Skip to content

Commit bfc12cb

Browse files
nalhadefnalhadef
committed
ocpbugs-8882: configure an addditionl clientca for the openshiftapi server
1 parent 9a0be7a commit bfc12cb

File tree

4 files changed

+120
-7
lines changed

4 files changed

+120
-7
lines changed

‎modules/configure-an-additional-clientCA.adoc‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/certificates/api-server.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="configure-an-additional-clientCA-for-the-OpenShift-API-server_{context}"]
7+
8+
= Configure an additional clientCA for the OpenShift API server
9+
10+
Optionally, you may choose to invalidate the installer-generated kubeconfig. You would do this when:
11+
12+
* You don't trust who installed the cluster
13+
* The kubeconfig is leaked
14+
* Other security-related needs exist, such as periodic rotation of the kubeconfig
15+
16+
To replace the installer-generated kubeconfig, remove the installer-generated clientCA from the API server
17+
18+
. Import an additional CA certificate in a configmap of the openshift-config namespace. The CA file must be in PEM format.
19+
+
20+
[source,terminal]
21+
----
22+
oc create configmap client-ca-custom -n openshift-config --from-file=ca-bundle.crt=ca.crt
23+
----
24+
+
25+
. Patch the APIServer instance.
26+
+
27+
[source, terminal]
28+
----
29+
oc patch apiserver cluster --type=merge -p '{"spec": {"clientCA": {"name": "client-ca-custom"}}}'
30+
----
31+
32+
. Test the new clientCA certificate with a certificate signed from the new clientCA.
33+
. If the test is successful, you can remove the installer-generated clientCA.
34+
35+

‎modules/customize-certificates-api-add-named.adoc‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,6 @@ certificate for the API server FQDN must be the first certificate in the file.
2222
It can then be followed with any intermediate certificates, and the file should
2323
end with the root CA certificate.
2424
25-
[WARNING]
26-
====
27-
Do not provide a named certificate for the internal load balancer (host
28-
name `api-int.<cluster_name>.<base_domain>`). Doing so will leave your
29-
cluster in a degraded state.
30-
====
31-
3225
.Procedure
3326

3427
. Login to the new API as the `kubeadmin` user.

‎modules/replace-the-certificate-authority-clientca.adoc‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/certificates/api-server.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="replace-the-certificate-authority_{context}"]
7+
8+
= Replace the installer-generated kubeconfig before replacing it with a newly generated CA certificate
9+
10+
The installer-generated kubeconfig cannot be removed, but it can be invalidated and replaced with a newly generated CA certificate.
11+
12+
You may choose to invalidate the installer-generated kubeconfig, stored in the `admin-kubeconfig-client-ca` configmap under the `openshift-config` namespace, when:
13+
14+
* You don't trust who installed the cluster
15+
* The kubeconfig is leaked
16+
* Other security-related needs exist, such as periodic rotation of the kubeconfig
17+
18+
[IMPORTANT]
19+
====
20+
To avoid being locked out of the cluster, have an alternative way to login, such as, using an OAuth-authenticated administrator user or using a client certificate signed by an additional client CA.
21+
====
22+
23+
.Procedure
24+
25+
. Optional: Generate a new self-signed CA, unless an existing corporate or other CA is to be used.
26+
+
27+
[source,terminal]
28+
----
29+
$ export NAME="custom"
30+
$ export CA_SUBJ="/OU=openshift/CN=admin-kubeconfig-signer-custom"
31+
32+
# set the CA validity to 10 years
33+
$ export VALIDITY=3650
34+
35+
# generate the CA private key
36+
$ openssl genrsa -out ${NAME}-ca.key 4096
37+
38+
# Create the CA certificate
39+
$ openssl req -x509 -new -nodes -key ${NAME}-ca.key -sha256 -days $VALIDITY -out ${NAME}-ca.crt -subj "${CA_SUBJ}"
40+
----
41+
+
42+
. Generate a new `system:admin` certificate. The client certificate must have the user into the x.509 subject CN field and the group into the O field.
43+
+
44+
[source,terminal]
45+
----
46+
$ export USER=system:admin
47+
$ export GROUP=system:masters
48+
$ export USER_SUBJ="/O=${GROUP}/CN=${USER}"
49+
50+
# create the user CSR
51+
$ openssl req -nodes -newkey rsa:2048 -keyout ${USER}.key -subj "${USER_SUBJ}" -out ${USER}.csr
52+
53+
# sign the user CSR and generate the certificate, the certificate must have the `clientAuth` extension
54+
$ openssl x509 -extfile <(printf "extendedKeyUsage = clientAuth") -req -in ${USER}.csr \
55+
-CA ${NAME}-ca.crt -CAkey ${NAME}-ca.key -CAcreateserial -out
56+
${USER}.crt -days $VALIDITY -sha256
57+
----
58+
+
59+
. Add the new certificate as an additional clientCA.
60+
+
61+
[source,terminal]
62+
----
63+
# create the client-ca ConfigMap"
64+
$ oc create configmap client-ca-custom -n openshift-config --from-file=ca-bundle.crt=${NAME}-ca.crt
65+
66+
# patch the APIServer
67+
$ oc patch apiserver cluster --type=merge -p '{"spec": {"clientCA": {"name": "client-ca-custom"}}}'
68+
----
69+
+
70+
. Import an additional CA certificate in a configmap of the openshift-config namespace. The CA file must be in PEM format.
71+
+
72+
[source,terminal]
73+
----
74+
$ oc create configmap admin-kubeconfig-client-ca -n openshift-config
75+
--from-file=ca-bundle.crt=new-ca.crt \
76+
--dry-run -o yaml | oc replace -f -
77+
----
78+

‎security/certificates/api-server.adoc‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,10 @@ API server's certificate by default. This certificate can be replaced
1212
by one that is issued by a CA that clients trust.
1313

1414
include::modules/customize-certificates-api-add-named.adoc[leveloffset=+1]
15+
16+
include::modules/configure-an-additional-clientCA.adoc[leveloffset=+1]
17+
18+
include::modules/replace-the-certificate-authority-clientca.adoc[leveloffset=+1]
19+
20+
21+

0 commit comments

Comments
 (0)