SupportConsoleDevelopersStart a trialContact

Chapter 12. Accessing S3-compatible object storage with self-signed certificates

To securely connect OpenShift AI components to object storage solutions or databases that are deployed within an OpenShift cluster that uses self-signed certificates, you must provide a certificate authority (CA) certificate. Each namespace includes a config map named kube-root-ca.crt, which contains the CA certificate of the internal API Server.

Use this procedure only when the object storage endpoint serves TLS by using a certificate that is signed by an internal or cluster CA. You do not need this procedure in the following cases:

  • The endpoint serves plain HTTP and does not use TLS.
  • The endpoint presents a certificate that the cluster-wide CA bundle already includes.

Prerequisites

  • You have cluster administrator privileges for your OpenShift cluster.

  • You have installed the OpenShift CLI (oc) as described in the appropriate documentation for your cluster:

  • You have deployed an object storage solution or database in your OpenShift cluster.

Procedure

  1. In a terminal window, log in to the OpenShift CLI (oc) as shown in the following example: 

    oc login api.<cluster_name>.<cluster_domain>:6443 --web

  2. Retrieve the current OpenShift AI trusted CA configuration and store it in a new file. This step preserves any existing custom CA bundle, so that the later steps add the internal CA for the cluster to it instead of replacing it: 

    oc get dscinitializations.dscinitialization.opendatahub.io default-dsci -o json | jq -r '.spec.trustedCABundle.customCABundle' > /tmp/my-custom-ca-bundles.crt

  3. Add the kube-root-ca.crt config map for the cluster to the OpenShift AI trusted CA configuration: 

    oc get configmap kube-root-ca.crt -o jsonpath="{['data']['ca\.crt']}" >> /tmp/my-custom-ca-bundles.crt
    Note

    The kube-root-ca.crt config map is identical in every namespace, so this command returns the same CA certificate regardless of your current project.

  4. Update the OpenShift AI trusted CA configuration to trust certificates issued by the certificate authorities in kube-root-ca.crt: 

    oc patch dscinitialization default-dsci --type='json' -p='[{"op":"replace","path":"/spec/trustedCABundle/customCABundle","value":"'"$(awk '{printf "%s\\n", $0}' /tmp/my-custom-ca-bundles.crt)"'"}]'

Verification

  • From a workbench pod that mounts the updated trusted CA bundle, send a test request to the HTTPS endpoint of your object storage and confirm that the TLS handshake succeeds: 

    $ oc exec -n <namespace> <workbench-pod> -- \
  curl -sS -o /dev/null -w "%{http_code}\n" https://<s3-endpoint>

    Any HTTP response code, such as 200 or 403, confirms that the TLS handshake succeeded and that the cluster trusts the certificate. A curl error that mentions a self-signed certificate or a certificate verification failure indicates that the trusted CA bundle does not include the issuing CA.

  • A component that is configured to use the in-cluster object storage or database starts successfully. For example, a pipeline server that is configured to use an in-cluster database reaches a running state.
Note

For a more thorough, end-to-end check, you can confirm the certificate configuration by working through the OpenShift AI tutorial - Fraud Detection example, which exercises in-cluster object storage and AI pipelines against the updated trusted CA bundle.

For more information about installing local object storage buckets and creating connections, see Running a script to install local object storage buckets and create connections.

For more information about enabling AI pipelines, see Enabling pipelines.

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top