Chapter 10. Configuring custom SSL/TLS certificates for Red Hat Quay on OpenShift Container Platform

Procedure

1. Generate the root CA key by entering the following command:

   $ openssl genrsa -out rootCA.key 2048

2. Generate the root CA certificate by entering the following command:

   $ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem

3. Enter the information that will be incorporated into your certificate request, including the server hostname, for example:

   Country Name (2 letter code) [XX]:IE
   State or Province Name (full name) []:GALWAY
   Locality Name (eg, city) [Default City]:GALWAY
   Organization Name (eg, company) [Default Company Ltd]:QUAY
   Organizational Unit Name (eg, section) []:DOCS
   Common Name (eg, your name or your server's hostname) []:quay-server.example.com

4. Generate the server key by entering the following command:

   $ openssl genrsa -out ssl.key 2048

5. Generate a signing request by entering the following command:

   $ openssl req -new -key ssl.key -out ssl.csr

6. Enter the information that will be incorporated into your certificate request, including the server hostname, for example:

   Country Name (2 letter code) [XX]:IE
   State or Province Name (full name) []:GALWAY
   Locality Name (eg, city) [Default City]:GALWAY
   Organization Name (eg, company) [Default Company Ltd]:QUAY
   Organizational Unit Name (eg, section) []:DOCS
   Common Name (eg, your name or your server's hostname) []:quay-server.example.com
   Email Address []:

7. Create a configuration file openssl.cnf, specifying the server hostname, for example:

   Example openssl.cnf file

   [req]
   req_extensions = v3_req
   distinguished_name = req_distinguished_name
   [req_distinguished_name]
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   subjectAltName = @alt_names
   [alt_names]
   DNS.1 = <quay-server.example.com>
   IP.1 = 192.168.1.112

8. Use the configuration file to generate the certificate ssl.cert:

   $ openssl x509 -req -in ssl.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out ssl.cert -days 356 -extensions v3_req -extfile openssl.cnf

9. Confirm your created certificates and files by entering the following command:

   $ ls /path/to/certificates

   Example output

   rootCA.key ssl-bundle.cert ssl.key custom-ssl-config-bundle-secret.yaml rootCA.pem ssl.cert
   openssl.cnf rootCA.srl  ssl.csr

Procedure

1. Create a new YAML file, for example, custom-ssl-config-bundle-secret.yaml:

   $ touch custom-ssl-config-bundle-secret.yaml

2. Create the custom-ssl-config-bundle-secret resource.

   1. Create the resource by entering the following command:

      $ oc -n <namespace> create secret generic custom-ssl-config-bundle-secret \
        --from-file=config.yaml=</path/to/config.yaml> \ 1
        --from-file=ssl.cert=</path/to/ssl.cert> \ 2
        --from-file=extra_ca_cert_<name-of-certificate>.crt=ca-certificate-bundle.crt
       \ 3
        --from-file=ssl.key=</path/to/ssl.key> \ 4
        --dry-run=client -o yaml > custom-ssl-config-bundle-secret.yaml

      1

      Where <config.yaml> is your base64 decoded config.yaml file.

      2

      Where <ssl.cert> is your ssl.cert file.

      3

      Optional. The --from-file=extra_ca_cert_<name-of-certificate>.crt=ca-certificate-bundle.crt field allows Red Hat Quay to recognize custom Certificate Authority (CA) files. If you are using LDAP, OIDC, or another service that uses custom CAs, you must add them via the extra_ca_cert path. For more information, see "Adding additional Certificate Authorities to Red Hat Quay on OpenShift Container Platform."

      4

      Where <ssl.key> is your ssl.key file.

3. Optional. You can check the content of the custom-ssl-config-bundle-secret.yaml file by entering the following command:

   $ cat custom-ssl-config-bundle-secret.yaml

   Example output

   apiVersion: v1
   data:
     config.yaml: QUxMT1dfUFVMTFNfV0lUSE9VVF9TVFJJQ1RfTE9HR0lORzogZmFsc2UKQVVUSEVOVElDQVRJT05fVFlQRTogRGF0YWJhc2UKREVGQVVMVF9UQUdfRVhQSVJBVElPTjogMncKRElTVFJJQlVURURfU1R...
     ssl.cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVYakNDQTBhZ0F3SUJBZ0lVTUFBRk1YVWlWVHNoMGxNTWI3U1l0eFV5eTJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZZ3hDekFKQmdOVkJBWVR...
     extra_ca_cert_<name-of-certificate>:LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVYakNDQTBhZ0F3SUJBZ0lVTUFBRk1YVWlWVHNoMGxNTWI3U1l0eFV5eTJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZZ3hDe...
     ssl.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2c0VWxZOVV1SVJPY1oKcFhpZk9MVEdqaS9neUxQMlpiMXQ...
   kind: Secret
   metadata:
     creationTimestamp: null
     name: custom-ssl-config-bundle-secret
     namespace: <namespace>

4. Create the configBundleSecret resource by entering the following command:

   $ oc create -n <namespace> -f custom-ssl-config-bundle-secret.yaml

   Example output

   secret/custom-ssl-config-bundle-secret created

5. Update the QuayRegistry YAML file to reference the custom-ssl-config-bundle-secret object by entering the following command:

   $ oc patch quayregistry <registry_name> -n <namespace> --type=merge -p '{"spec":{"configBundleSecret":"custom-ssl-config-bundle-secret"}}'

   Example output

   quayregistry.quay.redhat.com/example-registry patched

6. Set the tls component of the QuayRegistry YAML to false by entering the following command:

   $ oc patch quayregistry <registry_name> -n <namespace> --type=merge -p '{"spec":{"components":[{"kind":"tls","managed":false}]}}'

   Example output

   quayregistry.quay.redhat.com/example-registry patched

7. Ensure that your QuayRegistry YAML file has been updated to use the custom SSL configBundleSecret resource, and that your and tls resource is set to false by entering the following command:

   $ oc get quayregistry <registry_name> -n <namespace> -o yaml

   Example output

   # ...
     configBundleSecret: custom-ssl-config-bundle-secret
   # ...
   spec:
     components:
     - kind: tls
       managed: false
   # ...