第 2 章 Configuring certificates

Procedure

1. Create a config map that includes only the root CA certificate used to sign the wildcard certificate:

   $ oc create configmap custom-ca \
        --from-file=ca-bundle.crt=</path/to/example-ca.crt> \1
        -n openshift-config

   1

   </path/to/example-ca.crt> is the path to the root CA certificate file on your local file system.

2. Update the cluster-wide proxy configuration with the newly created config map:

   $ oc patch proxy/cluster \
        --type=merge \
        --patch='{"spec":{"trustedCA":{"name":"custom-ca"}}}'

3. Create a secret that contains the wildcard certificate chain and key:

   $ oc create secret tls <secret> \1
        --cert=</path/to/cert.crt> \2
        --key=</path/to/cert.key> \3
        -n openshift-ingress

   1

   <secret> is the name of the secret that will contain the certificate chain and private key.

   2

   </path/to/cert.crt> is the path to the certificate chain on your local file system.

   3

   </path/to/cert.key> is the path to the private key associated with this certificate.

4. Update the Ingress Controller configuration with the newly created secret:

   $ oc patch ingresscontroller.operator default \
        --type=merge -p \
        '{"spec":{"defaultCertificate": {"name": "<secret>"}}}' \1
        -n openshift-ingress-operator

   1

   Replace <secret> with the name used for the secret in the previous step.