public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-27 13:38:07 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
gh-pages
rancher-docs/assets/js/8a8ac7df.69c878d2.js
T

668 lines
41 KiB
JavaScript
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
"use strict";
(self["webpackChunkrancher_docs"] = self["webpackChunkrancher_docs"] || []).push([[70981],{
/***/ 3905:
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
/* harmony export */ Zo: () => (/* binding */ MDXProvider),
/* harmony export */ kt: () => (/* binding */ createElement)
/* harmony export */ });
/* unused harmony exports MDXContext, useMDXComponents, withMDXComponents */
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
function _defineProperty(obj, key, value) {
if (key in obj) {
Object.defineProperty(obj, key, {
value: value,
enumerable: true,
configurable: true,
writable: true
});
} else {
obj[key] = value;
}
return obj;
}
function _extends() {
_extends = Object.assign || function (target) {
for (var i = 1; i < arguments.length; i++) {
var source = arguments[i];
for (var key in source) {
if (Object.prototype.hasOwnProperty.call(source, key)) {
target[key] = source[key];
}
}
}
return target;
};
return _extends.apply(this, arguments);
}
function ownKeys(object, enumerableOnly) {
var keys = Object.keys(object);
if (Object.getOwnPropertySymbols) {
var symbols = Object.getOwnPropertySymbols(object);
if (enumerableOnly) symbols = symbols.filter(function (sym) {
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
});
keys.push.apply(keys, symbols);
}
return keys;
}
function _objectSpread2(target) {
for (var i = 1; i < arguments.length; i++) {
var source = arguments[i] != null ? arguments[i] : {};
if (i % 2) {
ownKeys(Object(source), true).forEach(function (key) {
_defineProperty(target, key, source[key]);
});
} else if (Object.getOwnPropertyDescriptors) {
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
} else {
ownKeys(Object(source)).forEach(function (key) {
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
});
}
}
return target;
}
function _objectWithoutPropertiesLoose(source, excluded) {
if (source == null) return {};
var target = {};
var sourceKeys = Object.keys(source);
var key, i;
for (i = 0; i < sourceKeys.length; i++) {
key = sourceKeys[i];
if (excluded.indexOf(key) >= 0) continue;
target[key] = source[key];
}
return target;
}
function _objectWithoutProperties(source, excluded) {
if (source == null) return {};
var target = _objectWithoutPropertiesLoose(source, excluded);
var key, i;
if (Object.getOwnPropertySymbols) {
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
for (i = 0; i < sourceSymbolKeys.length; i++) {
key = sourceSymbolKeys[i];
if (excluded.indexOf(key) >= 0) continue;
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
target[key] = source[key];
}
}
return target;
}
var isFunction = function isFunction(obj) {
return typeof obj === 'function';
};
var MDXContext = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createContext({});
var withMDXComponents = function withMDXComponents(Component) {
return function (props) {
var allComponents = useMDXComponents(props.components);
return /*#__PURE__*/React.createElement(Component, _extends({}, props, {
components: allComponents
}));
};
};
var useMDXComponents = function useMDXComponents(components) {
var contextComponents = react__WEBPACK_IMPORTED_MODULE_0__.useContext(MDXContext);
var allComponents = contextComponents;
if (components) {
allComponents = isFunction(components) ? components(contextComponents) : _objectSpread2(_objectSpread2({}, contextComponents), components);
}
return allComponents;
};
var MDXProvider = function MDXProvider(props) {
var allComponents = useMDXComponents(props.components);
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(MDXContext.Provider, {
value: allComponents
}, props.children);
};
var TYPE_PROP_NAME = 'mdxType';
var DEFAULTS = {
inlineCode: 'code',
wrapper: function wrapper(_ref) {
var children = _ref.children;
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(react__WEBPACK_IMPORTED_MODULE_0__.Fragment, {}, children);
}
};
var MDXCreateElement = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.forwardRef(function (props, ref) {
var propComponents = props.components,
mdxType = props.mdxType,
originalType = props.originalType,
parentName = props.parentName,
etc = _objectWithoutProperties(props, ["components", "mdxType", "originalType", "parentName"]);
var components = useMDXComponents(propComponents);
var type = mdxType;
var Component = components["".concat(parentName, ".").concat(type)] || components[type] || DEFAULTS[type] || originalType;
if (propComponents) {
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2(_objectSpread2({
ref: ref
}, etc), {}, {
components: propComponents
}));
}
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2({
ref: ref
}, etc));
});
MDXCreateElement.displayName = 'MDXCreateElement';
function createElement (type, props) {
var args = arguments;
var mdxType = props && props.mdxType;
if (typeof type === 'string' || mdxType) {
var argsLength = args.length;
var createElementArgArray = new Array(argsLength);
createElementArgArray[0] = MDXCreateElement;
var newProps = {};
for (var key in props) {
if (hasOwnProperty.call(props, key)) {
newProps[key] = props[key];
}
}
newProps.originalType = type;
newProps[TYPE_PROP_NAME] = typeof type === 'string' ? type : mdxType;
createElementArgArray[1] = newProps;
for (var i = 2; i < argsLength; i++) {
createElementArgArray[i] = args[i];
}
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, createElementArgArray);
}
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, args);
}
/***/ }),
/***/ 23715:
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
__webpack_require__.r(__webpack_exports__);
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
/* harmony export */ assets: () => (/* binding */ assets),
/* harmony export */ contentTitle: () => (/* binding */ contentTitle),
/* harmony export */ "default": () => (/* binding */ MDXContent),
/* harmony export */ frontMatter: () => (/* binding */ frontMatter),
