2.2. Adding API server certificates

Procedure

1. Create a secret that contains the certificate chain and private key in the openshift-config namespace.

   $ oc create secret tls <secret> \1
        --cert=</path/to/cert.crt> \2
        --key=</path/to/cert.key> \3
        -n openshift-config

   1

   <secret> is the name of the secret that will contain the certificate chain and private key.

   2

   </path/to/cert.crt> is the path to the certificate chain on your local file system.

   3

   </path/to/cert.key> is the path to the private key associated with this certificate.

2. Update the API server to reference the created secret.

   $ oc patch apiserver cluster \
        --type=merge -p \
        '{"spec":{"servingCerts": {"namedCertificates":
        [{"names": ["<FQDN>"], 1
        "servingCertificate": {"name": "<secret>"}}]}}}' 2

   1

   Replace <FQDN> with the FQDN that the API server should provide the certificate for.

   2

   Replace <secret> with the name used for the secret in the previous step.

3. Examine the apiserver/cluster object and confirm the secret is now referenced.

   $ oc get apiserver cluster -o yaml

   Example output

   ...
   spec:
     servingCerts:
       namedCertificates:
       - names:
         - <FQDN>
         servingCertificate:
           name: <secret>
   ...