From ee7d33740b52ac340f105e37abaad332d949f283 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 31 Jan 2023 11:12:39 -0800 Subject: [PATCH] #384 Clarify which CA certs are needed --- .../installation-and-upgrade/resources/add-tls-secrets.md | 4 ++-- .../advanced-use-cases/helm2/helm-rancher/tls-secrets.md | 4 ++-- .../installation-and-upgrade/resources/add-tls-secrets.md | 4 ++-- .../installation-and-upgrade/resources/add-tls-secrets.md | 4 ++-- .../installation-and-upgrade/resources/add-tls-secrets.md | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/getting-started/installation-and-upgrade/resources/add-tls-secrets.md b/docs/getting-started/installation-and-upgrade/resources/add-tls-secrets.md index 8e72f41c461..8b4c9817693 100644 --- a/docs/getting-started/installation-and-upgrade/resources/add-tls-secrets.md +++ b/docs/getting-started/installation-and-upgrade/resources/add-tls-secrets.md @@ -25,9 +25,9 @@ If you want to replace the certificate, you can delete the `tls-rancher-ingress` ## Using a Private CA Signed Certificate -If you are using a private CA, Rancher requires a copy of the CA certificate which is used by the Rancher Agent to validate the connection to the server. +If you are using a private CA, Rancher requires a copy of the private CA's root certificate or certificate chain, which the Rancher Agent uses to validate the connection to the server. -Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. +Create a file named `cacerts.pem` that only contains the root CA certificate or certificate chain from your private CA, and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. ``` kubectl -n cattle-system create secret generic tls-ca \ diff --git a/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/tls-secrets.md b/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/tls-secrets.md index d2895f02d68..2b5de011bf1 100644 --- a/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/tls-secrets.md +++ b/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/tls-secrets.md @@ -19,9 +19,9 @@ kubectl -n cattle-system create secret tls tls-rancher-ingress \ ### Using a Private CA Signed Certificate -If you are using a private CA, Rancher requires a copy of the CA certificate which is used by the Rancher Agent to validate the connection to the server. +If you are using a private CA, Rancher requires a copy of the private CA's root certificate or certificate chain, which the Rancher Agent uses to validate the connection to the server. -Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. +Create a file named `cacerts.pem` that only contains the root CA certificate or certificate chain from your private CA, and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. >**Important:** Make sure the file is called `cacerts.pem` as Rancher uses that filename to configure the CA certificate. diff --git a/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/resources/add-tls-secrets.md b/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/resources/add-tls-secrets.md index c649daf31b1..519702c4efc 100644 --- a/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/resources/add-tls-secrets.md +++ b/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/resources/add-tls-secrets.md @@ -21,9 +21,9 @@ kubectl -n cattle-system create secret tls tls-rancher-ingress \ ## Using a Private CA Signed Certificate -If you are using a private CA, Rancher requires a copy of the CA certificate which is used by the Rancher Agent to validate the connection to the server. +If you are using a private CA, Rancher requires a copy of the private CA's root certificate or certificate chain, which the Rancher Agent uses to validate the connection to the server. -Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. +Create a file named `cacerts.pem` that only contains the root CA certificate or certificate chain from your private CA, and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. ``` kubectl -n cattle-system create secret generic tls-ca \ diff --git a/versioned_docs/version-2.5/getting-started/installation-and-upgrade/resources/add-tls-secrets.md b/versioned_docs/version-2.5/getting-started/installation-and-upgrade/resources/add-tls-secrets.md index c649daf31b1..519702c4efc 100644 --- a/versioned_docs/version-2.5/getting-started/installation-and-upgrade/resources/add-tls-secrets.md +++ b/versioned_docs/version-2.5/getting-started/installation-and-upgrade/resources/add-tls-secrets.md @@ -21,9 +21,9 @@ kubectl -n cattle-system create secret tls tls-rancher-ingress \ ## Using a Private CA Signed Certificate -If you are using a private CA, Rancher requires a copy of the CA certificate which is used by the Rancher Agent to validate the connection to the server. +If you are using a private CA, Rancher requires a copy of the private CA's root certificate or certificate chain, which the Rancher Agent uses to validate the connection to the server. -Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. +Create a file named `cacerts.pem` that only contains the root CA certificate or certificate chain from your private CA, and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. ``` kubectl -n cattle-system create secret generic tls-ca \ diff --git a/versioned_docs/version-2.6/getting-started/installation-and-upgrade/resources/add-tls-secrets.md b/versioned_docs/version-2.6/getting-started/installation-and-upgrade/resources/add-tls-secrets.md index 8e72f41c461..8b4c9817693 100644 --- a/versioned_docs/version-2.6/getting-started/installation-and-upgrade/resources/add-tls-secrets.md +++ b/versioned_docs/version-2.6/getting-started/installation-and-upgrade/resources/add-tls-secrets.md @@ -25,9 +25,9 @@ If you want to replace the certificate, you can delete the `tls-rancher-ingress` ## Using a Private CA Signed Certificate -If you are using a private CA, Rancher requires a copy of the CA certificate which is used by the Rancher Agent to validate the connection to the server. +If you are using a private CA, Rancher requires a copy of the private CA's root certificate or certificate chain, which the Rancher Agent uses to validate the connection to the server. -Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. +Create a file named `cacerts.pem` that only contains the root CA certificate or certificate chain from your private CA, and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. ``` kubectl -n cattle-system create secret generic tls-ca \