Re: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0
The upstream procedure is here: https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/ Greg. From: "Dharwadkar, Sriram" <Sriram.Dharwadkar@commscope.com> Date: Friday, January 29, 2021 at 6:20 AM To: "starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io> Subject: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0 [Please note: This e-mail is from an EXTERNAL e-mail address] Hi, We are using Distributed StarlingX-4.0. As per the documentation https://docs.starlingx.io/deploy_install_guides/r4_release/ansible_bootstrap... k8s_root_ca_cert and k8s_root_ca_key are install time only parameters. Documentation says updating k8s_root_ca_cert and k8s_root_ca_key is an involved process. Can you please share the procedure for updating root_ca and root_key ? We have a usecase to update this cert and key during runtime, with reboot it should take new root_ca and root_key, is this possible ? Regards, Sriram
Hi Greg, Thanks for the reply. Another question on the same topic. For k8s_root_ca_cert and k8s_root_ca_key, instead of giving self signed certificate and key, is it possible to give the key and certificate signed by a third party CA. If yes, how to give third party CA certificate as an input to installation (in localhost.yaml?). Regards, Sriram From: Waines, Greg <Greg.Waines@windriver.com> Sent: Friday, January 29, 2021 6:38 PM To: Dharwadkar, Sriram <Sriram.Dharwadkar@commscope.com>; starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0 The upstream procedure is here: https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/ Greg. External (greg.waines@windriver.com<mailto:greg.waines@windriver.com>) Report This Email<https://shared.outlook.inky.com/report?id=Y29tbXNjb3BlL3NyaXJhbS5kaGFyd2Fka2FyQGNvbW1zY29wZS5jb20vOTk0ZjQ4NWNmMThhMGE0ZDAzMDBlYzkyY2ExMGY3YTYvMTYxMTkyNTcwMC43Nw==#key=b948afc2a92dda0195916177b98d6a83> FAQ<https://www.inky.com/banner-faq/> Protection by INKY<https://www.inky.com> The upstream procedure is here: https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/<https://secure-web.cisco.com/15ZBoH5PpMvXnW-SATwdQYI0x1GwsBhyhNUBpTV3et1-kCxfh00VJ3vckWRaWpyeJgTcx6fp2a2aZexK0-ZS8ODqy-i0wTOn_byb_6ftp99pqnfZl5gac4w15zuLH2OYIQFibe9T2gm914JH7O7sKA4SZoGAudctTXQ0udtUAbt6pGtLlVye0cxq5i5vr2V5hD8m5edueFqqfAsPBteu8HIxIBBYjhVdyYrPDe-vgT1lsVOlG5IJtR_1qa5eu8CD1SJS4fn0LmCjuLatos2BP21A0HiYRbzwdgQRyoJRI97WDTyD1V0nhS5JJJyNGR1eRKJV2XJrw329J8Yg0XSMwuw/https%3A%2F%2Fkubernetes.io%2Fdocs%2Ftasks%2Ftls%2Fmanual-rotation-of-ca-certificates%2F> Greg. From: "Dharwadkar, Sriram" <Sriram.Dharwadkar@commscope.com<mailto:Sriram.Dharwadkar@commscope.com>> Date: Friday, January 29, 2021 at 6:20 AM To: "starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io>" <starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io>> Subject: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0 [Please note: This e-mail is from an EXTERNAL e-mail address] Hi, We are using Distributed StarlingX-4.0. As per the documentation https://docs.starlingx.io/deploy_install_guides/r4_release/ansible_bootstrap_configs.html<https://secure-web.cisco.com/10vZAKmYtKxfibvJnzHyVAgy5gTU2MPWcU9eJmJ4g_qEuBWaly5LHoGdKfZmYV3LRTOo0m39k7aZLlknweajeKdG-uNxdt4Jljgk4xc8Psam9_JZcUBx8-7CThKDZWGLEyNyFqXKTLrkZbB0_dlZ4U3n7qWSdN5HBSq9c5tkr9I3jbKWx60EUk8ncMXCGx-fApyymYAjOSHwLR59_FwTcvmdqTxmL68YWUHSGBxjtzMjUmgPjn8lg0dE1G1gVpFZ6UJ6LT_fFd5tNXHN2ncTyCG40QtDJrf_rnQJBGRPdKqqGDs1D3RGqqYOgAbpcoDj5/https%3A%2F%2Fdocs.starlingx.io%2Fdeploy_install_guides%2Fr4_release%2Fansible_bootstrap_configs.html> k8s_root_ca_cert and k8s_root_ca_key are install time only parameters. Documentation says updating k8s_root_ca_cert and k8s_root_ca_key is an involved process. Can you please share the procedure for updating root_ca and root_key ? We have a usecase to update this cert and key during runtime, with reboot it should take new root_ca and root_key, is this possible ? Regards, Sriram