/* harmony export */ metadata: () => (/* binding */ metadata),
/* harmony export */ toc: () => (/* binding */ toc)
/* harmony export */ });
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
/* harmony import */ var _mdx_js_react__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3905);
/* @jsxRuntime classic */ /* @jsx mdx */ /* @jsxFrag React.Fragment */ function _define_property(obj, key, value) {
if (key in obj) {
Object.defineProperty(obj, key, {
value: value,
enumerable: true,
configurable: true,
writable: true
});
} else {
obj[key] = value;
}
return obj;
}
function _object_spread(target) {
for(var i = 1; i < arguments.length; i++){
var source = arguments[i] != null ? arguments[i] : {};
var ownKeys = Object.keys(source);
if (typeof Object.getOwnPropertySymbols === "function") {
ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
return Object.getOwnPropertyDescriptor(source, sym).enumerable;
}));
}
ownKeys.forEach(function(key) {
_define_property(target, key, source[key]);
});
}
return target;
}
function ownKeys(object, enumerableOnly) {
var keys = Object.keys(object);
if (Object.getOwnPropertySymbols) {
var symbols = Object.getOwnPropertySymbols(object);
if (enumerableOnly) {
symbols = symbols.filter(function(sym) {
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
});
}
keys.push.apply(keys, symbols);
}
return keys;
}
function _object_spread_props(target, source) {
source = source != null ? source : {};
if (Object.getOwnPropertyDescriptors) {
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
} else {
ownKeys(Object(source)).forEach(function(key) {
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
});
}
return target;
}
function _object_without_properties(source, excluded) {
if (source == null) return {};
var target = _object_without_properties_loose(source, excluded);
var key, i;
if (Object.getOwnPropertySymbols) {
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
for(i = 0; i < sourceSymbolKeys.length; i++){
key = sourceSymbolKeys[i];
if (excluded.indexOf(key) >= 0) continue;
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
target[key] = source[key];
}
}
return target;
}
function _object_without_properties_loose(source, excluded) {
if (source == null) return {};
var target = {};
var sourceKeys = Object.keys(source);
var key, i;
for(i = 0; i < sourceKeys.length; i++){
key = sourceKeys[i];
if (excluded.indexOf(key) >= 0) continue;
target[key] = source[key];
}
return target;
}
const frontMatter = {
title: 'Updating the Rancher Certificate'
};
const contentTitle = undefined;
const metadata = {
"unversionedId": "getting-started/installation-and-upgrade/resources/update-rancher-certificate",
"id": "version-2.0-2.4/getting-started/installation-and-upgrade/resources/update-rancher-certificate",
"title": "Updating the Rancher Certificate",
"description": "Updating a Private CA Certificate",
"source": "@site/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/resources/update-rancher-certificate.md",
"sourceDirName": "getting-started/installation-and-upgrade/resources",
"slug": "/getting-started/installation-and-upgrade/resources/update-rancher-certificate",
"permalink": "/v2.0-v2.4/getting-started/installation-and-upgrade/resources/update-rancher-certificate",
"draft": false,
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/resources/update-rancher-certificate.md",
"tags": [],
"version": "2.0-2.4",
"lastUpdatedAt": 1705104464,
"formattedLastUpdatedAt": "Jan 13, 2024",
"frontMatter": {
"title": "Updating the Rancher Certificate"
},
"sidebar": "tutorialSidebar",
"previous": {
"title": "Upgrading Cert-Manager with Helm 2",
"permalink": "/v2.0-v2.4/getting-started/installation-and-upgrade/resources/upgrade-cert-manager-helm-2"
},
"next": {
"title": "Setting up Local System Charts for Air Gapped Installations",
"permalink": "/v2.0-v2.4/getting-started/installation-and-upgrade/resources/local-system-charts"
}
};
const assets = {};
const toc = [
{
value: 'Updating a Private CA Certificate',
id: 'updating-a-private-ca-certificate',
level: 2
},
{
value: '1. Create/update the certificate secret resource',
id: '1-createupdate-the-certificate-secret-resource',
level: 3
},
{
value: '2. Create/update the CA certificate secret resource',
id: '2-createupdate-the-ca-certificate-secret-resource',
level: 3
},
{
value: '3. Reconfigure the Rancher deployment',
id: '3-reconfigure-the-rancher-deployment',
level: 3
},
{
value: '4. Reconfigure Rancher agents to trust the private CA',
id: '4-reconfigure-rancher-agents-to-trust-the-private-ca',
level: 3
},
{
value: 'Why is this step required?',
id: 'why-is-this-step-required',
level: 4
},
{
value: 'Which method should I choose?',
id: 'which-method-should-i-choose',
level: 4
},
{
value: 'Method 1: Kubectl command',
id: 'method-1-kubectl-command',
level: 4
},
{
value: 'Method 2: Manually update checksum',
id: 'method-2-manually-update-checksum',
level: 4
},
{
value: 'Method 3: Recreate Rancher agents',
id: 'method-3-recreate-rancher-agents',
level: 4
},
{
value: 'Updating from a Private CA Certificate to a Common Certificate',
id: 'updating-from-a-private-ca-certificate-to-a-common-certificate',
level: 2
},
{
value: '1. Create/update the certificate secret resource',
id: '1-createupdate-the-certificate-secret-resource-1',
level: 3
},
{
value: '2. Delete the CA certificate secret resource',
id: '2-delete-the-ca-certificate-secret-resource',
level: 3
},
{
value: '3. Reconfigure the Rancher deployment',
id: '3-reconfigure-the-rancher-deployment-1',
level: 3
},
{
value: '4. Reconfigure Rancher agents for the non-private/common certificate',
id: '4-reconfigure-rancher-agents-for-the-non-privatecommon-certificate',
level: 3
}
];
const layoutProps = {
toc
};
const MDXLayout = "wrapper";
function MDXContent(_param) {
var { components } = _param, props = _object_without_properties(_param, [
"components"
]);
return /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)(MDXLayout, _object_spread_props(_object_spread({}, layoutProps, props), {
components: components,
mdxType: "MDXLayout"
}), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("head", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("link", {
rel: "canonical",
href: "https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/update-rancher-certificate"
})), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "updating-a-private-ca-certificate"
}, `Updating a Private CA Certificate`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Follow these steps to update the SSL certificate of the ingress in a Rancher `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/v2.0-v2.4/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/"
}, `high availability Kubernetes installation`), ` or to switch from the default self-signed certificate to a custom certificate.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `A summary of the steps is as follows:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
}, `Create or update the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "li"
}, `tls-rancher-ingress`), ` Kubernetes secret resource with the new certificate and private key.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
}, `Create or update the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "li"
}, `tls-ca`), ` Kubernetes secret resource with the root CA certificate (only required when using a private CA).`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
}, `Update the Rancher installation using the Helm CLI.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
}, `Reconfigure the Rancher agents to trust the new CA certificate.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The details of these instructions are below.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "1-createupdate-the-certificate-secret-resource"
}, `1. Create/update the certificate secret resource`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `First, concatenate the server certificate followed by any intermediate certificate(s) to a file named `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls.crt`), ` and provide the corresponding certificate key in a file named `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls.key`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you are switching the install from using the Rancher self-signed certificate or Let’s Encrypt issued certificates, use the following command to create the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls-rancher-ingress`), ` secret resource in your Rancher HA cluster:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ kubectl -n cattle-system create secret tls tls-rancher-ingress \\
--cert=tls.crt \\
--key=tls.key
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Alternatively, to update an existing certificate secret:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ kubectl -n cattle-system create secret tls tls-rancher-ingress \\
--cert=tls.crt \\
--key=tls.key \\
--dry-run --save-config -o yaml | kubectl apply -f -
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "2-createupdate-the-ca-certificate-secret-resource"
}, `2. Create/update the CA certificate secret resource`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If the new certificate was signed by a private CA, you will need to copy the corresponding root CA certificate into a file named `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `cacerts.pem`), ` and create or update the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls-ca secret`), ` in the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `cattle-system`), ` namespace. If the certificate was signed by an intermediate CA, then the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `cacerts.pem`), ` must contain both the intermediate and root CA certificates (in this order).`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To create the initial secret:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ kubectl -n cattle-system create secret generic tls-ca \\
--from-file=cacerts.pem
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To update an existing `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls-ca`), ` secret:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ kubectl -n cattle-system create secret generic tls-ca \\
--from-file=cacerts.pem \\
--dry-run --save-config -o yaml | kubectl apply -f -
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "3-reconfigure-the-rancher-deployment"
}, `3. Reconfigure the Rancher deployment`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("blockquote", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "blockquote"
}, `Before proceeding, `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/v2.0-v2.4/reference-guides/user-settings/api-keys#creating-an-api-key"
}, `generate an API token in the Rancher UI`), ` (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("b", null, `User > API & Keys`), `).`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This step is required if Rancher was initially installed with self-signed certificates (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ingress.tls.source=rancher`), `) or with a Let's Encrypt issued certificate (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ingress.tls.source=letsEncrypt`), `).`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `It ensures that the Rancher pods and ingress resources are reconfigured to use the new server and optional CA certificate.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To update the Helm deployment you will need to use the same (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `--set`), `) options that were used during initial installation. Check with:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ helm get values rancher -n cattle-system
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Also get the version string of the currently deployed Rancher chart:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ helm ls -A
