Dell APEX Cloud Platform for Red Hat OpenShift: Failure to create disconnected HCP-managed clusters due to certificate verification errors

When following the admin guide to create a disconnected HCP-managed cluster, the process may fail. The UI console will display the error "failed to verify certificate: x509: certificate signed by unknown authority."

In a Dell APEX Cloud Platform for Red Hat OpenShift (ACP4OCP) cluster, two registries are required:

1. An internal registry named depot-manager within the ACP4OCP Hub cluster for storing OCP and ACP manager images.
2. An external registry to handle power outages.

The ACP4OCP cluster must trust both registries' certificates, which are stored in a ConfigMap called acp-ingress-ca. This ConfigMap is then set as the additionalTrustedCA for the image.config.openshift.io resource.

However, during the HCP-managed cluster setup, the ACP4OCP's hypershift component creates its own trustedCA based on the image.config.openshift.io resource's settings. It uses this to verify the OpenShift Container Platform (OCP) release image. If the additionalTrustedCA configuration includes two certificates and uses "|-" as the delimiter, hypershift does not add a line break after the first certificate. This causes both certificates to be considered invalid.

In YAML syntax, both "|-" and "|" are valid delimiters, which are used to represent multiline string values. When creating or modifying a "key/value" ConfigMap from the OCP web console, "|-" will be used as the default delimiter.

To check if the Configmap contains "|-" as the delimiter, run the following command on the ACP manager:

• oc get configmap -n openshift-config acp-ingress-ca -o yaml

For example:

To change the delimiter between the certificate name and the certificate key from "|-" to "|", perform the following steps:

1. Run "oc edit configmap -n openshift-config acp-ingress-ca" on the ACP manager, change "|-" to "|", and save the changes in the Configmap.
2. Restart the hypershift component pods with command "oc delete pod -n hypershift --all".
3. After hypershift pods are ready, retry the HCP-managed cluster setup.