mirror of https://github.com/crossplane/docs.git
55 lines
2.1 KiB
Markdown
55 lines
2.1 KiB
Markdown
<!-- vale Google.Headings = NO -->
|
|
<!-- vale Microsoft.HeadingAcronyms = NO -->
|
|
---
|
|
title: Self-signed CA certs
|
|
weight: 270
|
|
description: "Configure Crossplane with self-signed certificates"
|
|
---
|
|
<!-- vale Google.Headings = YES -->
|
|
<!-- vale Microsoft.HeadingAcronyms = YES -->
|
|
|
|
> Using self-signed certificates isn't advised in production, it's
|
|
recommended to only use self-signed certificates for testing.
|
|
|
|
When Crossplane loads Configuration and Provider Packages from private
|
|
registries, you must configure it to trust the CA and Intermediate certs.
|
|
|
|
You need to install Crossplane via the Helm chart with the
|
|
`registryCaBundleConfig.name` and `registryCaBundleConfig.key` parameters
|
|
defined. See [Install Crossplane]({{<ref "../get-started/install" >}}).
|
|
|
|
## Configure
|
|
|
|
1. Create a CA Bundle (A file containing your Root and Intermediate
|
|
certificates in a specific order). You can do this with any text editor or
|
|
from the command line, so long as the resulting file contains all required crt
|
|
files in the proper order. Often, this is either a single
|
|
self-signed Root CA crt file, or an Intermediate crt and Root crt file. The
|
|
order of the crt files should be from lowest to highest in signing order.
|
|
For example, if you have a chain of two certificates below your Root
|
|
certificate, you place the bottom level Intermediate cert at the beginning of
|
|
the file, then the Intermediate cert that singed that cert, then the Root cert
|
|
that signed that cert.
|
|
|
|
2. Save the files as `[yourdomain].ca-bundle`.
|
|
|
|
3. Create a Kubernetes ConfigMap in your Crossplane system namespace:
|
|
|
|
```
|
|
kubectl -n [Crossplane system namespace] create cm ca-bundle-config \
|
|
--from-file=ca-bundle=./[yourdomain].ca-bundle
|
|
```
|
|
|
|
4. Set the `registryCaBundleConfig.name` Helm chart parameter to
|
|
`ca-bundle-config` and the `registryCaBundleConfig.key` parameter to
|
|
`ca-bundle`.
|
|
|
|
> The Helm docs cover providing Helm with parameter values,
|
|
[Helm install](https://helm.sh/docs/helm/helm_install/). An example block
|
|
in an `override.yaml` file would look like this:
|
|
```
|
|
registryCaBundleConfig:
|
|
name: ca-bundle-config
|
|
key: ca-bundle
|
|
```
|