mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
58 lines
1.8 KiB
Plaintext
58 lines
1.8 KiB
Plaintext
// This is included in the following assemblies:
|
|
//
|
|
// installing/installing_bare_metal/ipi/bare-metal-postinstallation-configuration.adoc
|
|
|
|
:_mod-docs-content-type: PROCEDURE
|
|
[id="bare-metal-install-new-bmc-ca_{context}"]
|
|
= Installing a new BMC CA certificate
|
|
|
|
[role="_abstract"]
|
|
You can install a local or self-signed BMC CA certificate on a cluster which was installed without a BMC CA certificate. Providing your own BMC CA certificate secures the communication between your cluster and BMC's.
|
|
|
|
.Prerequisites
|
|
|
|
* You installed a cluster on bare metal without a BMC CA certificate.
|
|
* You have a local or self-signed CA certificate.
|
|
|
|
.Procedure
|
|
|
|
. Create a file called `bmc-verify-ca.yaml` using a text editor, with the following contents:
|
|
+
|
|
[source,yaml]
|
|
----
|
|
apiVersion: v1
|
|
data:
|
|
verify_ca.crt: |
|
|
-----BEGIN CERTIFICATE-----
|
|
<self_signed_certificate_contents>
|
|
-----END CERTIFICATE-----
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: bmc-verify-ca
|
|
namespace: openshift-machine-api
|
|
----
|
|
+
|
|
where:
|
|
|
|
`<self_signed_certificate_contents>`:: Specifies the contents of your local or self-signed CA certificate.
|
|
|
|
. Apply the ConfigMap by running the following command:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc apply -f bmc-verify-ca.yaml
|
|
----
|
|
|
|
. Verify that the ConfigMap has been mounted in the Ironic container by running the following command:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc exec -n openshift-machine-api \
|
|
$(oc get pods -n openshift-machine-api -l app=metal3 -o jsonpath='{.items[0].metadata.name}') \
|
|
-c metal3-ironic -- ls -l /certs/ca/bmc
|
|
----
|
|
+
|
|
If successful, the command should display the certificate file.
|
|
|
|
. For each bare metal host in your cluster that you want to secure BMC communications with, follow the procedure titled _Editing a BareMetalHost resource_ and ensure that the `disableCertificateVerification` parameter is set to `false`.
|