Skip to content

Commit

Permalink
Update CYDEL01-cybsup01.md
Browse files Browse the repository at this point in the history
  • Loading branch information
olivierlemee authored Dec 19, 2024
1 parent bbcb6ba commit e2a32db
Showing 1 changed file with 3 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -80,11 +80,11 @@ If previous RKE2 version need to be uninstalled before defining the CA root, exe
See [RKE2 security certificates](https://docs.rke2.io/security/certificates) documentation for help.
- Create `/var/lib/rancher/rke2/server/tls` folder and copy into:
- custom domain certificate (e.g STAR_cybnity_tech.crt defining the SSL certificate for domain and/or sub-domains) as `root-ca.pem` renamed file
- private key of the custom domain (e.g private.key file of custom domain SSL certificate) as `root-ca.key` renamed file
- private key of the custom domain (e.g private.key file of custom domain SSL certificate) as `root-ca.key` renamed file.
- Generate custom CA certs and keys via command `curl -sL https://github.com/k3s-io/k3s/raw/master/contrib/util/generate-custom-ca-certs.sh | PRODUCT=rke2 bash -` and check text shown regarding the database updates applied with success (e.g new entries made) about CA certificate generation completed.
- As recommended by command result, store in a secure area the root and intermediate certificate files (.pem, .crt, .key) and remove them from __/var/lib/rancher/rke2/server/tls__ folder
- As recommended by command result, store in a secure area the root and intermediate certificate files (.pem, .crt, .key) and remove them from __/var/lib/rancher/rke2/server/tls__ folder.
- Create folder `mkdir -p /opt/rke2/server/tls`
- Copy current service-account signing key considerated like current via `cp /var/lib/rancher/rke2/server/tls/service.key /opt/rke2/server/tls`, to avoid token lost during future custom CA certificate rotation
- Copy current service-account signing key considerated like current via `cp /var/lib/rancher/rke2/server/tls/service.key /opt/rke2/server/tls`, to avoid token lost during future custom CA certificate rotation.

### RKE2 Installation
- As root user, set environment variable to use during RKE2 script installation execution via command:
Expand Down

0 comments on commit e2a32db

Please sign in to comment.