Red Hat Training

A Red Hat training course is available for OpenShift Container Platform

11.3. 在安装过程中配置自定义证书

在集群安装过程中，可以使用 openshift_master_named_certificates 和 openshift_master_overwrite_named_certificates 参数来配置自定义证书，它们可在清单文件中配置。有关使用 Ansible 配置自定义证书 的更多详细信息。

自定义证书配置参数

openshift_master_overwrite_named_certificates=true 1
openshift_master_named_certificates=[{"certfile": "/path/on/host/to/crt-file", "keyfile": "/path/on/host/to/key-file", "names": ["public-master-host.com"], "cafile": "/path/on/host/to/ca-file"}] 2
openshift_hosted_router_certificate={"certfile": "/path/on/host/to/app-crt-file", "keyfile": "/path/on/host/to/app-key-file", "cafile": "/path/on/host/to/app-ca-file"} 3

1
如果您为 openshift_master_named_certificates 参数提供值，请将此参数设置为 true。
2
置备 主 API 证书。如有必要，将组成 证书链 的所有必需文件串联为提供给 certFile 参数的证书文件。
3
置备 路由器通配符证书。

master API 证书的参数示例： 

openshift_master_overwrite_named_certificates=true
openshift_master_named_certificates=[{"names": ["master.148.251.233.173.nip.io"], "certfile": "/home/cloud-user/master.148.251.233.173.nip.io.cert.pem", "keyfile": "/home/cloud-user/master.148.251.233.173.nip.io.key.pem", "cafile": "/home/cloud-user/master-bundle.cert.pem"}]

路由器通配符证书的参数示例： 

openshift_hosted_router_certificate={"certfile": "/home/cloud-user/star-apps.148.251.233.173.nip.io.cert.pem", "keyfile": "/home/cloud-user/star-apps.148.251.233.173.nip.io.key.pem", "cafile": "/home/cloud-user/ca-chain.cert.pem"}