[Starlingx-discuss] [DOCS] Ability to specify custom certificates for the kubernetes root CA

Tullis, Michael L michael.l.tullis at intel.com
Fri Aug 2 19:41:25 UTC 2019


Thanks David.

We’ll discuss this in our upcoming docs meeting and will get back to you if we have further questions.

-- Mike

From: Sullivan, David <David.Sullivan at windriver.com>
Sent: Friday, August 2, 2019 1:37 PM
To: starlingx-discuss at lists.starlingx.io; Tullis, Michael L <michael.l.tullis at intel.com>
Subject: [DOCS] Ability to specify custom certificates for the kubernetes root CA

As part of this Launchpad there are changes that can impact documentation. Let me know if you require further details.

Thanks,

David

---
Ability to specify custom certificates for the kubernetes root CA


This change allows the administrator to specify the certificate and key for the kubernetes root CA. Additionally the administrator can also provide values to add to the kubernetes apiserver certificate Subject Alternative Name list.

IMPORTANT: The default length for the generated kubernetes root CA certificate is 10 years. Replacing the root CA certificate is an involved process so the custom certificate expiry should be as long as possible. We recommend ensuring root CA certificate has an expiry of at least 5-10 years.


These changes must be made via the ansible bootstrap playbook. Three new optional parameters are provided.
k8s_root_ca_cert
k8s_root_ca_key
apiserver_cert_sans

k8s_root_ca_cert and k8s_root_ca_key must specify the full path to the certificate and key respectively. The root CA certificate must be in PEM format. These two values must be provided as a pair. The playbook will not proceed if only one value is provided.

The apiserver_cert_sans parameter can be used to specify a list of Subject Alternative Name entries that will be added to the kubernetes apiserver certificate. Each entry in the list must be an IP address or domain name.
eg
apiserver_cert_sans:
  - hostname.domain
  - 198.51.100.75

Reviews:
https://review.opendev.org/#/c/671561
https://review.opendev.org/#/c/671559

Launchpad:
https://bugs.launchpad.net/starlingx/+bug/1837079
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20190802/95d72f53/attachment.html>


More information about the Starlingx-discuss mailing list