Yes in localhost.yaml. https://docs.starlingx.io/deploy_install_guides/r5_release/ansible_bootstrap... Greg. From: "Dharwadkar, Sriram" <Sriram.Dharwadkar@commscope.com> Date: Thursday, February 4, 2021 at 7:08 AM To: Greg Waines <Greg.Waines@windriver.com>, "starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io>, "Rai, Ankush" <Ankush.Rai@commscope.com> Subject: RE: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0 [Please note: This e-mail is from an EXTERNAL e-mail address] Hi Greg, Thanks for the reply. Another question on the same topic. For k8s_root_ca_cert and k8s_root_ca_key, instead of giving self signed certificate and key, is it possible to give the key and certificate signed by a third party CA. If yes, how to give third party CA certificate as an input to installation (in localhost.yaml?). Regards, Sriram From: Waines, Greg <Greg.Waines@windriver.com> Sent: Friday, January 29, 2021 6:38 PM To: Dharwadkar, Sriram <Sriram.Dharwadkar@commscope.com>; starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0 The upstream procedure is here: https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/<https://secure-web.cisco.com/15ZBoH5PpMvXnW-SATwdQYI0x1GwsBhyhNUBpTV3et1-kCxfh00VJ3vckWRaWpyeJgTcx6fp2a2aZexK0-ZS8ODqy-i0wTOn_byb_6ftp99pqnfZl5gac4w15zuLH2OYIQFibe9T2gm914JH7O7sKA4SZoGAudctTXQ0udtUAbt6pGtLlVye0cxq5i5vr2V5hD8m5edueFqqfAsPBteu8HIxIBBYjhVdyYrPDe-vgT1lsVOlG5IJtR_1qa5eu8CD1SJS4fn0LmCjuLatos2BP21A0HiYRbzwdgQRyoJRI97WDTyD1V0nhS5JJJyNGR1eRKJV2XJrw329J8Yg0XSMwuw/https%3A%2F%2Fkubernetes.io%2Fdocs%2Ftasks%2Ftls%2Fmanual-rotation-of-ca-certificates%2F> Greg. From: "Dharwadkar, Sriram" <Sriram.Dharwadkar@commscope.com<mailto:Sriram.Dharwadkar@commscope.com>> Date: Friday, January 29, 2021 at 6:20 AM To: "starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io>" <starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io>> Subject: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0 [Please note: This e-mail is from an EXTERNAL e-mail address] Hi, We are using Distributed StarlingX-4.0. As per the documentation https://docs.starlingx.io/deploy_install_guides/r4_release/ansible_bootstrap_configs.html<https://secure-web.cisco.com/10vZAKmYtKxfibvJnzHyVAgy5gTU2MPWcU9eJmJ4g_qEuBWaly5LHoGdKfZmYV3LRTOo0m39k7aZLlknweajeKdG-uNxdt4Jljgk4xc8Psam9_JZcUBx8-7CThKDZWGLEyNyFqXKTLrkZbB0_dlZ4U3n7qWSdN5HBSq9c5tkr9I3jbKWx60EUk8ncMXCGx-fApyymYAjOSHwLR59_FwTcvmdqTxmL68YWUHSGBxjtzMjUmgPjn8lg0dE1G1gVpFZ6UJ6LT_fFd5tNXHN2ncTyCG40QtDJrf_rnQJBGRPdKqqGDs1D3RGqqYOgAbpcoDj5/https%3A%2F%2Fdocs.starlingx.io%2Fdeploy_install_guides%2Fr4_release%2Fansible_bootstrap_configs.html> k8s_root_ca_cert and k8s_root_ca_key are install time only parameters. Documentation says updating k8s_root_ca_cert and k8s_root_ca_key is an involved process. Can you please share the procedure for updating root_ca and root_key ? We have a usecase to update this cert and key during runtime, with reboot it should take new root_ca and root_key, is this possible ? Regards, Sriram
participants (2)
-
Dharwadkar, Sriram
-
Waines, Greg