As part of this Launchpad there are changes that can impact documentation. Let me know if you require further details.

Thanks,

David 

---

Ability to specify custom certificates for the kubernetes root CA

This change allows the administrator to specify the certificate and key for the kubernetes root CA. Additionally the administrator can also provide values to add to the kubernetes apiserver certificate Subject Alternative Name list.

IMPORTANT: The default length for the generated kubernetes root CA certificate is 10 years. Replacing the root CA certificate is an involved process so the custom certificate expiry should be as long as possible. We recommend ensuring root CA certificate has an expiry of at least 5-10 years.

These changes must be made via the ansible bootstrap playbook. Three new optional parameters are provided.

k8s_root_ca_cert

k8s_root_ca_key

apiserver_cert_sans

k8s_root_ca_cert and k8s_root_ca_key must specify the full path to the certificate and key respectively. The root CA certificate must be in PEM format. These two values must be provided as a pair. The playbook will not proceed if only one value is provided.

The apiserver_cert_sans parameter can be used to specify a list of Subject Alternative Name entries that will be added to the kubernetes apiserver certificate. Each entry in the list must be an IP address or domain name.

eg

apiserver_cert_sans:

  - hostname.domain

  - 198.51.100.75

Reviews:

https://review.opendev.org/#/c/671561

https://review.opendev.org/#/c/671559

Launchpad:

https://bugs.launchpad.net/starlingx/+bug/1837079