Skip to content

OSDOCS-17121-4:CQA 2.0-Security-Certificates-Attachment5 #115151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tedaveryredhat wants to merge 1 commit into
base: main
Choose a base branch
from
+8 −12
Open

OSDOCS-17121-4:CQA 2.0-Security-Certificates-Attachment5 #115151

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion modules/customize-certificates-replace-default-router.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@
[id="replacing-default-ingress_{context}"]
= Replacing the default ingress certificate

You can replace the default ingress certificate for all applications under the `.apps` subdomain. After you replace the certificate, all applications, including the web console and CLI, have encryption provided by the specified certificate.
[role="_abstract"]
To secure the web console, CLI, and all applications under the .apps subdomain in {product-title}, you can replace the default ingress certificate by creating a TLS secret with your wildcard certificate and updating the Ingress Controller and cluster proxy configuration.

[NOTE]
====
Expand Down
14 changes: 3 additions & 11 deletions modules/customize-certificates-understanding-default-router.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,7 @@
[id="understanding-default-ingress_{context}"]
= Understanding the default ingress certificate

By default, {product-title} uses the Ingress Operator to
create an internal CA and issue a wildcard certificate that is valid for
applications under the `.apps` sub-domain. Both the web console and CLI
use this certificate as well.
[role="_abstract"]
The default ingress certificate in {product-title} is a wildcard certificate that the Ingress Operator issues from an internal CA for the web console, CLI, and applications under the .apps subdomain. You can replace it with a certificate from a public CA so that external clients connect securely to your applications.

The internal infrastructure CA certificates are self-signed.
While this process might be perceived as bad practice by some security or
PKI teams, any risk here is minimal. The only clients that implicitly
trust these certificates are other components within the cluster.
Replacing the default wildcard certificate with one that is issued by a
public CA already included in the CA bundle as provided by the container userspace
allows external clients to connect securely to applications running under the `.apps` sub-domain.
The internal infrastructure CA certificates are self-signed. While this process might be perceived as bad practice by some security or PKI teams, any risk here is minimal. The only clients that implicitly trust these certificates are other components within the cluster. Replacing the default wildcard certificate with one that is issued by a public CA already included in the CA bundle as provided by the container userspace allows external clients to connect securely to applications running under the `.apps` sub-domain.
3 changes: 3 additions & 0 deletions security/certificates/replacing-default-ingress-certificate.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@
include::_attributes/common-attributes.adoc[]
:context: replacing-default-ingress

[role="_abstract"]
To allow external clients to connect securely to applications under the .apps subdomain in {product-title}, you can replace the default wildcard ingress certificate with one issued by a trusted public CA.

toc::[]

include::modules/customize-certificates-understanding-default-router.adoc[leveloffset=+1]
Expand Down