在 Rancher 中将证书管理器用于自签名证书

Question

I'm using Rancher for my PoC. As part of stack I'm using harbor as helm chart registry and container registry. I'm following this tutorial about how to configure self signed certificate in Ranchor for Harbor in this case.

I'm interested about how to use cert-manager for managing self-signed certificate in any cluster in Rancher. Currently cert-manager is running in rancher cluster (because rancher is using self-signed certificate too). Have I install cert-manager in all of my clusters in which I need to have an integration with Harbor. Since certificate is currently not configured, I'm always getting that error x509: certificate signed by unknown authority .

Answer 1

Check if, in the context of your tutorial, the page " Updating a Private CA Certificate "

It includes "Reconfigure Rancher agents to trust the private CA"

For each cluster under Rancher management (except the local Rancher management cluster) run the following command using the Kubeconfig file of the Rancher management cluster (RKE or K3S).

 kubectl patch clusters.management.cattle.io <REPLACE_WITH_CLUSTERID> \ -p '{"status":{"agentImage":"dummy"}}' --type merge

This command will cause all Agent Kube.netes resources to be reconfigured with the checksum of the new certificate.