Chapter 8. Working with certificates

Procedure

1. In a terminal window, log in to the OpenShift CLI as shown in the following example:

   oc login api.<cluster_name>.<cluster_domain>:6443 --web

2. Retrieve the current OpenShift AI trusted CA configuration and store it in a new file:

   oc get dscinitializations.dscinitialization.opendatahub.io default-dsci -o json | jq -r '.spec.trustedCABundle.customCABundle' > /tmp/my-custom-ca-bundles.crt

3. Add the cluster’s kube-root-ca.crt ConfigMap to the OpenShift AI trusted CA configuration:

   oc get configmap kube-root-ca.crt -o jsonpath="{['data']['ca\.crt']}" >> /tmp/my-custom-ca-bundles.crt

4. Update the OpenShift AI trusted CA configuration to trust certificates issued by the certificate authorities in kube-root-ca.crt:

   oc patch dscinitialization default-dsci --type='json' -p='[{"op":"replace","path":"/spec/trustedCABundle/customCABundle","value":"'"$(awk '{printf "%s\\n", $0}' /tmp/my-custom-ca-bundles.crt)"'"}]'

Procedure

1. Log in to the OpenShift console.

2. From Workloads ConfigMaps, create a ConfigMap with the required bundle in the same data science project as the target data science pipeline:

   kind: ConfigMap
   apiVersion: v1
   metadata:
       name: custom-ca-bundle
   data:
       ca-bundle.crt: |
       # contents of ca-bundle.crt

3. Add the following snippet to the .spec.apiserver.caBundle field of the underlying Data Science Pipelines Application (DSPA):

   apiVersion: datasciencepipelinesapplications.opendatahub.io/v1
   kind: DataSciencePipelinesApplication
   metadata:
       name: data-science-dspa
   spec:
       ...
       apiServer:
       ...
       cABundle:
           configMapName: custom-ca-bundle
           configMapKey: ca-bundle.crt

4. Save the ConfigMap. The pipeline server pod automatically redeploys with the updated bundle.

1. Log in to the OpenShift console.
2. Go to the data science project that has the target data science pipeline.
3. Click the Pods tab.
4. Click the pipeline server pod with the ds-pipeline-dspa-<hash> prefix.
5. Click Terminal.
6. Enter cat /dsp-custom-certs/dsp-ca.crt.
7. Verify that your CA bundle is present within this file.

Procedure

1. Log in to the OpenShift console.
2. From the list of projects, open the openshift-ingress project.
3. Click YAML.
4. Search for "cert" to find a secret with a name that includes "cert". For example, rhods-internal-primary-cert-bundle-secret. The contents of the secret should contain two items that are used for all OpenShift Routes: tls.cert (the certificate) and tls.key (the key).
5. Copy the reference to the secret.
6. From the list of projects, open the istio-system project.
7. Create a YAML file and paste the reference to the secret that you copied from the openshift-ingress YAML file.

8. Edit the YAML code to keep only the relevant content, as shown in the following example. Replace rhods-internal-primary-cert-bundle-secret with the name of your secret:

   kind: Secret
   apiVersion: v1
   metadata:
   name: rhods-internal-primary-cert-bundle-secret
   data:
   tls.crt: >-
       LS0tLS1CRUd...
   tls.key: >-
       LS0tLS1CRUd...
   type: kubernetes.io/tls

9. Save the YAML file in the istio-system project.
10. Navigate to Operators Installed Operators Red Hat OpenShift AI.
11. Click Data Science Cluster*, and then click default-dsc YAML.

12. Edit the kserve configuration section to refer to your secret as shown in the following example. Replace rhods-internal-primary-cert-bundle-secret with the name of the secret that you created in Step 8.

    kserve:
    devFlags: {}
    managementState: Managed
    serving:
        ingressGateway:
        certificate:
            secretName: rhods-internal-primary-cert-bundle-secret
            type: Provided
        managementState: Managed
        name: knative-serving

Procedure

1. In the OpenShift web console, click Operators Installed Operators and then click the Red Hat OpenShift AI Operator.
2. Click the DSC Initialization tab.
3. Click the default-dsci object.
4. Click the YAML tab.

5. In the spec section, change the value of the managementState field for trustedCABundle to Removed:

   spec:
     trustedCABundle:
       managementState: Removed

6. Click Save.