Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

このコンテンツは選択した言語では利用できません。

Chapter 2. Adding trusted certificate authorities

Learn how to add custom trusted certificate authorities to Red Hat Advanced Cluster Security for Kubernetes.

If you are using an enterprise certificate authority (CA) on your network, or self-signed certificates, you must add the CA’s root certificate to Red Hat Advanced Cluster Security for Kubernetes as a trusted root CA.

Adding trusted root CAs allows:

  • Central and Scanner to trust remote servers when you integrate with other tools.
  • Sensor to trust custom certificates you use for Central.

You can add additional CAs during the installation or on an existing deployment.

Note

You must first configure your trusted CAs in the cluster where you have deployed Central and then propagate the changes to Scanner and Sensor.

2.1. Configuring additional CAs
リンクのコピー

To add custom CAs:

Procedure

  1. Download the ca-setup.sh script.

    Note
    • If you are doing a new installation, you can find the ca-setup.sh script in the scripts directory at central-bundle/central/scripts/ca-setup.sh.
    • You must run the ca-setup.sh script in the same terminal from which you logged into your OpenShift Container Platform cluster.

  2. Make the ca-setup.sh script executable: 

    $ chmod +x ca-setup.sh
    Copy to Clipboard Toggle word wrap

  3. To add:

    1. A single certificate, use the -f (file) option: 

      $ ./ca-setup.sh -f <certificate>
      Copy to Clipboard Toggle word wrap
      Note
      • You must use a PEM-encoded certificate file (with any extension).
      • You can also use the -u (update) option along with the -f option to update any previously added certificate.

    2. Multiple certificates at once, move all certificates in a directory, and then use the -d (directory) option: 

      $ ./ca-setup.sh -d <directory_name>
      Copy to Clipboard Toggle word wrap
      Note
      • You must use PEM-encoded certificate files with a .crt or .pem extension.
      • Each file must only contain a single certificate.
      • You can also use the -u (update) option along with the -d option to update any previously added certificates.

2.2. Propagating changes
リンクのコピー

After you configure trusted CAs, you must make Red Hat Advanced Cluster Security for Kubernetes services trust them.

  • If you have configured trusted CAs after the installation, you must restart Central.
  • Additionally, if you are also adding certificates for integrating with image registries, you must restart both Central and Scanner.

2.2.1. Restarting the Central container
リンクのコピー

You can restart the Central container by deleting the Central pod.

Important

If you use Kubernetes, enter kubectl instead of oc.

Procedure

  • To delete the Central pod, run the following command: 

    $ oc -n stackrox delete pod -lapp=central
    Copy to Clipboard Toggle word wrap

2.2.2. Restarting the Scanner container
リンクのコピー

You can restart the Scanner container by deleting the pod.

Procedure

  • Run the following command to delete the Scanner pod:

    • On OpenShift Container Platform: 

      $ oc delete pod -n stackrox -l app=scanner
      Copy to Clipboard Toggle word wrap

    • On Kubernetes: 

      $ kubectl delete pod -n stackrox -l app=scanner
      Copy to Clipboard Toggle word wrap
Important

After you have added trusted CAs and configured Central, the CAs are included in any new Sensor deployment bundles that you create.

  • If an existing Sensor reports problems while connecting to Central, you must generate a Sensor deployment YAML file and update existing clusters.

  • If you are deploying a new Sensor using the sensor.sh script, run the following command before you run the sensor.sh script: 

    $ ./ca-setup-sensor.sh -d ./additional-cas/
    Copy to Clipboard Toggle word wrap
  • If you are deploying a new Sensor using Helm, you do not have to run any additional scripts.
トップに戻る
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2025 Red Hat