Skip to content

[GH#87271] Add information about the openshift-service-ca.crt ConfigMap #87272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

[GH#87271] Add information about the openshift-service-ca.crt ConfigMap #87272

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1f2eca6
Add information about the openshift-service-ca.crt ConfigMap
Jamstah Jan 20, 2025
3ec9a6e
RedHat.CaseSensitiveTerms: Use 'config map' rather than 'configmap'
Jamstah Jan 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions modules/customize-certificates-access-default-service-serving-configmap.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
// Module included in the following assemblies:
//
// * security/certificates/service-serving-certificate.adoc

:_mod-docs-content-type: PROCEDURE
[id="access-default-service-serving-configmap_{context}"]
= Access the service CA bundle in the default config map

A pod can access the service CA certificate by mounting the default
`ConfigMap` object that exists in every project. The service CA
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"project" and "namespace" are synonyms in OpenShift, but using namespace is more consistent with Kubernetes docs. You might clarify: “…exists in every namespace (project).”

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Current step shows how to verify the config map exists, and better to expand this with a second step showing how to actually consume it inside a Pod.
2. Mount the config map into your pod so that applications can use the CA to validate TLS connections. Add a volume and volume mount in your pod specification:

apiVersion: v1
kind: Pod
metadata:
  name: service-ca-example
spec:
  containers:
  - name: app
    image: registry.redhat.io/ubi9/ubi-minimal
    command: ["/bin/sh", "-c", "sleep 3600"]
    volumeMounts:
    - name: service-ca
      mountPath: /var/run/configmaps/service-ca
      readOnly: true
  volumes:
  - name: service-ca
    configMap:
      name: openshift-service-ca.crt

And step 3, include a verification workflow.
3. Test the CA with a TLS connection to a service that is using an OpenShift-issued serving certificate. For example, if you have a service named my-service in the same namespace, you can run the following command inside the pod:

curl --cacert /var/run/configmaps/service-ca/service-ca.crt https://my-service:443

If the connection succeeds without certificate errors, the service CA bundle is working correctly.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another thing, do we have a html version link to review.

Copy link
Contributor

@ibihim ibihim Aug 29, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the only important thing is that we show them that this configmap exists and that it has a particular key and the value has a PEM header.

How to mount that configmap might be good to reference, but if one would add it there, it might be a little off-topic.

certificate is in the `service-ca.crt` key of the `openshift-service-ca.crt`
config map. Access to this CA certificate allows TLS clients to verify
connections to services using service serving certificates.

.Procedure

. View the config map to ensure that the service CA bundle is available:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I checked the code and the configmap must be there. If it gets deleted it gets recreated. So there is no direct point in checking that it is there. But there is value in showing the configmap, its name and the key / pem encoding.

+
[source,terminal]
----
$ oc get configmap openshift-service-ca.crt -o yaml
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably needs a namespace set here?

Copy link
Contributor

@ibihim ibihim Aug 29, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, in the context of mounting that configmap it would be necessary to use a specific namespace.

If you don't specify any, it returns the one on the default namespace / current project, so it works, but we can't be sure, that this is from the current project.

----
+
The CA bundle is displayed as the value of the `service-ca.crt` key in the YAML output:
+
[source,terminal]
----
apiVersion: v1
data:
service-ca.crt: |
-----BEGIN CERTIFICATE-----
...
----
2 changes: 2 additions & 0 deletions security/certificates/service-serving-certificate.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ include::modules/customize-certificates-add-service-serving.adoc[leveloffset=+1]
.Additional resources
* You can use a service certificate to configure a secure route using reencrypt TLS termination. For more information, see xref:../../networking/routes/secured-routes.adoc#nw-ingress-creating-a-reencrypt-route-with-a-custom-certificate_secured-routes[Creating a re-encrypt route with a custom certificate].

include::modules/customize-certificates-access-default-service-serving-configmap.adoc[leveloffset=+1]

include::modules/customize-certificates-add-service-serving-configmap.adoc[leveloffset=+1]

include::modules/customize-certificates-add-service-serving-apiservice.adoc[leveloffset=+1]
Expand Down