// Module included in the following assemblies:
//
// * builds/setting-up-trusted-ca

:_mod-docs-content-type: PROCEDURE
[id="configmap-adding-ca_{context}"]
= Adding certificate authorities to the cluster

ifdef::openshift-enterprise,openshift-rosa,openshift-dedicated,openshift-webscale,openshift-origin[]
You can add certificate authorities (CA) to the cluster for use when pushing and pulling images with the following procedure.

.Prerequisites

ifdef::openshift-rosa[]
* You must have cluster administrator privileges.
endif::[]
ifdef::openshift-dedicated[]
* You must have at least dedicated administrator privileges.
endif::[]
* You must have access to the public certificates of the registry, usually a `hostname/ca.crt` file located in the `/etc/docker/certs.d/` directory.

.Procedure

. Create a `ConfigMap` in the `openshift-config` namespace containing the trusted certificates for the registries that use self-signed certificates. For each CA file, ensure the key in the `ConfigMap` is the hostname of the registry in the `hostname[..port]` format:
+
[source,terminal]
----
$ oc create configmap registry-cas -n openshift-config \
--from-file=myregistry.corp.com..5000=/etc/docker/certs.d/myregistry.corp.com:5000/ca.crt \
--from-file=otherregistry.com=/etc/docker/certs.d/otherregistry.com/ca.crt
----

. Update the cluster image configuration:
+
[source,terminal]
----
$ oc patch image.config.openshift.io/cluster --patch '{"spec":{"additionalTrustedCA":{"name":"registry-cas"}}}' --type=merge
----
endif::[]