config-custom-ssl-certs-kubernetes.adoc

Adding custom SSL/TLS certificates when {productname} is deployed on Kubernetes

When deployed on Kubernetes, {productname} mounts in a secret as a volume to store config assets. Currently, this breaks the upload certificate function of the superuser panel.

As a temporary workaround, base64 encoded certificates can be added to the secret after {productname} has been deployed.

Use the following procedure to add custom SSL/TLS certificates when {productname} is deployed on Kubernetes.

Prerequisites

• {productname} has been deployed.

• You have a custom ca.crt file.

Procedure

1. Base64 encode the contents of an SSL/TLS certificate by entering the following command:

   $ cat ca.crt | base64 -w 0
   Example output

   ...c1psWGpqeGlPQmNEWkJPMjJ5d0pDemVnR2QNCnRsbW9JdEF4YnFSdVd3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=

2. Enter the following kubectl command to edit the quay-enterprise-config-secret file:

   $ kubectl --namespace quay-enterprise edit secret/quay-enterprise-config-secret

3. Add an entry for the certificate and paste the full base64 encoded stringer under the entry. For example:

     custom-cert.crt:
   c1psWGpqeGlPQmNEWkJPMjJ5d0pDemVnR2QNCnRsbW9JdEF4YnFSdVd3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=

4. Use the kubectl delete command to remove all {productname} pods. For example:

   $ kubectl delete pod quay-operator.v3.7.1-6f9d859bd-p5ftc quayregistry-clair-postgres-7487f5bd86-xnxpr quayregistry-quay-app-upgrade-xq2v6  quayregistry-quay-database-859d5445ff-cqthr quayregistry-quay-redis-84f888776f-hhgms

   Afterwards, the {productname} deployment automatically schedules replace pods with the new certificate data.