Configure a custom CA with the OpenShift CLI

Configure a custom certificate authority (CA) for Red Hat Edge Manager service certificates by using the OpenShift CLI (oc). You can use either cert-manager or a manually created TLS secret.

Before you begin

  • The OpenShift CLI (oc) is installed and authenticated.

Procedure

  1. If you use cert-manager, list available issuers to find the issuerRef.name value. Use the issuer instance name from this output, not a CRD kind name such as ClusterIssuer: 
    $ oc get clusterissuers
$ oc get issuers -n _<project_name>_

    Use the name from oc get clusterissuers when issuerRef.kind is ClusterIssuer. Use the name from oc get issuers when issuerRef.kind is Issuer.

  2. Save the following manifest as <certificate_manifest>.yaml. Replace <project_name> with your OpenShift project and <issuer_name> with your cert-manager issuer: 
    apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: flightctl-ca
  namespace: _<project_name>_ # Must match your installation namespace
spec:
  isCA: true
  commonName: flightctl-ca
  secretName: flightctl-ca
  duration: 87600h # 10 years
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: _<issuer_name>_
    kind: ClusterIssuer # or Issuer
    group: cert-manager.io
  3. Apply the manifest: 
    $ oc apply -f _<certificate_manifest>.yaml_
  4. Wait until cert-manager issues the certificate and creates the flightctl-ca secret: 
    $ oc get certificate flightctl-ca -n _<project_name>_
$ oc get secret flightctl-ca -n _<project_name>_

    Confirm that the CertificateREADY column is True and the flightctl-ca secret exists.

    If the secret does not appear or READY is False, inspect the certificate status:

    $ oc describe certificate flightctl-ca -n _<project_name>_

    Common causes include an incorrect issuerRef.name or an issuer that is not ready.

  5. If you do not use cert-manager, skip steps 1 through 4 and create a TLS secret named flightctl-ca that contains your CA certificate and private key: 
    $ oc create secret tls flightctl-ca -n _<project_name>_ \
  --cert=_</path/to/ca.crt>_ \
  --key=_</path/to/ca.key>_

Results

  • The flightctl-ca secret exists in the installation namespace: 
    $ oc get secret flightctl-ca -n _<project_name>_
  • For the cert-manager path, the Certificate resource reports READY as True: 
    $ oc get certificate flightctl-ca -n _<project_name>_