1.3. Modifying Central custom resource for external database

Procedure

1. Create a password secret in the deployed namespace by using the OpenShift Container Platform web console or the terminal.

   • On the OpenShift Container Platform web console, go to the Workloads Secrets page. Create a Key/Value secret with the key password and the value as the path of a plain text file containing the password for the superuser of the provisioned database.

   • Or, run the following command in your terminal:

     $ oc create secret generic external-db-password \
       --from-file=password=<password.txt>

     where:

     <password.txt>

     Specifies the path of the file which has the plain text password.

2. Go to the Red Hat Advanced Cluster Security for Kubernetes operator page in the OpenShift Container Platform web console. Select Central in the top navigation bar and select the instance you want to connect to the database.
3. Go to the YAML editor view.
4. For db.passwordSecret.name specify the referenced secret that you created in earlier steps. For example, external-db-password.
5. For db.connectionString specify the connection string in keyword=value format, for example, host=<host> port=5432 database=stackrox user=stackrox sslmode=verify-ca
6. For db.persistence delete the entire block.

7. If necessary, you can specify a Certificate Authority for Central to trust the database certificate by adding a TLS block under the top-level spec, as shown in the following example:

   • Update the central custom resource with the following configuration:

     spec:
       tls:
         additionalCAs:
         - name: db-ca
           content: |
             <certificate>
       central:
         db:
           isEnabled: Default
           connectionString: "host=<host> port=5432 user=<user> sslmode=verify-ca"
           passwordSecret:
             name: external-db-password

     where:

     spec.central.db.isEnabled

     Specifies that you must not change the value of IsEnabled to Enabled.

8. Click Save.