<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-CA" link="#0563C1" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Yes in localhost.yaml.<o:p></o:p></p>
<p class="MsoNormal"><a href="https://docs.starlingx.io/deploy_install_guides/r5_release/ansible_bootstrap_configs.html#kubernetes-root-ca-certificate-and-key">https://docs.starlingx.io/deploy_install_guides/r5_release/ansible_bootstrap_configs.html#kubernetes-root-ca-certificate-and-key</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Greg.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">"Dharwadkar, Sriram" <Sriram.Dharwadkar@commscope.com><br>
<b>Date: </b>Thursday, February 4, 2021 at 7:08 AM<br>
<b>To: </b>Greg Waines <Greg.Waines@windriver.com>, "starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io>, "Rai, Ankush" <Ankush.Rai@commscope.com><br>
<b>Subject: </b>RE: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div style="border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FFEB9C"><span style="font-size:10.0pt;color:red">[Please note: This e-mail is from an EXTERNAL e-mail address]</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Hi Greg,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Thanks for the reply. <o:p></o:p></p>
<p class="MsoNormal">Another question on the same topic.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">For k8s_root_ca_cert and k8s_root_ca_key, instead of giving self signed certificate and key, is it possible to give the key and certificate signed by a third party CA.<o:p></o:p></p>
<p class="MsoNormal">If yes, how to give third party CA certificate as an input to installation (in localhost.yaml?).
<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Regards,<br>
Sriram<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Waines, Greg <Greg.Waines@windriver.com> <br>
<b>Sent:</b> Friday, January 29, 2021 6:38 PM<br>
<b>To:</b> Dharwadkar, Sriram <Sriram.Dharwadkar@commscope.com>; starlingx-discuss@lists.starlingx.io<br>
<b>Subject:</b> Re: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal">The upstream procedure is here:<o:p></o:p></p>
<p class="MsoNormal"><a href="https://secure-web.cisco.com/15ZBoH5PpMvXnW-SATwdQYI0x1GwsBhyhNUBpTV3et1-kCxfh00VJ3vckWRaWpyeJgTcx6fp2a2aZexK0-ZS8ODqy-i0wTOn_byb_6ftp99pqnfZl5gac4w15zuLH2OYIQFibe9T2gm914JH7O7sKA4SZoGAudctTXQ0udtUAbt6pGtLlVye0cxq5i5vr2V5hD8m5edueFqqfAsPBteu8HIxIBBYjhVdyYrPDe-vgT1lsVOlG5IJtR_1qa5eu8CD1SJS4fn0LmCjuLatos2BP21A0HiYRbzwdgQRyoJRI97WDTyD1V0nhS5JJJyNGR1eRKJV2XJrw329J8Yg0XSMwuw/https%3A%2F%2Fkubernetes.io%2Fdocs%2Ftasks%2Ftls%2Fmanual-rotation-of-ca-certificates%2F">https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/</a><o:p></o:p></p>
<p class="MsoNormal">Greg.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">"Dharwadkar, Sriram" <<a href="mailto:Sriram.Dharwadkar@commscope.com">Sriram.Dharwadkar@commscope.com</a>><br>
<b>Date: </b>Friday, January 29, 2021 at 6:20 AM<br>
<b>To: </b>"<a href="mailto:starlingx-discuss@lists.starlingx.io">starlingx-discuss@lists.starlingx.io</a>" <<a href="mailto:starlingx-discuss@lists.starlingx.io">starlingx-discuss@lists.starlingx.io</a>><br>
<b>Subject: </b>[Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div style="border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FFEB9C"><span style="font-size:10.0pt;color:red">[Please note: This e-mail is from an EXTERNAL e-mail address]</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">We are using Distributed StarlingX-4.0. <o:p></o:p></p>
<p class="MsoNormal">As per the documentation <a href="https://secure-web.cisco.com/10vZAKmYtKxfibvJnzHyVAgy5gTU2MPWcU9eJmJ4g_qEuBWaly5LHoGdKfZmYV3LRTOo0m39k7aZLlknweajeKdG-uNxdt4Jljgk4xc8Psam9_JZcUBx8-7CThKDZWGLEyNyFqXKTLrkZbB0_dlZ4U3n7qWSdN5HBSq9c5tkr9I3jbKWx60EUk8ncMXCGx-fApyymYAjOSHwLR59_FwTcvmdqTxmL68YWUHSGBxjtzMjUmgPjn8lg0dE1G1gVpFZ6UJ6LT_fFd5tNXHN2ncTyCG40QtDJrf_rnQJBGRPdKqqGDs1D3RGqqYOgAbpcoDj5/https%3A%2F%2Fdocs.starlingx.io%2Fdeploy_install_guides%2Fr4_release%2Fansible_bootstrap_configs.html">
https://docs.starlingx.io/deploy_install_guides/r4_release/ansible_bootstrap_configs.html</a><o:p></o:p></p>
<p class="MsoNormal">k8s_root_ca_cert and k8s_root_ca_key are install time only parameters. Documentation says updating k8s_root_ca_cert and k8s_root_ca_key is an involved process.<o:p></o:p></p>
<p class="MsoNormal">Can you please share the procedure for updating root_ca and root_key ?<o:p></o:p></p>
<p class="MsoNormal">We have a usecase to update this cert and key during runtime, with reboot it should take new root_ca and root_key, is this possible ?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Regards,<br>
Sriram<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>