Skip to content

Latest commit

 

History

History
57 lines (51 loc) · 1.7 KB

customize-certificates-add-service-serving-configmap.adoc

File metadata and controls

57 lines (51 loc) · 1.7 KB

Add a service certificate to a ConfigMap

A Pod can access the service CA certificate by mounting a ConfigMap that is annotated with service.beta.openshift.io/inject-cabundle=true. Once annotated, the cluster automatically injects the service CA certificate into the service-ca.crt key on the ConfigMap. Access to this CA certificate allows TLS clients to verify connections to services using service serving certificates.

Important

After adding this annotation to a ConfigMap all existing data in it is deleted. It is recommended to use a separate ConfigMap to contain the service-ca.crt, instead of using the same ConfigMap that stores your Pod’s configuration.
Procedure

  1. Annotate the ConfigMap with service.beta.openshift.io/inject-cabundle=true.

    $ oc annotate configmap <configmap-name> \//(1)
     service.beta.openshift.io/inject-cabundle=true

    1. Replace <configmap-name> with the name of the ConfigMap to annotate.

      Note

      Explicitly referencing the service-ca.crt key in a volumeMount will prevent a Pod from starting until the ConfigMap has been injected with the CA bundle.

      For instance, to annotate the ConfigMap foo the following command would be used:

      $ oc annotate configmap foo service.beta.openshift.io/inject-cabundle=true

  2. View the ConfigMap to ensure the certificate has been generated. This appears as a service-ca.crt in the YAML output.

    $ oc get configmap <configmap-name> -o yaml
apiVersion: v1
data:
  service-ca.crt: |
    -----BEGIN CERTIFICATE-----
...