第 3 章 Certificate types and descriptions
3.1. User-provided certificates for the API server
3.1.1. Purpose
The API server is accessible by clients external to the cluster at api.<cluster_name>.<base_domain>. You might want clients to access the API server at a different host name or without the need to distribute the cluster-managed certificate authority (CA) certificates to the clients. The administrator must set a custom default certificate to be used by the API server when serving content.
3.1.2. Location
The user-provided certificates must be provided in a kubernetes.io/tls type Secret in the openshift-config namespace. Update the API server cluster configuration, the apiserver/cluster resource, to enable the use of the user-provided certificate.
3.1.3. Management
User-provided certificates are managed by the user.
3.1.4. Expiration
API server client certificate expiration is less than five minutes.
User-provided certificates are managed by the user.
3.1.5. Customization
Update the secret containing the user-managed certificate as needed.
