7.3. Setting up OpenShift Serverless transport encryption

Procedure

1. Create a SelfSigned ClusterIssuer custom resource (CR):

   Example ClusterIssuer CR

   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: knative-serving-selfsigned-issuer
   spec:
     selfSigned: {}

2. Apply the ClusterIssuer CR by running the following command:

   $ oc apply -f <filename>

3. Create a root certificate that refers to the ClusterIssuer CR:

   Example root certificate

   apiVersion: cert-manager.io/v1
   kind: Certificate
   metadata:
     name: knative-serving-selfsigned-ca
     namespace: cert-manager 

   1

   
   spec:
     secretName: knative-serving-ca 

   2

   
   
     isCA: true
     commonName: selfsigned-ca
     privateKey:
       algorithm: ECDSA
       size: 256
   
     issuerRef:
       name: knative-serving-selfsigned-issuer
       kind: ClusterIssuer
       group: cert-manager.io

   1

   The cert-manager Operator for Red Hat OpenShift namespace, cert-manager by default.

   2

   Secret name later used for the ClusterIssuer CR for Knative Serving.

4. Apply the Certificate CR by running the following command:

   $ oc apply -f <filename>

Procedure

1. Create the knative-serving-ca-issuer ClusterIssuer for Serving:

   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: knative-serving-ca-issuer
   spec:
     ca:
       secretName: knative-serving-ca 

   1

   1

   Secret name in the cert-manager Operator for Red Hat OpenShift namespace (cert-manager by default) containing the certificate that can be used by OpenShift Serverless Serving components for new certificates.

2. Apply the ClusterIssuer resource by running the following command:

   $ oc apply -f <filename>

1. Specifying the ClusterIssuer issuer to use:

   • clusterLocalIssuerRef: issuer for cluster-local-domain certificates used for ingress.
   • systemInternalIssuerRef: issuer for certificates for system-internal-tls certificates used by Knative internal components.

2. Specifying transport encryption features to use:

   • cluster-local-domain-tls: Enables the transport encryption feature for cluster-local domains
   • system-internal-tls: Enables the transport encryption feature for OpenShift Serverless Serving internal components.

Procedure

1. Enable transport encryption in the KnativeServing resource:

   apiVersion: operator.knative.dev/v1beta1
   kind: KnativeServing
   metadata:
     name: knative-serving
     namespace: knative-serving
   spec:
     ...
     config:
       certmanager:
         clusterLocalIssuerRef: |
           kind: ClusterIssuer
           name: knative-serving-ca-issuer 

   1

   
         systemInternalIssuerRef: |
           kind: ClusterIssuer
           name: knative-serving-ca-issuer 

   2

   
       network:
         cluster-local-domain-tls: Enabled 

   3

   
         system-internal-tls: Enabled 

   4

   1

   Define the cluster issuer for each feature. The same or individual cluster issuers can be used.

   2

   Define the cluster issuer.

   3

   Enable the cluster-local-domain-tls feature. This and other features can be enabled or disabled individually.

   4

   Enable the system-internal-tls feature.

2. Apply the KnativeServing resource by running the following command:

   $ oc apply -f <filename>

3. Optionally, change the defaultCertificate value in the Ingress Controller:

   apiVersion: operator.openshift.io/v1
   kind: IngressController
    ...
   spec:
     defaultCertificate:
       name: ca-ingress-cert

4. If you changed the defaultCertificate value, you must specify the custom certificate name in the openshift-ingress-default-certificate field in the KnativeServing custom resource.

   For example, if the custom certificate name is ca-ingress-cert, add the following configuration:

   ...
   spec:
     config:
       network:
         system-internal-tls: Enabled
         openshift-ingress-default-certificate: "ca-ingress-cert"
   ...

5. If you enabled cluster-local-domain-tls or system-internal-tls, restart the Controller component by running the following command.

   重要

   When either the cluster-local-domain-tls or the system-internal-tls feature is enabled, you must restart the Controller component to enable the Knative Serving cert-manager integration.

   $ oc rollout restart deploy/controller -n knative-serving

6. If you enabled system-internal-tls, restart the Activator component by running the following command.

   重要

   When the system-internal-tls feature is activated, you must restart the Activator component to reconfigure its internal web server, as this is not possible during runtime.

   $ oc rollout restart deploy/activator -n knative-serving