Add support for multiple trusted custom certificates to be specified via cluster config
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 328
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 9
Description
**What would you like to be added**:
Currently EKS-A allows a CA certificate to be specified via the registryMirrorConfiguration section. For Bottlerocket, a bundle can be specified here and would get inserted as system wide certificates for any FQDN. For Ubuntu, however, it only gets tied to the endpoint for containerd. These should be made system-wide for Ubuntu as well.
**Why is this needed**:
There can be a need to have custom trusted certificates inserted in case of non-transparent proxies, different registries being used for workload image pulls on cluster VMs etc.
Contributor guide
Research direction
Start at the registryMirrorConfiguration handling for Ubuntu and Bottlerocket, focusing on how the CA bundle is applied to containerd endpoints. Done means certificates configured there are trusted system-wide on Ubuntu as well as Bottlerocket, including support for multiple custom certificates.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100