Red Hat OpenShift Container Platform

Add the service CA bundle to a config map

To verify TLS connections to services that use serving certificates in Red Hat OpenShift Container Platform, you can inject the service Certificate Authority (CA) certificate into a config map. Annotate the config map so that pods can mount the CA bundle from the service-ca.crt key.

After adding this annotation to a config map, the OpenShift Service CA Operator deletes all the data in the config map. Consider using a separate config map to contain the service-ca.crt, instead of using the same config map that stores your pod configuration.

Procedure

Annotate the config map with the service.beta.openshift.io/inject-cabundle=true annotation by entering the following command:

$ oc annotate configmap <config_map_name> \
     service.beta.openshift.io/inject-cabundle=true

Replace <config_map_name> with the name of the config map to annotate.

Explicitly referencing the service-ca.crt key in a volume mount prevents a pod from starting until the config map has been injected with the CA bundle. You can override this behavior by setting the optional parameter to true in the serving certificate configuration of the volume.

View the config map to ensure that the service CA bundle has been injected:
```
$ oc get configmap <config_map_name> -o yaml
```
The CA bundle is displayed as the value of the service-ca.crt key in the YAML output:
```
apiVersion: v1
data:
  service-ca.crt: |
    -----BEGIN CERTIFICATE-----
...
```

Mount the config map as a volume to each container that exists in a pod by configuring your Deployment object.

Example Deployment object that defines the volume for the mounted config map

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-example-custom-ca-deployment
  namespace: my-example-custom-ca-ns
spec:
  ...
    spec:
      ...
      containers:
        - name: my-container-that-needs-custom-ca
          volumeMounts:
          - name: trusted-ca
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
      volumes:
      - name: trusted-ca
        configMap:
          name: <config_map_name>
          items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem
# ...

where:

<config_map_name>: Specifies the name of the config map that you annotated in an earlier step of the procedure.
ca-bundle.crt: Specifies the ConfigMap key. This is required.
tls-ca-bundle.pem: Specifies the ConfigMap path. This is required.