Thanks David. We’ll discuss this in our upcoming docs meeting and will get back to you if we have further questions. -- Mike From: Sullivan, David <David.Sullivan@windriver.com> Sent: Friday, August 2, 2019 1:37 PM To: starlingx-discuss@lists.starlingx.io; Tullis, Michael L <michael.l.tullis@intel.com> Subject: [DOCS] Ability to specify custom certificates for the kubernetes root CA As part of this Launchpad there are changes that can impact documentation. Let me know if you require further details. Thanks, David --- Ability to specify custom certificates for the kubernetes root CA This change allows the administrator to specify the certificate and key for the kubernetes root CA. Additionally the administrator can also provide values to add to the kubernetes apiserver certificate Subject Alternative Name list. IMPORTANT: The default length for the generated kubernetes root CA certificate is 10 years. Replacing the root CA certificate is an involved process so the custom certificate expiry should be as long as possible. We recommend ensuring root CA certificate has an expiry of at least 5-10 years. These changes must be made via the ansible bootstrap playbook. Three new optional parameters are provided. k8s_root_ca_cert k8s_root_ca_key apiserver_cert_sans k8s_root_ca_cert and k8s_root_ca_key must specify the full path to the certificate and key respectively. The root CA certificate must be in PEM format. These two values must be provided as a pair. The playbook will not proceed if only one value is provided. The apiserver_cert_sans parameter can be used to specify a list of Subject Alternative Name entries that will be added to the kubernetes apiserver certificate. Each entry in the list must be an IP address or domain name. eg apiserver_cert_sans: - hostname.domain - 198.51.100.75 Reviews: https://review.opendev.org/#/c/671561 https://review.opendev.org/#/c/671559 Launchpad: https://bugs.launchpad.net/starlingx/+bug/1837079