4d8775ca61
Removed rst substitution from tables and inline markups. Updated table and reestructured sections in the overview. Fixed issues, reworded paragraphs, changed titles. Deleted unnecessary sections, added a new item to section and fixed editorial issues. Fixed editorial and formatting issues. Fixed more editorial and formatting issues. Fixed formatting and editorial issues. Added command line. Fixed command line. Signed-off-by: Elisamara Aoki Goncalves <elisamaraaoki.goncalves@windriver.com> Change-Id: I69874db16c76d5aceac706f2b8033771780500ca
3.9 KiB
Install Custom Kubernetes Root CA Certificate
By default, the K8S Root certificate and key are auto-generated and result in the other Kubernetes certificates being signed by an internal not well-known ; for example, for the Kubernetes API server certificate.
It is optional that you update the Kubernetes Root with a custom Root certificate and key, generated by yourself, and trusted by external servers connecting to the ’s Kubernetes API endpoint
The installation of the custom Kubernetes Root certificate can only be done during system deployment by using bootstrap overrides.
See Create Certificates Locally using openssl
<create-certificates-locally-using-openssl> for how to
create a private Root certificate and key.
Caution
The default duration for the generated Kubernetes Root CA certificate is 10 years. Replacing the Root certificate is a complex process, so the custom certificate expiry should be set for a long period, if possible. recommends setting the Root certificate with an expiry of at least 5-10 years.
The administrator can also provide values to add to the Kubernetes API server certificate Subject Alternative Name list using the apiserver_cert_sans override parameter.
Use the bootstrap override values <k8s_root_ca_cert> and <k8s_root_ca_key>, as part of the installation procedure to specify the certificate and key for the Kubernetes Root .
<k8s_root_ca_cert>
Specifies the certificate for the Kubernetes Root . The <k8s_root_ca_cert> value is the absolute path of the certificate file. The certificate must be in format and the value must be provided as part of a pair with <k8s_root_ca_key>.
<k8s_root_ca_key>
Specifies the key for the Kubernetes Root . The <k8s_root_ca_key> value is the absolute path of the certificate file. The certificate must be in format and the value must be provided as part of a pair with <k8s_root_ca_cert>.
For example:
k8s_root_ca_cert: /home/sysadmin/mystarlingx-k8s-rootca-certificate.pem
k8s_root_ca_key: /home/sysadmin/mystarlingx-k8s-rootca-certificate-key.pemThe playbook will not proceed if only one value is provided.
Caution
The default duration for the generated Kubernetes Root certificate is 10 years. Replacing the Root certificate is an involved process so the custom certificate expiry should be as long as possible. We recommend ensuring Root certificate has an expiry of at least 5-10 years.
The administrator can also provide values to add to the Kubernetes API server certificate Subject Alternative Name list using the <apiserver_cert_sans> override parameter.
apiserver_cert_sans
Specifies a list of Subject Alternative Name entries that will be added to the Kubernetes API server certificate. Each entry in the list must be an IP address or domain name. For example:
apiserver_cert_sans:
- hostname.domain
- 198.51.100.75automatically updates this parameter to include IP records for the floating IP and both unit IP addresses. Any names associated with the floating IP address should be added.
Make the K8S Root certificate available to any remote server wanting
to connect remotely to the 's Kubernetes API, e.g. through
kubectl or Helm. This Kubernetes Root CA certificate should
be configured as a trusted on the remote server.
See the step 2.b
<security-install-kubectl-and-helm-clients-directly-on-a-host>
in Install Kubectl and Helm Clients Directly on a Host.