为群集添加可信 CA

要在 Red Hat OpenShift on IBM Cloud 集群中添加受信任的 CA，需要创建包含 CA 证书的配置图，并部署在所有工作节点上安装证书的守护进程。

开始之前，请确保已准备好 CA 证书文件。 该证书必须采用 PEM 格式。

1. 使用 CA 证书创建 openshift-config-user-ca-bundle configmap。 将 <path-to-your-ca-cert> 替换为 CA 证书文件的路径。

   kubectl create cm openshift-config-user-ca-bundle -n kube-system --from-file=openshift-config-user-ca-bundle.crt=<path-to-your-ca-cert>
   

2. 创建在每个节点上安装可信 CA 的脚本。

   cat > openshift-config-user-ca-script.sh <<EOF
   #!/bin/bash
   set -e  # Exit on any error
   set -x  # Enable debug output
   if ! diff /tmp/openshift-config-user-ca-bundle/openshift-config-user-ca-bundle.crt /host/etc/pki/ca-trust/source/anchors ; then
       cp /tmp/openshift-config-user-ca-bundle/openshift-config-user-ca-bundle.crt /host/etc/pki/ca-trust/source/anchors
       chroot /host update-ca-trust extract
       if chroot /host systemctl is-enabled coreos-update-ca-trust.service; then
           chroot /host systemctl restart coreos-update-ca-trust.service
       fi
       chroot /host systemctl restart crio.service;
   fi
   # Keep container running to maintain daemonset pod
   sleep inf
   EOF
   kubectl delete cm -n kube-system openshift-config-user-ca-script --ignore-not-found
   kubectl create cm -n kube-system --from-file openshift-config-user-ca-script.sh openshift-config-user-ca-script
   

3. 创建在所有节点上运行脚本的守护进程集。

   OCP_REGISTRY_ENDPOINT=$(kubectl get pod -n kube-system -l k8s-app=kube-apiserver-proxy -o json | jq -r '.items[0].spec.containers[0].image | select( . != null )' | awk -F/ '{ print $1 }')
   if [[ -z "${OCP_REGISTRY_ENDPOINT}" ]]; then
       OCP_REGISTRY_ENDPOINT=$(kubectl get pod -n kube-system -l app=ibm-master-proxy-static -o json | jq -r '.items[0].spec.containers[0].image | select( . != null )' | awk -F/ '{ print $1 }')
   fi
   OCP_VERSION=$(oc version -o json | jq -r .openshiftVersion)
   kubectl apply -f - <<EOF
   ---
   apiVersion: apps/v1
   kind: DaemonSet
   metadata:
     name: update-openshift-config-user-ca-bundle
     namespace: kube-system
     labels:
       app: update-openshift-config-user-ca-bundle
   spec:
     selector:
       matchLabels:
         app: update-openshift-config-user-ca-bundle
     template:
       metadata:
         labels:
           app: update-openshift-config-user-ca-bundle
       spec:
         containers:
           - command: ["/bin/bash", "-c", "/tmp/openshift-config-user-ca-script/openshift-config-user-ca-script.sh"]
             image: ${OCP_REGISTRY_ENDPOINT}/armada-master/ocp-release-${OCP_VERSION}-x86_64:cli
             imagePullPolicy: IfNotPresent
             name: update-openshift-config-user-ca-bundle
             resources:
               requests:
                 cpu: 1m
                 memory: 1Mi
             securityContext:
               privileged: true
             volumeMounts:
               - name: host-volume
                 mountPath: /host
               - name: openshift-config-user-ca-bundle
                 mountPath: /tmp/openshift-config-user-ca-bundle
               - name: openshift-config-user-ca-script
                 mountPath: /tmp/openshift-config-user-ca-script
         hostIPC: true
         hostNetwork: true
         hostPID: true
         tolerations:
         - operator: Exists
         volumes:
           - name: host-volume
             hostPath:
               path: /
               type: Directory
           - name: openshift-config-user-ca-bundle
             configMap:
               name: openshift-config-user-ca-bundle
           - name: openshift-config-user-ca-script
             configMap:
               name: openshift-config-user-ca-script
               defaultMode: 0755
   EOF
   kubectl rollout status ds -n kube-system update-openshift-config-user-ca-bundle
   

4. 通过检查守护进程日志来验证是否安装了可信 CA。

   oc logs -n kube-system -l app=update-openshift-config-user-ca-bundle --tail=-1
   

守护进程设置完成后，您的受信任 CA 将安装在所有工作节点上，您的集群就可以从使用由自定义 CA 签发的证书的注册表中提取映像。