mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 21:46:22 +01:00
40 lines
1.5 KiB
Plaintext
40 lines
1.5 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * builds/setting-up-trusted-ca
|
|
|
|
:_mod-docs-content-type: PROCEDURE
|
|
[id="configmap-adding-ca_{context}"]
|
|
= Adding certificate authorities to the cluster
|
|
|
|
ifdef::openshift-enterprise,openshift-rosa,openshift-dedicated,openshift-webscale,openshift-origin[]
|
|
You can add certificate authorities (CA) to the cluster for use when pushing and pulling images with the following procedure.
|
|
|
|
.Prerequisites
|
|
|
|
ifdef::openshift-rosa[]
|
|
* You must have cluster administrator privileges.
|
|
endif::[]
|
|
ifdef::openshift-dedicated[]
|
|
* You must have at least dedicated administrator privileges.
|
|
endif::[]
|
|
* You must have access to the public certificates of the registry, usually a `hostname/ca.crt` file located in the `/etc/docker/certs.d/` directory.
|
|
|
|
.Procedure
|
|
|
|
. Create a `ConfigMap` in the `openshift-config` namespace containing the trusted certificates for the registries that use self-signed certificates. For each CA file, ensure the key in the `ConfigMap` is the hostname of the registry in the `hostname[..port]` format:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc create configmap registry-cas -n openshift-config \
|
|
--from-file=myregistry.corp.com..5000=/etc/docker/certs.d/myregistry.corp.com:5000/ca.crt \
|
|
--from-file=otherregistry.com=/etc/docker/certs.d/otherregistry.com/ca.crt
|
|
----
|
|
|
|
. Update the cluster image configuration:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc patch image.config.openshift.io/cluster --patch '{"spec":{"additionalTrustedCA":{"name":"registry-cas"}}}' --type=merge
|
|
----
|
|
endif::[]
|