Question about certificates signed by a internal CA

GabrielKM · September 11, 2019, 8:11pm

It’s supported use a certificate signed by a internal certificate authority on rancher server ? How to add the internal CA chain to the rancher containers ?

Thanks

Arash_Kaffamanesh · September 16, 2019, 6:25pm

Hi Gabriel,

Yes, for single node you can see here how you can use private CA:
https://rancher.com/docs/rancher/v2.x/en/installation/single-node/

If you deploy Rancher on k8s with helm for example you can set privateCA=true:

helm install --name rancher rancher-latest/rancher --namespace cattle-system --set hostname=node2 --set ingress.tls.source=secret --set privateCA=true

Have a look on this implementation, I’m using privateCA:

github.com

arashkaffamanesh/multipass-k3s-rancher/blob/master/3-deploy-rancher-on-k3s.sh

#!/bin/bash
export KUBECONFIG=k3s.yaml
kubectl -n kube-system create serviceaccount tiller
kubectl create clusterrolebinding tiller --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
curl -LO https://git.io/get_helm.sh
chmod 700 get_helm.sh
./get_helm.sh
helm init --service-account tiller
kubectl rollout status deployment tiller-deploy -n kube-system
# sleep 60
#helm install stable/cert-manager --name cert-manager --namespace kube-system --version v0.5.2
#sleep 60
#kubectl -n kube-system rollout status deploy/cert-manager
helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
kubectl create ns cattle-system
kubectl -n cattle-system create secret generic tls-ca --from-file=./ca/rancher/cacerts.pem
kubectl -n cattle-system create secret tls tls-rancher-ingress --cert=./ca/rancher/cert.pem --key=./ca/rancher/key.pem
kubectl get secrets -n cattle-system
# using slef signed private CA certificate
helm install --name rancher rancher-latest/rancher --namespace cattle-system --set hostname=node2  --set ingress.tls.source=secret --set privateCA=true

This file has been truncated. show original

Cheers,
Arash

superseb · September 17, 2019, 10:51am

Please see the docs on using private CA on https://rancher.com/docs/rancher/v2.x/en/installation/ha/helm-rancher/#certificates-from-files and https://rancher.com/docs/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/

Topic		Replies	Views
Rancher PrivateCA Rancher 2.x	8	4959	February 11, 2020
Rancher 2.xdocker install single node Rancher 2.x	3	370	June 18, 2021
How to use self signed certificates helm catalog? Rancher 2.x	1	1546	July 13, 2021
Rancher2 installation in Kubernetes - with a self-signed certificate Rancher 2.x	2	256	April 14, 2023
Got an issue when installing rancher HA on kubernetes with self-signed CA	2	902	April 11, 2023

Question about certificates signed by a internal CA

Related Topics