public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add docs for tls-additional (#1981)

Browse Source 
* Add docs for tls-additional

* Address review comments

* Add tls-additional docs to previous versions
This commit is contained in:
Jake Hyde
2025-11-26 15:15:30 -08:00
committed by GitHub
parent 49fa9264c4
commit abf80148ac
6 changed files with 99 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
versioned_docs/version-2.11/getting-started/installation-and-upgrade/resources/add-tls-secrets.md
+16
View File
@@ -42,8 +42,24 @@ kubectl -n cattle-system create secret generic tls-ca \
The configured `tls-ca` secret is retrieved when Rancher starts. On a running Rancher installation the updated CA will take effect after new Rancher pods are started.
The certificate chain must be properly formatted, or components may fail to download resources from the Rancher server.
:::
## Adding Additional CA Certificates
If you are using a node driver that makes API requests with a different CA than the one configured for Rancher, you can add additional root certificates and certificate chains.
Create a unique file ending in `.pem` for each certificate that is required, and use kubectl to create the
`tls-additional` secret in the `cattle-system` namespace.
```console
kubectl -n cattle-system create secret generic tls-additional \
--from-file=cacerts1.pem=cacerts1.pem --from-file=cacerts2.pem=cacerts2.pem
```
Rancher mounts these CA root certificates and certificate chains into the node driver pod during provisioning.
## Updating a Private CA Certificate
Follow the steps on [this page](update-rancher-certificate.md) to update the SSL certificate of the ingress in a Rancher [high availability Kubernetes installation](../install-upgrade-on-a-kubernetes-cluster/install-upgrade-on-a-kubernetes-cluster.md) or to switch from the default self-signed certificate to a custom certificate.