fix(certs): auto-install ca retrieved from rancher #33
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Zespre Chang <zespre.chang@suse.com>
Signed-off-by: Zespre Chang <zespre.chang@suse.com>
This was referenced Oct 12, 2023
Signed-off-by: Zespre Chang <zespre.chang@suse.com>
ibrokethecloud
approved these changes
Dec 4, 2023
There was a problem hiding this comment.
LGTM. thanks.
Can confirm that the ssl cert is downloaded and pulled into the ca store
node2:/etc/pki/trust/anchors # ls -alrt
total 12
drwxr-xr-x 4 root root 4096 Apr 8 2021 ..
-rw-r--r-- 1 root root 664 Dec 4 01:47 embedded-rancher-ca.pem
drwxr-xr-x 2 root root 4096 Dec 4 01:47 .
node2:/etc/pki/trust/anchors # more embedded-rancher-ca.pem
-----BEGIN CERTIFICATE-----
MIIBvDCCAWOgAwIBAgIBADAKBggqhkjOPQQDAjBGMRwwGgYDVQQKExNkeW5hbWlj
bGlzdGVuZXItb3JnMSYwJAYDVQQDDB1keW5hbWljbGlzdGVuZXItY2FAMTcwMTY1
MzU3NzAeFw0yMzEyMDQwMTMyNTdaFw0zMzEyMDEwMTMyNTdaMEYxHDAaBgNVBAoT
E2R5bmFtaWNsaXN0ZW5lci1vcmcxJjAkBgNVBAMMHWR5bmFtaWNsaXN0ZW5lci1j
YUAxNzAxNjUzNTc3MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuIUssPqLlLw3
6/n+X9GCZUbel52NCnglFsDSDhGrlkyup6TGfWnGfSUjfzuCGatk71nKHKYDK0g3
eb+d1HFeXaNCMEAwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wHQYD
VR0OBBYEFLc/YDjOu8sfD2UuPbKL+Uu8+wIGMAoGCCqGSM49BAMCA0cAMEQCIBb6
RP/KRjZuU0whKiF5W2myB4wDd6LPXHeYgiSeDDC9AiAe127ZzALWSjFc9rt8ZH33
OBC34dALTHRWJiwAp4+8Xw==
-----END CERTIFICATE-----
node2:/var/lib/ca-certificates/pem # ls -alrt
total 616
-r--r--r-- 1 root root 664 Dec 4 01:47 dynamiclistener-ca_1701653577.pem
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add the following two items to the existing joining plan of rancherd:
https://<VIP/FQDN>/cacerts)update-ca-certificatescommandDuring the Harvester bootstrap, rancherd will process the plan, try to get the CA cert, and update the system's trust list.
Related issue: harvester/harvester#4603