Skip to content

Commit

Permalink
[version-4-2] docs: DOC-1224 Self-Hosted Custom CA Update (#3061) (#3135
Browse files Browse the repository at this point in the history 
)

* docs: DOC-1224 Self-Hosted Custom CA Update (#3061)

* docs: DOC-1224

* docs: vertex steps

* docs: updated instructions

* Apply suggestions from code review

* chore: fix indent
  • Loading branch information
@karl-cardenas-coding
karl-cardenas-coding authored Jun 20, 2024
1 parent 9361be7 commit f0c0531
Show file tree
Hide file tree
Showing 2 changed files with 93 additions and 16 deletions.
43 changes: 40 additions & 3 deletions ...-palette/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -236,7 +236,44 @@ The default container runtime for OVAs is [Podman](https://podman.io/), not Dock
sudo --login
```

19. Start the airgap initialization process by issuing the following command. The script requires the hostname or IP
19. If you have custom SSL certificates you want to apply to the image and pack registry, and the Spectro Cloud
Repository, copy the custom SSL certificates, in base64 PEM format, to the airgap support VM.

If you do not provide a custom SSL certificate, the airgap setup process will generate a self-signed certificate for
you.

:::warning

Three items you need to keep in mind when providing custom SSL certificates:

- The custom SSL certificates must be in base64 PEM format. If you have custom SSL certificates in a different
format, convert them to base64 PEM format before copying them to the support VM. The airgap setup process also
expects the certificate files to be named **server.crt** and **server.key**.

- The custom certificate's Fully Qualified Domain Name (FQDN) must match the hostname or IP address you provide for
the airgap support VM. Otherwise, the airgap setup process will fail due to a certificate mismatch.
- The custom SSL certificates files must have the following permissions bits set:
- **server.crt**: 644
- **server.key**: 600
:::
The custom certificates must be placed in the **/opt/spectro/ssl** folder. Include the following files:
- **server.crt**
- **server.key**
You also need to update the permissions for the **/data/secret/cert/** directory. This folder is mounted to Harbor
during the airgap setup process and must have access to the custom SSL certificates. Use the following command to
ensure the permissions are set correctly.
```shell
chown -R 10000:10000 /data/secret/cert/*
```
20. Start the airgap initialization process by issuing the following command. The script requires the hostname or IP
address of the airgap support VM. Choose the preferred method for your environment. Be aware that the script will
generate a self-signed certificate for the value you provide.
Expand Down Expand Up @@ -317,10 +354,10 @@ The default container runtime for OVAs is [Podman](https://podman.io/), not Dock
</TabItem>
</Tabs>
20. The output of the script contains credentials and values you will need when completing the installation with the
21. The output of the script contains credentials and values you will need when completing the installation with the
Palette CLI. If you need to review this information in the future, invoke the script again.
21. Review the [Additional Packs](../../airgap/supplemental-packs.md) page and identify any additional packs you want to
22. Review the [Additional Packs](../../airgap/supplemental-packs.md) page and identify any additional packs you want to
add to your OCI registry. By default, the installation includes only the minimum required packs. You can also add
additional packs after the installation is complete.
Expand Down
66 changes: 53 additions & 13 deletions ...e-vertex/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -179,16 +179,18 @@ The default container runtime for OVAs is [Podman](https://podman.io/), not Dock
17. If you want to assign a static IP address to the airgap support VM, you can do so now. Click on the box below to
expand the instructions. Otherwise, proceed to the next step.

<details>
<summary>Assign a static IP address</summary>
<details>

<summary>Assign a static IP address</summary>

Create an empty file to disable cloud-init from overriding the new network configurations you will add.

```shell
sudo touch /etc/cloud/cloud-init.disabled
```

Issue the following command to update cloud-init. Select **VMware** from the wizard Menu when prompted. The command will disable cloud-init from managing the network configuration.
Issue the following command to update cloud-init. Select **VMware** from the wizard Menu when prompted. The command
will disable cloud-init from managing the network configuration.

```shell
sudo dpkg-reconfigure cloud-init
Expand All @@ -200,7 +202,8 @@ The default container runtime for OVAs is [Podman](https://podman.io/), not Dock
sudo vi /etc/netplan/01-netcfg.yaml
```

Modify the file to look like the example below. Replace the IP address, gateway, and DNS server with your network settings. Save the file and exit the text editor.
Modify the file to look like the example below. Replace the IP address, gateway, and DNS server with your network
settings. Save the file and exit the text editor.

```yaml
network:
Expand All @@ -213,31 +216,68 @@ The default container runtime for OVAs is [Podman](https://podman.io/), not Dock
- 10.1.1.0/18
gateway4: 2.2.2.2
nameservers:
addresses: [1.1.1.1]
addresses: [1.1.1.1]
```

:::tip
:::tip

If you are working in Vim, press `i` to enter insert mode in the text editor. Press `esc` to exit insert mode. Type
`:wq` to save the file and exit the text editor.
If you are working in Vim, press `i` to enter insert mode in the text editor. Press `esc` to exit insert mode. Type
`:wq` to save the file and exit the text editor.

:::
:::

Issue the following command to apply the changes.

```shell
sudo netplan apply
```

</details>
</details>

18. Switch to the `root` user account. You will need to use the `root` user account to complete the remaining steps.

```shell
sudo --login
```

19. Start the airgap initialization process by issuing the following command. The script requires the hostname or IP
19. If you have custom SSL certificates you want to apply to the image and pack registry, and the Spectro Cloud
Repository, copy the custom SSL certificates, in base64 PEM format, to the airgap support VM.

If you do not provide a custom SSL certificate, the airgap setup process will generate a self-signed certificate for
you.

:::warning

Three items you need to keep in mind when providing custom SSL certificates:

- The custom SSL certificates must be in base64 PEM format. If you have custom SSL certificates in a different
format, convert them to base64 PEM format before copying them to the support VM. The airgap setup process also
expects the certificate files to be named **server.crt** and **server.key**.

- The custom certificate's Fully Qualified Domain Name (FQDN) must match the hostname or IP address you provide for
the airgap support VM. Otherwise, the airgap setup process will fail due to a certificate mismatch.
- The custom SSL certificates files must have the following permissions bits set:
- **server.crt**: 644
- **server.key**: 600
:::
The custom certificates must be placed in the **/opt/spectro/ssl** folder. Include the following files:
- **server.crt**
- **server.key**
You also need to update the permissions for the **/data/secret/cert/** directory. This folder is mounted to Harbor
during the airgap setup process and must have access to the custom SSL certificates. Use the following command to
ensure the permissions are set correctly.
```shell
chown -R 10000:10000 /data/secret/cert/*
```
20. Start the airgap initialization process by issuing the following command. The script requires the hostname or IP
address of the airgap support VM. Choose the preferred method for your environment. Be aware that the script will
generate a self-signed certificate for the value you provide.
Expand Down Expand Up @@ -318,10 +358,10 @@ If you are working in Vim, press `i` to enter insert mode in the text editor. Pr
</TabItem>
</Tabs>
20. The output of the script contains credentials and values you will need when completing the installation with the
21. The output of the script contains credentials and values you will need when completing the installation with the
Palette CLI. If you need to review this information in the future, invoke the script again.
21. Review the [Additional Packs](../../airgap/supplemental-packs.md) page and identify any additional packs you want to
22. Review the [Additional Packs](../../airgap/supplemental-packs.md) page and identify any additional packs you want to
add to your OCI registry. By default, the installation includes only the minimum required packs. You can also add
additional packs after the installation is complete.
Expand Down

0 comments on commit f0c0531

Please sign in to comment.