2019-03-20 15:57:47 -04:00
// Module included in the following assemblies:
//
// * builds/setting-up-trusted-ca
2022-02-04 15:22:10 +00:00
:_content-type: PROCEDURE
2019-05-30 16:52:45 -04:00
[id="configmap-adding-ca_{context}"]
2019-11-11 15:48:39 -05:00
= Adding certificate authorities to the cluster
2020-12-03 22:10:00 -05:00
2022-08-24 14:36:32 -04:00
ifdef::openshift-enterprise,openshift-rosa,openshift-dedicated,openshift-webscale,openshift-origin[]
2020-12-03 22:10:00 -05:00
You can add certificate authorities (CA) to the cluster for use when pushing and pulling images with the following procedure.
2019-03-20 15:57:47 -04:00
2020-08-06 13:15:31 -04:00
.Prerequisites
2022-08-24 14:36:32 -04:00
ifdef::openshift-rosa[]
2020-08-06 13:15:31 -04:00
* You must have cluster administrator privileges.
2022-08-24 14:36:32 -04:00
endif::[]
ifdef::openshift-dedicated[]
* You must have at least dedicated administrator privileges.
endif::[]
2020-12-03 22:10:00 -05:00
* You must have access to the public certificates of the registry, usually a `hostname/ca.crt` file located in the `/etc/docker/certs.d/` directory.
2020-08-06 13:15:31 -04:00
.Procedure
2020-12-03 22:10:00 -05:00
. Create a `ConfigMap` in the `openshift-config` namespace containing the trusted certificates for the registries that use self-signed certificates. For each CA file, ensure the key in the `ConfigMap` is the hostname of the registry in the `hostname[..port]` format:
2020-08-06 13:15:31 -04:00
+
[source,terminal]
----
$ oc create configmap registry-cas -n openshift-config \
--from-file=myregistry.corp.com..5000=/etc/docker/certs.d/myregistry.corp.com:5000/ca.crt \
--from-file=otherregistry.com=/etc/docker/certs.d/otherregistry.com/ca.crt
----
. Update the cluster image configuration:
+
[source,terminal]
----
$ oc patch image.config.openshift.io/cluster --patch '{"spec":{"additionalTrustedCA":{"name":"registry-cas"}}}' --type=merge
----
endif::[]
