Search <book_title>...

Veritas InfoScale™ for Kubernetes Environments 8.0.200 - Linux

Last Published: 2023-02-21

Product(s): InfoScale & Storage Foundation (8.0.200)

Platform: Linux

Adding a custom CA certificate

As a prerequisite, download the following packages from github.com repository by using python-pip.

Tools

cfssl
cfssl-certinfo
cfssljson

Complete the following steps

On the bastion node, create a directory - custom-ca. Navigate to this directory to perform the next steps.

Copy the following content into a file and save it as vxconfig.json.

{
  "signing": {
    "default": {
      "expiry": "43800h"
    },
    "profiles": {
      "cluster": {
        "expiry": "8760h",
        "usages": [
          "signing",
          "key encipherment",
          "cert sign",
          "server auth",
          "client auth"
        ],
        "ca_constraint": {
          "is_ca": true
        }
      }
    }
  }
}

Copy the following content into a file and save it as csr_config.json.

{
  "CN": "infoscale-ca",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "hosts": [
    "kubernetes"
  ],
  "names": [
    {
      "O": "system:nodes",
      "OU": "vx"
    }
  ]
}

Run the following command to generate certificates.

cfssl genkey csr_config.json | cfssljson -bare infoscale-ca

Review output similar to the following output

2022/02/10 15:09:27 [INFO] generate received request
2022/02/10 15:09:27 [INFO] received CSR
2022/02/10 15:09:27 [INFO] generating key: rsa-2048
2022/02/10 15:09:28 [INFO] encoded CSR

Now you must sign the certificate you just generated. Run the following command.
cfssl sign -ca /etc/kubernetes/pki/ca.crt -ca-key /etc/kubernetes/pki/ca.key -hostname kubernetes -config ./vxconfig.json -profile cluster ./infoscale-ca.csr | cfssljson -bare infoscale-ca
Run ls to list files in the folder.
Following files must be created
```
infoscale-ca.csr  infoscale-ca-key.pem  infoscale-ca.pem
```
Here , infoscale-ca.pem is the external CA certificate.

Copy the following content into a file and save it as custom-ca.yaml.

apiVersion: v1
kind: Namespace
metadata:
  labels:
    control-plane: infoscale-sds-operator
  name: infoscale-vtas
---
apiVersion: v1
kind: Secret
metadata:
  name: infoscale-ca
  namespace: infoscale-vtas
type: kubernetes.io/tls
data:
  ca.crt: $(oc get cm kube-root-ca.crt -o 
            jsonpath="{.data['ca\.crt']}"| base64 -w0)
  tls.crt: $(base64 ./infoscale-ca.pem | tr -d '\n')
  tls.key: $(base64 ./infoscale-ca-key.pem | tr -d '\n')

You have to replace content for ca.crt, tls.crt, and tls.key.

Run
oc get cm kube-root-ca.crt -o jsonpath="{.data['ca\.crt']}" | base64 -w0
Copy the output of this command as
```
<Content of ca.crt>
```

Modify custom-ca.yaml as under

apiVersion: v1
kind: Namespace
metadata:
  labels:
    control-plane: infoscale-sds-operator
  name: infoscale-vtas
---
apiVersion: v1
kind: Secret
metadata:
  name: infoscale-ca
  namespace: infoscale-vtas
type: kubernetes.io/tls
data:
  ca.crt: <Content of ca.crt>
  tls.crt: $(base64 ./infoscale-ca.pem | tr -d '\n')
  tls.key: $(base64 ./infoscale-ca-key.pem | tr -d '\n')

Similarly, run
base64 ./infoscale-ca.pem | tr -d '\n' and update tls.crt in custom-ca.yaml with the output of this command.
Run
base64 ./infoscale-ca-key.pem | tr -d '\n' and update tls.key in custom-ca.yaml with the output of this command.

Ensure that custom-ca.yaml is as under

apiVersion: v1
kind: Namespace
metadata:
  labels:
    control-plane: infoscale-sds-operator
  name: infoscale-vtas
---
apiVersion: v1
kind: Secret
metadata:
  name: infoscale-ca
  namespace: infoscale-vtas
type: kubernetes.io/tls
data:
  ca.crt: <Content of ca.crt>
  tls.crt: <Content of tls.crt>
  tls.key: <Content of tls.key>

Run oc apply -f custom-ca.yaml.
If you are configuring DR, copy this custom-ca.yaml to the DR cluster.
Run oc apply -f custom-ca.yaml on the DR cluster before applying license.

After custom-ca.yaml is successfully applied, you can apply iso.yaml. See the Installation section.