Skip to content

[enterprise-4.9] Custom certs for the oAuth server route #34077

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

[enterprise-4.9] Custom certs for the oAuth server route #34077

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions authentication/configuring-internal-oauth.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,4 +17,6 @@ include::modules/oauth-configuring-token-inactivity-timeout.adoc[leveloffset=+1]

include::modules/oauth-server-metadata.adoc[leveloffset=+1]

include::modules/oauth-customizing-the-oauth-server-URL.adoc[leveloffset=+1]

include::modules/oauth-troubleshooting-api-events.adoc[leveloffset=+1]
36 changes: 36 additions & 0 deletions modules/oauth-customizing-the-oauth-server-URL.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
// Module included in the following assemblies:
//
// * authentication/configuring-internal-oauth.adoc

[id="customizing-the-oauth-server-url_{context}"]
= Customizing OAuth server URL

The OAuth server route can be customized using the `ingress` config route configuration API. A custom hostname and a TLS certificate can be set using the `spec.componentRoutes` part of the configuration.

[id="customizing-the-openshift-integrated-oauth-server-route_{context}"]
== Customising the OpenShift integrated OAuth server route

.Prerequisites

* Log in to the cluster as a user with administrative privileges.

.Procedure

* Set the custom hostname and optionally configure the serving certificate and key.
+
[source,yaml]
----
apiVersion: config.openshift.io/v1
kind: Ingress
metadata:
name: cluster
spec:
componentRoutes:
- name: oauth-openshift
namespace: openshift-authentication
hostname: <custom-hostname>
servingCertKeyPairSecret:
name: <secret-name>
----
+
If the domain for the custom hostname suffix does not match the cluster domain suffix, then a secret that contains a TLS certificate and key must exist in the `openshift-config` namespace and must be referenced in the `ingress` config. If the domain for the custom hostname suffix matches the cluster domain suffix then the secret is optional. The secret must contain `tls.crt` and `tls.key` data keys, where the certificate and key are stored, and both must be in a valid format. The best way to ensure that is to use the TLS Secret.