Configure a custom CA from the OpenShift web console

Configure a custom certificate authority (CA) for Red Hat Edge Manager service certificates by using the Red Hat OpenShift Container Platform web console. You can use either cert-manager or a manually created TLS secret.

Before you begin

  • You are logged into the Red Hat OpenShift Container Platform web console.
  • Your installation project is selected.

Procedure

  1. If you use cert-manager, find your issuer name. Click Search, select ClusterIssuer or Issuer from the Resources list, and record the issuer instance name. Use that name as issuerRef.name, not a CRD kind name such as ClusterIssuer.
  2. In your installation project, click the + icon and select Import YAML.
  3. Paste the following manifest. Replace <project_name> with your OpenShift project and <issuer_name> with your cert-manager issuer: 
    apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: flightctl-ca
  namespace: _<project_name>_ # Must match your installation namespace
spec:
  isCA: true
  commonName: flightctl-ca
  secretName: flightctl-ca
  duration: 87600h # 10 years
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: _<issuer_name>_
    kind: ClusterIssuer # or Issuer
    group: cert-manager.io
  4. Click Create.
  5. Confirm that cert-manager issued the certificate:
    1. Click Search, select Certificate from the Resources list, and open flightctl-ca in your installation project. Confirm the status is Ready.
    2. Navigate to Workloads Secrets and confirm that flightctl-ca exists.

    If the secret does not appear or the certificate is not ready, open flightctl-ca in Search and review the status conditions for errors such as an incorrect issuer name.

  6. If you do not use cert-manager, skip steps 1 through 5 and click the + icon in your installation project, then select Import YAML.
  7. Paste a kubernetes.io/tls Secret manifest for flightctl-ca. The tls.crt and tls.key values must be base64-encoded PEM content for your CA certificate and private key.
  8. Click Create.

Results

  • Navigate to Workloads Secrets and confirm that the flightctl-ca secret exists in your installation project.
  • For the cert-manager path, click Search, select Certificate from the Resources list, and confirm that flightctl-ca reports Ready.