mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-11-06 08:56:00 +00:00
1 line
6.9 KiB
JavaScript
1 line
6.9 KiB
JavaScript
"use strict";(self.webpackChunkrancher_docs=self.webpackChunkrancher_docs||[]).push([[87302],{3905:(e,t,n)=>{n.d(t,{Zo:()=>p,kt:()=>h});var a=n(67294);function r(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,a)}return n}function c(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?i(Object(n),!0).forEach((function(t){r(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):i(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,a,r=function(e,t){if(null==e)return{};var n,a,r={},i=Object.keys(e);for(a=0;a<i.length;a++)n=i[a],t.indexOf(n)>=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(a=0;a<i.length;a++)n=i[a],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var o=a.createContext({}),l=function(e){var t=a.useContext(o),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},p=function(e){var t=l(e.components);return a.createElement(o.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},u=a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,o=e.parentName,p=s(e,["components","mdxType","originalType","parentName"]),u=l(n),h=r,m=u["".concat(o,".").concat(h)]||u[h]||d[h]||i;return n?a.createElement(m,c(c({ref:t},p),{},{components:n})):a.createElement(m,c({ref:t},p))}));function h(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,c=new Array(i);c[0]=u;var s={};for(var o in t)hasOwnProperty.call(t,o)&&(s[o]=t[o]);s.originalType=e,s.mdxType="string"==typeof e?e:r,c[1]=s;for(var l=2;l<i;l++)c[l]=n[l];return a.createElement.apply(null,c)}return a.createElement.apply(null,n)}u.displayName="MDXCreateElement"},65730:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>o,contentTitle:()=>c,default:()=>d,frontMatter:()=>i,metadata:()=>s,toc:()=>l});var a=n(87462),r=(n(67294),n(3905));const i={title:"Adding Kubernetes TLS Secrets",description:"Read about how to populate the Kubernetes TLS secret for a Rancher installation"},c=void 0,s={unversionedId:"getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/tls-secrets",id:"version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/tls-secrets",title:"Adding Kubernetes TLS Secrets",description:"Read about how to populate the Kubernetes TLS secret for a Rancher installation",source:"@site/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/tls-secrets.md",sourceDirName:"getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher",slug:"/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/tls-secrets",permalink:"/v2.0-v2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/tls-secrets",draft:!1,editUrl:"https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/tls-secrets.md",tags:[],version:"2.0-2.4",lastUpdatedAt:1675192695,formattedLastUpdatedAt:"Jan 31, 2023",frontMatter:{title:"Adding Kubernetes TLS Secrets",description:"Read about how to populate the Kubernetes TLS secret for a Rancher installation"},sidebar:"tutorialSidebar",previous:{title:"4. Install Rancher",permalink:"/v2.0-v2.4/pages-for-subheaders/helm-rancher"},next:{title:"Chart Options",permalink:"/v2.0-v2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/chart-options"}},o={},l=[{value:"Using a Private CA Signed Certificate",id:"using-a-private-ca-signed-certificate",level:3}],p={toc:l};function d(e){let{components:t,...n}=e;return(0,r.kt)("wrapper",(0,a.Z)({},p,n,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("p",null,"Kubernetes will create all the objects and services for Rancher, but it will not become available until we populate the ",(0,r.kt)("inlineCode",{parentName:"p"},"tls-rancher-ingress")," secret in the ",(0,r.kt)("inlineCode",{parentName:"p"},"cattle-system")," namespace with the certificate and key."),(0,r.kt)("p",null,"Combine the server certificate followed by any intermediate certificate(s) needed into a file named ",(0,r.kt)("inlineCode",{parentName:"p"},"tls.crt"),". Copy your certificate key into a file named ",(0,r.kt)("inlineCode",{parentName:"p"},"tls.key"),"."),(0,r.kt)("p",null,"Use ",(0,r.kt)("inlineCode",{parentName:"p"},"kubectl")," with the ",(0,r.kt)("inlineCode",{parentName:"p"},"tls")," secret type to create the secrets."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"kubectl -n cattle-system create secret tls tls-rancher-ingress \\\n --cert=tls.crt \\\n --key=tls.key\n")),(0,r.kt)("blockquote",null,(0,r.kt)("p",{parentName:"blockquote"},(0,r.kt)("strong",{parentName:"p"},"Note:")," If you want to replace the certificate, you can delete the ",(0,r.kt)("inlineCode",{parentName:"p"},"tls-rancher-ingress")," secret using ",(0,r.kt)("inlineCode",{parentName:"p"},"kubectl -n cattle-system delete secret tls-rancher-ingress")," and add a new one using the command shown above. If you are using a private CA signed certificate, replacing the certificate is only possible if the new certificate is signed by the same CA as the certificate currently in use.")),(0,r.kt)("h3",{id:"using-a-private-ca-signed-certificate"},"Using a Private CA Signed Certificate"),(0,r.kt)("p",null,"If you are using a private CA, Rancher requires a copy of the private CA's root certificate or certificate chain, which the Rancher Agent uses to validate the connection to the server."),(0,r.kt)("p",null,"Create a file named ",(0,r.kt)("inlineCode",{parentName:"p"},"cacerts.pem")," that only contains the root CA certificate or certificate chain from your private CA, and use ",(0,r.kt)("inlineCode",{parentName:"p"},"kubectl")," to create the ",(0,r.kt)("inlineCode",{parentName:"p"},"tls-ca")," secret in the ",(0,r.kt)("inlineCode",{parentName:"p"},"cattle-system")," namespace."),(0,r.kt)("blockquote",null,(0,r.kt)("p",{parentName:"blockquote"},(0,r.kt)("strong",{parentName:"p"},"Important:")," Make sure the file is called ",(0,r.kt)("inlineCode",{parentName:"p"},"cacerts.pem")," as Rancher uses that filename to configure the CA certificate.")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"kubectl -n cattle-system create secret generic tls-ca \\\n --from-file=cacerts.pem\n")))}d.isMDXComponent=!0}}]); |