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Upgrade the Helm application instance using the original configuration values and making sure to specify `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ingress.tls.source=secret`), ` as well as the current chart version to prevent an application upgrade.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If the certificate was signed by a private CA, add the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `set privateCA=true`), ` argument as well. Also make sure to read the documentation describing the initial installation using custom certificates.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `helm upgrade rancher rancher-stable/rancher \\
--namespace cattle-system \\
--version <DEPLOYED_CHART_VERSION> \\
--set hostname=rancher.my.org \\
--set ingress.tls.source=secret \\
--set ...
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When the upgrade is completed, navigate to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `https://<Rancher_SERVER>/v3/settings/cacerts`), ` to verify that the value matches the CA certificate written in the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls-ca`), ` secret earlier.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "4-reconfigure-rancher-agents-to-trust-the-private-ca"
}, `4. Reconfigure Rancher agents to trust the private CA`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This section covers three methods to reconfigure Rancher agents to trust the private CA. This step is required if either of the following is true:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Rancher was initially configured to use the Rancher self-signed certificate (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "li"
}, `ingress.tls.source=rancher`), `) or with a Let's Encrypt issued certificate (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "li"
}, `ingress.tls.source=letsEncrypt`), `)`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `The root CA certificate for the new custom certificate has changed`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
"id": "why-is-this-step-required"
}, `Why is this step required?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When Rancher is configured with a certificate signed by a private CA, the CA certificate chain is downloaded into Rancher agent containers. Agents compare the checksum of the downloaded certificate against the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `CATTLE_CA_CHECKSUM`), ` environment variable. This means that, when the private CA certificate is changed on Rancher server side, the environment variable `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `CATTLE_CA_CHECKSUM`), ` must be updated accordingly.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
"id": "which-method-should-i-choose"
}, `Which method should I choose?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Method 1 is the easiest one but requires all clusters to be connected to Rancher after the certificates have been rotated. This is usually the case if the process is performed right after updating the Rancher deployment (Step 3).`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If the clusters have lost connection to Rancher but you have `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "https://rancher.com/docs/rancher/v2.0-v2.4/en/cluster-admin/cluster-access/ace/"
}, `Authorized Cluster Endpoints`), ` enabled, then go with method 2.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Method 3 can be used as a fallback if method 1 and 2 are unfeasible.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
"id": "method-1-kubectl-command"
}, `Method 1: Kubectl command`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `For each cluster under Rancher management (including `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `local`), `) run the following command using the Kubeconfig file of the Rancher management cluster (RKE or K3S).`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `kubectl patch clusters <REPLACE_WITH_CLUSTERID> -p '{"status":{"agentImage":"dummy"}}' --type merge
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This command will cause all Agent Kubernetes resources to be reconfigured with the checksum of the new certificate.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
"id": "method-2-manually-update-checksum"
}, `Method 2: Manually update checksum`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Manually patch the agent Kubernetes resources by updating the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `CATTLE_CA_CHECKSUM`), ` environment variable to the value matching the checksum of the new CA certificate. Generate the new checksum value like so:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ curl -k -s -fL <RANCHER_SERVER>/v3/settings/cacerts | jq -r .value > cacert.tmp
$ sha256sum cacert.tmp | awk '{print $1}'
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Using a Kubeconfig for each downstream cluster update the environment variable for the two agent deployments.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ kubectl edit -n cattle-system ds/cattle-node-agent
$ kubectl edit -n cattle-system deployment/cluster-agent
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
"id": "method-3-recreate-rancher-agents"
}, `Method 3: Recreate Rancher agents`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `With this method you are recreating the Rancher agents by running a set of commands on a controlplane node of each downstream cluster.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `First, generate the agent definitions as described here: `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "https://gist.github.com/superseb/076f20146e012f1d4e289f5bd1bd4971"
}, `https://gist.github.com/superseb/076f20146e012f1d4e289f5bd1bd4971`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Then, connect to a controlplane node of the downstream cluster via SSH, create a Kubeconfig and apply the definitions:
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "https://gist.github.com/superseb/b14ed3b5535f621ad3d2aa6a4cd6443b"
}, `https://gist.github.com/superseb/b14ed3b5535f621ad3d2aa6a4cd6443b`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "updating-from-a-private-ca-certificate-to-a-common-certificate"
