infra-docs-fpo/modules/sysadmin_guide/pages/sop_retrieve_ocp4_cacert.adoc

= SOP Retrieve OCP4 Cluster CACERT

== Resources

- [1] https://pagure.io/fedora-infra/ansible/blob/main/f/roles/dhcp_server[Ansible Role DHCP Server]

== Retrieve CACERT
In Fedora Infra, we have Apache terminating TLS for the cluster. Connections to the api and the machineconfig server are handled by haproxy. To prevent TLS errors we must configure haproxy with the OCP4 Cluster CA Cert.

This can be retrieved once the cluster control plane has been installed, from the `os-control01` node like so:

----
oc get configmap kube-root-ca.crt -o yaml -n openshift-ingress
----

Extract this CACERT in full, and commit it to ansible at: `https://pagure.io/fedora-infra/ansible/blob/main/f/roles/haproxy/files/ocp.<ENV>-rdu3.pem`

To deploy this cert, one must be apart of the `sysadmin-noc` group. Run the following playbook:

----
sudo rbac-playbook groups/proxies.yml -t 'haproxy'
----
ocp4: reordering header levels 2022-03-03 11:44:45 +00:00			`= SOP Retrieve OCP4 Cluster CACERT`
SOP Retrieve ocp4 cacert Signed-off-by: David Kirwan <dkirwan@redhat.com> 2021-09-15 13:02:05 +09:00
ocp4: reordering header levels 2022-03-03 11:44:45 +00:00			`== Resources`
SOP Retrieve ocp4 cacert Signed-off-by: David Kirwan <dkirwan@redhat.com> 2021-09-15 13:02:05 +09:00
			`- [1] https://pagure.io/fedora-infra/ansible/blob/main/f/roles/dhcp_server[Ansible Role DHCP Server]`

ocp4: reordering header levels 2022-03-03 11:44:45 +00:00			`== Retrieve CACERT`
SOP Retrieve ocp4 cacert Signed-off-by: David Kirwan <dkirwan@redhat.com> 2021-09-15 13:02:05 +09:00			`In Fedora Infra, we have Apache terminating TLS for the cluster. Connections to the api and the machineconfig server are handled by haproxy. To prevent TLS errors we must configure haproxy with the OCP4 Cluster CA Cert.`

			This can be retrieved once the cluster control plane has been installed, from the `os-control01` node like so:

			`----`
			`oc get configmap kube-root-ca.crt -o yaml -n openshift-ingress`
			`----`

DC move: iad => rdu3, 10.3. => 10.16. And remove some obsolete things. Signed-off-by: Nils Philippsen <nils@redhat.com> 2025-07-04 11:55:02 +02:00			Extract this CACERT in full, and commit it to ansible at: `https://pagure.io/fedora-infra/ansible/blob/main/f/roles/haproxy/files/ocp.<ENV>-rdu3.pem`
SOP Retrieve ocp4 cacert Signed-off-by: David Kirwan <dkirwan@redhat.com> 2021-09-15 13:02:05 +09:00
			To deploy this cert, one must be apart of the `sysadmin-noc` group. Run the following playbook:

			`----`
			`sudo rbac-playbook groups/proxies.yml -t 'haproxy'`
			`----`