operator-lifecycle-manager-catalog 4.9.0-0.okd-2022-01-29-035536 True False False 62m
operator-lifecycle-manager-packageserver 4.9.0-0.okd-2022-01-29-035536 True False False 57m
service-ca 4.9.0-0.okd-2022-01-29-035536 True False False 65m
storage 4.9.0-0.okd-2022-01-29-035536 True False False 65m

[vrutkovs]

Since its not an IPI install you should make sure that LB handles certificates correctly, including *.apps.okd.dorneean.wan

[adynetro]

there is no config for certificates in lb. The config is made accordingly to the documentation for okd / openshift install

frontend okd4_http_ingress_traffic_fe
bind :80
default_backend okd4_http_ingress_traffic_be
mode tcp
option tcplog

backend okd4_http_ingress_traffic_be
balance source
mode tcp
server okd4-master-1 10.10.10.50:22623 check
server okd4-master-2 10.10.10.51:22623 check
server okd4-master-3 10.10.10.52:22623 check

frontend okd4_https_ingress_traffic_fe
bind *:443
default_backend okd4_https_ingress_traffic_be
mode tcp
option tcplog

backend okd4_https_ingress_traffic_be
balance source
mode tcp
server okd4-master-1 10.10.10.50:22623 check
server okd4-master-2 10.10.10.51:22623 check
server okd4-master-3 10.10.10.52:22623 check

[adynetro]

Still having the issue, double checked the docs. I can sign a certificate for the loadbalancer and add it to the authority to the cluster with additionalTrustBundle ?