Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for user-provided CA certificates #6615

Merged
merged 9 commits into from
Feb 6, 2023

Conversation

brandond
Copy link
Member

@brandond brandond commented Dec 7, 2022

Proposed Changes

  • Add a sample script for generating root, intermediate, and cluster CA certificates
  • Fix kube-controller-manager cluster-signing certificates when root CAs are not self-signed.

Types of Changes

enhancement

Verification

  • Use script to generate CA certs before startup, note that cluster works properly and uses generated certs.

Testing

Linked Issues

User-Facing Change

K3s now functions properly when the cluster CA certificates are signed by an existing root or intermediate CA. You can find a sample script for generating such certificates before K3s starts in the github repo at [contrib/util/certs.sh](https://github.com/k3s-io/k3s/blob/master/contrib/util/certs.sh).

Further Comments

@brandond brandond force-pushed the custom-cert-gen branch 2 times, most recently from a11c58d to 00a096a Compare December 7, 2022 01:11
@brandond brandond force-pushed the custom-cert-gen branch 6 times, most recently from 4e45196 to c8caa4b Compare December 19, 2022 22:54
@brandond brandond marked this pull request as ready for review December 19, 2022 23:04
@brandond brandond requested a review from a team as a code owner December 19, 2022 23:04
@brandond brandond changed the title [WIP] Add support for user-provided CA certificates Add support for user-provided CA certificates Dec 19, 2022
@brandond brandond force-pushed the custom-cert-gen branch 7 times, most recently from ea40691 to 01e7d39 Compare January 14, 2023 21:35
Signed-off-by: Brad Davidson <[email protected]>
This command must be run on a server while the service is running. After this command completes, all the servers in the cluster should be restarted to load the new CA files.

Signed-off-by: Brad Davidson <[email protected]>
Signed-off-by: Brad Davidson <[email protected]>
@brandond brandond force-pushed the custom-cert-gen branch 3 times, most recently from 3b54bb5 to 9d31280 Compare January 31, 2023 01:33
@huapox
Copy link

huapox commented Feb 3, 2023

+1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants