diff options
| -rw-r--r-- | docs/webservices.txt | 39 |
1 files changed, 38 insertions, 1 deletions
diff --git a/docs/webservices.txt b/docs/webservices.txt index 8fad471..f535d46 100644 --- a/docs/webservices.txt +++ b/docs/webservices.txt @@ -1,3 +1,5 @@ +Architecture +============ - The users are not directly connected to the services running in OpenShift. There is always load-balancing HAProxy sitting in between. There is several implications: * The service will get request from HAProxy IP. I.e. IP-based authentication is not possible @@ -13,4 +15,39 @@ in the route specification. With 'passthrough' the container is expected to handle certificates itself. In the edge termination mode, the certificates are configured in the route and HAProxy manages secure communication with clients and provides unencrypted data to the service in the cluster. -
\ No newline at end of file + + +Updating/Generating certificates for the router +=============================================== + - Generating key & csr request + openssl genrsa -out kaas.key 4096 + openssl req -new -key kaas.key -sha256 -nodes -out kaas.csr -config <( + cat <<-EOF + [ req ] + default_bits = 4096 + req_extensions = req_ext + ... + + [ dn ] + CN=kaas.kit.edu + ... + + [ req_ext ] + subjectAltName = @alt_names + + [ alt_names ] + DNS.1 = kaas.kit.edu + DNS.2 = *.kaas.kit.edu + EOF + ) + - Installing + * Two files are needed. + 1) Secret Key + 2) PEM file containing both certificate and secret key. No CA certificate is needed (at least if our + certifcate is signed by known CA) + * New 'router-certs' secret should be created in 'default' namespace. Probably it is better to + modify existing secret than delete/create. However, the strings can't just be copied. Easiest way + is to create a new secret in temporary namespace: + oc -n test secrets new router-certs tls.crt=kaas.pem tls.key=kaas.key + and then copy 'tls.crt' and 'tls.key' values over. + * To reload secret, the 'router' pods should be deleted (and automatically re-created by rc). |