Add custom CA
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 131
- Forks
- 65
- PR merge metrics
- No merged PRs in 30d
Description
We've deployed Tinkerbell in an isolated environment and redirected all the quay and docker images to point to our internal harbor image, and it works fine even with the download-hook container after injecting our CA certificate into the container using postRenderer patches.
However I cannot figure out how to add our CA into the downloaded hookOS which gets booted on the servers so the tinker-agent can never gets downloaded there.
How can one add a trusted CA into this part of the chain?
Thank you!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the downloaded hookOS is built and how the download-hook container and postRenderer patches differ from the booted environment. Determine where a custom CA could be included so the tinker-agent can download successfully, then verify the resulting hookOS trusts the internal certificate during boot.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100