[Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0

[Waines, Greg]

Yes in localhost.yaml.
https://docs.starlingx.io/deploy_install_guides/r5_release/ansible_bootstrap_configs.html#kubernetes-root-ca-certificate-and-key

Greg.

From: "Dharwadkar, Sriram" <Sriram.Dharwadkar at commscope.com>
Date: Thursday, February 4, 2021 at 7:08 AM
To: Greg Waines <Greg.Waines at windriver.com>, "starlingx-discuss at lists.starlingx.io" <starlingx-discuss at lists.starlingx.io>, "Rai, Ankush" <Ankush.Rai at commscope.com>
Subject: RE: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0

[Please note: This e-mail is from an EXTERNAL e-mail address]
Hi Greg,

Thanks for the reply.
Another question on the same topic.

For k8s_root_ca_cert and k8s_root_ca_key, instead of giving self signed certificate and key, is it possible to give the key and certificate signed by a third party CA.
If yes, how to give third party CA certificate as an input to installation (in localhost.yaml?).

Regards,
Sriram

From: Waines, Greg <Greg.Waines at windriver.com>
Sent: Friday, January 29, 2021 6:38 PM
To: Dharwadkar, Sriram <Sriram.Dharwadkar at commscope.com>; starlingx-discuss at lists.starlingx.io
Subject: Re: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0


The upstream procedure is here:
https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/<https://secure-web.cisco.com/15ZBoH5PpMvXnW-SATwdQYI0x1GwsBhyhNUBpTV3et1-kCxfh00VJ3vckWRaWpyeJgTcx6fp2a2aZexK0-ZS8ODqy-i0wTOn_byb_6ftp99pqnfZl5gac4w15zuLH2OYIQFibe9T2gm914JH7O7sKA4SZoGAudctTXQ0udtUAbt6pGtLlVye0cxq5i5vr2V5hD8m5edueFqqfAsPBteu8HIxIBBYjhVdyYrPDe-vgT1lsVOlG5IJtR_1qa5eu8CD1SJS4fn0LmCjuLatos2BP21A0HiYRbzwdgQRyoJRI97WDTyD1V0nhS5JJJyNGR1eRKJV2XJrw329J8Yg0XSMwuw/https%3A%2F%2Fkubernetes.io%2Fdocs%2Ftasks%2Ftls%2Fmanual-rotation-of-ca-certificates%2F>
Greg.

From: "Dharwadkar, Sriram" <Sriram.Dharwadkar at commscope.com<mailto:Sriram.Dharwadkar at commscope.com>>
Date: Friday, January 29, 2021 at 6:20 AM
To: "starlingx-discuss at lists.starlingx.io<mailto:starlingx-discuss at lists.starlingx.io>" <starlingx-discuss at lists.starlingx.io<mailto:starlingx-discuss at lists.starlingx.io>>
Subject: [Starlingx-discuss] Procedure to update k8s_root_ca_cert and k8s_root_ca_key in StarlingX-4.0

[Please note: This e-mail is from an EXTERNAL e-mail address]
Hi,

We are using Distributed StarlingX-4.0.
As per the documentation https://docs.starlingx.io/deploy_install_guides/r4_release/ansible_bootstrap_configs.html<https://secure-web.cisco.com/10vZAKmYtKxfibvJnzHyVAgy5gTU2MPWcU9eJmJ4g_qEuBWaly5LHoGdKfZmYV3LRTOo0m39k7aZLlknweajeKdG-uNxdt4Jljgk4xc8Psam9_JZcUBx8-7CThKDZWGLEyNyFqXKTLrkZbB0_dlZ4U3n7qWSdN5HBSq9c5tkr9I3jbKWx60EUk8ncMXCGx-fApyymYAjOSHwLR59_FwTcvmdqTxmL68YWUHSGBxjtzMjUmgPjn8lg0dE1G1gVpFZ6UJ6LT_fFd5tNXHN2ncTyCG40QtDJrf_rnQJBGRPdKqqGDs1D3RGqqYOgAbpcoDj5/https%3A%2F%2Fdocs.starlingx.io%2Fdeploy_install_guides%2Fr4_release%2Fansible_bootstrap_configs.html>
k8s_root_ca_cert and k8s_root_ca_key are install time only parameters. Documentation says updating k8s_root_ca_cert and k8s_root_ca_key is an involved process.
Can you please share the procedure for updating root_ca and root_key ?
We have a usecase to update this cert and key during runtime, with reboot it should take new root_ca and root_key, is this possible ?

Regards,
Sriram
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20210204/b7c4cbd7/attachment.html>