Please help with adding self signed certificates.

[adityaTor]

Hi i followed the instruction on Github , on how to add self signed cert. This is how i am doing it -
apiclient set \ pki.my-trusted-bundle.data="$(cat mycert.pem | base64)" \ pki.my-trusted-bundle.trusted=true

I have also tried doing it using this method - [settings.pki.my-trusted-bundle] data="W3N..." trusted=true but i am having no luck whatsoever. All i get is this error no matter what i try. Please help if you guys can. Unable to match your input to the data model. We may not have enough type information. Unable to deserialize into PemCertificateString: Invalid base64 input: Invalid byte 10. Please try the -ison input form. offset 76- Cause: Error deserializing scalar value:

[arnaldo2792]

Hi @adityaTor, could you please try to add the -w0 parameter to the base64 command? I had the same problem in my testing when I was implementing the feature in #1654, as you can see there I concatenated a few certificates like this:

# Save all certificates as a bundle
BUNDLE=$(cat $PERSISTENT_DIR/ca-1.crt $PERSISTENT_DIR/ca-2.crt $PERSISTENT_DIR/ca-3.crt | base64 -w0)
apiclient set pki.local-registry.data=$BUNDLE \
  pki.local-registry.trusted=true

[adityaTor]

I am trying to access the domain, from the control container. If that is wrong, how can i access it from the host directly without going through admin or control containers ?

[arnaldo2792]

If you are using curl in the control container you can do this as long as the control container is superpowered:

# From sheltie
apiclient set host-containers.control.superpowered=true

# In the control container once it starts:
curl --cacert /.bottlerocket/rootfs/etc/ssl/certs/ca-bundle.crt <domain>

[adityaTor]

snap! thank you so much that worked! But, if a pod in my cluster (which is running on a bottlerocket node) needs to get to the internet to pull images, will it still work ? since i only set the self signed certs to the host.

[arnaldo2792]

If you are pulling the images from a self-hosted container registry that uses your self-signed certificates, k8s will use the host's certificate store (the one you used in the curl command).

But if you are trying to access your domain from within a k8s orchestrated container, you should update the certificates store in the container, and the procedure changes depending on the distro that you are using.

[adityaTor]

Ok, thank you. I will try to launch a few containers and see its able to reach the internet to pull images.