Yes in localhost.yaml.

https://docs.starlingx.io/deploy_install_guides/r5_release/ansible_bootstrap_configs.html#kubernetes-root-ca-certificate-and-key

Greg.

From: "Dharwadkar, Sriram" <Sriram.Dharwadkar@commscope.com>
Date: Thursday, February 4, 2021 at 7:08 AM
To: Greg Waines <Greg.Waines@windriver.com>, "starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io>, "Rai, Ankush" <Ankush.Rai@commscope.com>
Subject: RE: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0

[Please note: This e-mail is from an EXTERNAL e-mail address]

Hi Greg,

Thanks for the reply.

Another question on the same topic.

For k8s_root_ca_cert and k8s_root_ca_key, instead of giving self signed certificate and key, is it possible to give the key and certificate signed by a third party CA.

If yes, how to give third party CA certificate as an input to installation (in localhost.yaml?).

Regards,
Sriram

From: Waines, Greg <Greg.Waines@windriver.com>
Sent: Friday, January 29, 2021 6:38 PM
To: Dharwadkar, Sriram <Sriram.Dharwadkar@commscope.com>; starlingx-discuss@lists.starlingx.io
Subject: Re: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0

The upstream procedure is here:

https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/

Greg.

From: "Dharwadkar, Sriram" <Sriram.Dharwadkar@commscope.com>
Date: Friday, January 29, 2021 at 6:20 AM
To: "starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io>
Subject: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0

[Please note: This e-mail is from an EXTERNAL e-mail address]

Hi,

We are using Distributed StarlingX-4.0.

As per the documentation https://docs.starlingx.io/deploy_install_guides/r4_release/ansible_bootstrap_configs.html

k8s_root_ca_cert and k8s_root_ca_key are install time only parameters. Documentation says updating k8s_root_ca_cert and k8s_root_ca_key is an involved process.

Can you please share the procedure for updating root_ca and root_key ?

We have a usecase to update this cert and key during runtime, with reboot it should take new root_ca and root_key, is this possible ?

Regards,
Sriram