[Starlingx-discuss] [DOCS] Ability to add trusted CA certificate

[Tullis, Michael L]

Thanks David. We'll address this in our docs meeting tomorrow and will get back to you if we have questions.

-- Mike
________________________________
From: Sullivan, David [David.Sullivan at windriver.com]
Sent: Tuesday, June 25, 2019 10:15 AM
To: starlingx-discuss at lists.starlingx.io; Tullis, Michael L
Subject: [DOCS] Ability to add trusted CA certificate

As part of this Launchpad there are changes that can impact documentation. Let me know if you require further details.


---

Ability to add trusted CA


This change allows the administrator to install a trusted CA certificate to the system. A trusted CA certificate will be required if the end user configures a private docker registry that is signed by an unknown Certificate Authority. The provided certificate must be in PEM format.

There are two ways to add the trusted CA certificate.
1) Using the CLI
system certificate-install -m ssl_ca <path_to_certificate>

This will install the certificate on all hosts. New configurations are applied to the hosts to install the certificates. 250.001 (Host Configuration is out-of-date) alarms are raised for those nodes and are cleared as the new configurations are applied.

Sample output:
system certificate-install -m ssl_ca domain.crt
WARNING: For security reasons, the original certificate,
containing the private key, will be removed,
once the private key is processed.
+-------------+--------------------------------------+
| Property    | Value                                |
+-------------+--------------------------------------+
| uuid        | c986249f-b304-4ab4-b88e-14f92e75269d |
| certtype    | ssl_ca                               |
| signature   | ssl_ca_14617336624230451058          |
| start_date  | 2019-05-22 18:24:41+00:00            |
| expiry_date | 2020-05-21 18:24:41+00:00            |
+-------------+--------------------------------------+

2) Using the ansible bootstrap playbook
A new optional variable is supported by the bootstrap playbook: ssl_ca_cert. The value of this variable is the full path to the certificate.
eg
ssl_ca_cert: /path/to/ssl_ca_cert_file
When this variable is provided the playbook will install the CA certificate. At this time installing the ssl_ca_cert is not supported during bootstrap replay.


Reviews:
https://review.opendev.org/#/c/663797/
https://review.opendev.org/#/c/665298/
https://review.opendev.org/#/c/665986/

Launchpad:
https://bugs.launchpad.net/starlingx/+bug/1831946
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20190625/af116027/attachment.html>