Chapter 2. Adding trusted certificate authorities
Learn how to add custom trusted certificate authorities to Red Hat Advanced Cluster Security for Kubernetes.
If you are using an enterprise certificate authority (CA) on your network, or self-signed certificates, you must add the CA’s root certificate to Red Hat Advanced Cluster Security for Kubernetes as a trusted root CA.
Adding trusted root CAs allows:
- Central and Scanner to trust remote servers when you integrate with other tools.
- Sensor to trust custom certificates you use for Central.
You can add additional CAs during the installation or on an existing deployment.
You must first configure your trusted CAs in the cluster where you have deployed Central and then propagate the changes to Scanner and Sensor.
2.1. Configuring additional CAs
To add custom CAs:
Procedure
Download the
ca-setup.shscript.Note-
If you are doing a new installation, you can find the
ca-setup.shscript in thescriptsdirectory atcentral-bundle/central/scripts/ca-setup.sh. -
You must run the
ca-setup.shscript in the same terminal from which you logged into your OpenShift Container Platform cluster.
-
If you are doing a new installation, you can find the
Make the
ca-setup.shscript executable:$ chmod +x ca-setup.sh
To add:
A single certificate, use the
-f(file) option:$ ./ca-setup.sh -f <certificate>
Note- You must use a PEM-encoded certificate file (with any extension).
-
You can also use the
-u(update) option along with the-foption to update any previously added certificate.
Multiple certificates at once, move all certificates in a directory, and then use the
-d(directory) option:$ ./ca-setup.sh -d <directory_name>
Note-
You must use PEM-encoded certificate files with a
.crtor.pemextension. - Each file must only contain a single certificate.
-
You can also use the
-u(update) option along with the-doption to update any previously added certificates.
-
You must use PEM-encoded certificate files with a
2.2. Propagating changes
After you configure trusted CAs, you must make Red Hat Advanced Cluster Security for Kubernetes services trust them.
- If you have configured trusted CAs after the installation, you must restart Central.
- Additionally, if you are also adding certificates for integrating with image registries, you must restart both Central and Scanner.
2.2.1. Restarting the Central container
You can restart the Central container by killing the Central container or by deleting the Central pod.
Procedure
Run the following command to kill the Central container:
NoteYou must wait for at least 1 minute, until OpenShift Container Platform propagates your changes and restarts the Central container.
$ oc -n stackrox exec deploy/central -c central -- kill 1
Or, run the following command to delete the Central pod:
$ oc -n stackrox delete pod -lapp=central
2.2.2. Restarting the Scanner container
You can restart the Scanner container by deleting the pod.
Procedure
Run the following command to delete the Scanner pod:
On OpenShift Container Platform:
$ oc delete pod -n stackrox -l app=scanner
On Kubernetes:
$ kubectl delete pod -n stackrox -l app=scanner
After you have added trusted CAs and configured Central, the CAs are included in any new Sensor deployment bundles that you create.
- If an existing Sensor reports problems while connecting to Central, you must generate a Sensor deployment YAML file and update existing clusters.
If you are deploying a new Sensor using the
sensor.shscript, run the following command before you run thesensor.shscript:$ ./ca-setup-sensor.sh -d ./additional-cas/
- If you are deploying a new Sensor using Helm, you do not have to run any additional scripts.
