mirror of
https://github.com/ansible/awx-operator.git
synced 2026-04-10 02:41:35 +00:00
2b0221bbc6
* docs: simplify README.md and make index.md to refer to it * docs: change order for pages in navigation and add missing pages * docs: fix headings to improve navigation, transform notes to admonition, fix indentation, linting issues and minor issues * docs: merge docs for using images from private registries * docs: add example to integrate LDAP configuration via extra_settings_files * Apply suggestions from code review docs: apply suggested changes Co-authored-by: Don Naro <dnaro@redhat.com> * docs: update the doc site url as same as the url in https://www.ansible.com/ecosystem/ * docs: minor fixes for hpa page * docs: expand note block * docs: apply #1904 to README.md --------- Co-authored-by: Don Naro <dnaro@redhat.com>
25 lines
1.3 KiB
Markdown
25 lines
1.3 KiB
Markdown
# Custom Receptor CA
|
|
|
|
The control nodes on the K8S cluster will communicate with execution nodes via mutual TLS TCP connections, running via Receptor.
|
|
Execution nodes will verify incoming connections by ensuring the x509 certificate was issued by a trusted Certificate Authority (CA).
|
|
|
|
A user may wish to provide their own CA for this validation. If no CA is provided, AWX Operator will automatically generate one using OpenSSL.
|
|
|
|
Given custom `ca.crt` and `ca.key` stored locally, run the following,
|
|
|
|
```bash
|
|
kubectl create secret tls awx-demo-receptor-ca \
|
|
--cert=/path/to/ca.crt --key=/path/to/ca.key
|
|
```
|
|
|
|
The secret should be named `{AWX Custom Resource name}-receptor-ca`. In the above the AWX CR name is "awx-demo". Please replace "awx-demo" with your AWX Custom Resource name.
|
|
|
|
If this secret is created after AWX is deployed, run the following to restart the deployment,
|
|
|
|
```bash
|
|
kubectl rollout restart deployment awx-demo
|
|
```
|
|
|
|
!!! warning
|
|
Changing the receptor CA will break connections to any existing execution nodes. These nodes will enter an `unavailable` state, and jobs will not be able to run on them. Users will need to download and re-run the install bundle for each execution node. This will replace the TLS certificate files with those signed by the new CA. The execution nodes should then appear in a `ready` state after a few minutes.
|