}, `Updating from a Private CA Certificate to a Common Certificate`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("blockquote", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "blockquote"
}, `It is possible to perform the opposite procedure as shown above: you may change from a private certificate to a common, or non-private, certificate. The steps involved are outlined below.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "1-createupdate-the-certificate-secret-resource-1"
}, `1. Create/update the certificate secret resource`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `First, concatenate the server certificate followed by any intermediate certificate(s) to a file named `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls.crt`), ` and provide the corresponding certificate key in a file named `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls.key`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you are switching the install from using the Rancher self-signed certificate or Let’s Encrypt issued certificates, use the following command to create the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls-rancher-ingress`), ` secret resource in your Rancher HA cluster:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ kubectl -n cattle-system create secret tls tls-rancher-ingress \\
--cert=tls.crt \\
--key=tls.key
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Alternatively, to update an existing certificate secret:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ kubectl -n cattle-system create secret tls tls-rancher-ingress \\
--cert=tls.crt \\
--key=tls.key \\
--dry-run --save-config -o yaml | kubectl apply -f -
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "2-delete-the-ca-certificate-secret-resource"
}, `2. Delete the CA certificate secret resource`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You will delete the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls-ca secret`), ` in the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `cattle-system`), ` namespace as it is no longer needed. You may also optionally save a copy of the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls-ca secret`), ` if desired.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To save the existing secret:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `kubectl -n cattle-system get secret tls-ca -o yaml > tls-ca.yaml
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To delete the existing `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `tls-ca`), ` secret:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `kubectl -n cattle-system delete secret tls-ca
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "3-reconfigure-the-rancher-deployment-1"
}, `3. Reconfigure the Rancher deployment`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("blockquote", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "blockquote"
}, `Before proceeding, `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "https://rancher.com/docs/rancher/v2.6/en/user-settings/api-keys/#creating-an-api-key"
}, `generate an API token in the Rancher UI`), ` (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("b", null, `User > API & Keys`), `) and save the Bearer Token which you might need in step 4.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This step is required if Rancher was initially installed with self-signed certificates (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ingress.tls.source=rancher`), `) or with a Let's Encrypt issued certificate (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ingress.tls.source=letsEncrypt`), `).`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `It ensures that the Rancher pods and ingress resources are reconfigured to use the new server and optional CA certificate.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To update the Helm deployment you will need to use the same (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `--set`), `) options that were used during initial installation. Check with:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ helm get values rancher -n cattle-system
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Also get the version string of the currently deployed Rancher chart:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `$ helm ls -A
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Upgrade the Helm application instance using the original configuration values and making sure to specify the current chart version to prevent an application upgrade.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Also make sure to read the documentation describing the initial installation using custom certificates.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `helm upgrade rancher rancher-stable/rancher \\
--namespace cattle-system \\
--version <DEPLOYED_CHART_VERSION> \\
--set hostname=rancher.my.org \\
--set ...
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `On upgrade, you can either`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "li"
}, `remove `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `--set ingress.tls.source=secret \\`), ` from the Helm upgrade command, as shown above, or`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "li"
}, `remove the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `privateCA`), ` parameter or set it to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `false`), ` because the CA is valid:`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
parentName: "pre"
}, `set privateCA=false
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "4-reconfigure-rancher-agents-for-the-non-privatecommon-certificate"
}, `4. Reconfigure Rancher agents for the non-private/common certificate`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `CATTLE_CA_CHECKSUM`), ` environment variable on the downstream cluster agents should be removed or set to "" (an empty string).`));
}
MDXContent.isMDXComponent = true;
/***/ })
}]);
Reference in New Issue View Git Blame Copy Permalink