From b2d095fec192b75a64b0549eee563b446cc5ac87 Mon Sep 17 00:00:00 2001 From: Karl Cardenas <29551334+karl-cardenas-coding@users.noreply.github.com> Date: Thu, 20 Jun 2024 14:34:38 -0700 Subject: [PATCH] docs: DOC-1224 Self-Hosted Custom CA Update (#3061) * docs: DOC-1224 * docs: vertex steps * docs: updated instructions * Apply suggestions from code review (cherry picked from commit f775c3c811a0524f1a44d13d70e677d721c9019c) --- .../vmware-vsphere-airgap-instructions.md | 35 ++++++++++++++----- .../vmware-vsphere-airgap-instructions.md | 35 ++++++++++++++----- 2 files changed, 54 insertions(+), 16 deletions(-) diff --git a/docs/docs-content/enterprise-version/install-palette/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md b/docs/docs-content/enterprise-version/install-palette/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md index a6c04c6395..6751667e79 100644 --- a/docs/docs-content/enterprise-version/install-palette/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md +++ b/docs/docs-content/enterprise-version/install-palette/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md @@ -237,23 +237,42 @@ The default container runtime for OVAs is [Podman](https://podman.io/), not Dock ``` 19. If you have custom SSL certificates you want to apply to the image and pack registry, and the Spectro Cloud - Repository, copy the custom SSL certificates, in base64 PEM format, to the airgap support VM. The custom - certificates must be placed in the **/opt/spectro/ssl** folder. Include the following files: - - - **server.crt** - - **server.key** + Repository, copy the custom SSL certificates, in base64 PEM format, to the airgap support VM. If you do not provide a custom SSL certificate, the airgap setup process will generate a self-signed certificate for you. :::warning - The custom SSL certificates must be in base64 PEM format. If you have custom SSL certificates in a different format, - convert them to base64 PEM format before copying them to the support VM. The airgap setup process also expects the - files to be named **server.crt** and **server.key**. + Three items you need to keep in mind when providing custom SSL certificates: + + - The custom SSL certificates must be in base64 PEM format. If you have custom SSL certificates in a different + format, convert them to base64 PEM format before copying them to the support VM. The airgap setup process also + expects the certificate files to be named **server.crt** and **server.key**. + + - The custom certificate's Fully Qualified Domain Name (FQDN) must match the hostname or IP address you provide for + the airgap support VM. Otherwise, the airgap setup process will fail due to a certificate mismatch. + + - The custom SSL certificates files must have the following permissions bits set: + + - **server.crt**: 644 + - **server.key**: 600 ::: + The custom certificates must be placed in the **/opt/spectro/ssl** folder. Include the following files: + + - **server.crt** + - **server.key** + + You also need to update the permissions for the **/data/secret/cert/** directory. This folder is mounted to Harbor + during the airgap setup process and must have access to the custom SSL certificates. Use the following command to + ensure the permissions are set correctly. + + ```shell + chown -R 10000:10000 /data/secret/cert/* + ``` + 20. Start the airgap initialization process by issuing the following command. The script requires the hostname or IP address of the airgap support VM. Choose the preferred method for your environment. Be aware that the script will generate a self-signed certificate for the value you provide. diff --git a/docs/docs-content/vertex/install-palette-vertex/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md b/docs/docs-content/vertex/install-palette-vertex/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md index b8ddd933c3..81ffeeb3a9 100644 --- a/docs/docs-content/vertex/install-palette-vertex/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md +++ b/docs/docs-content/vertex/install-palette-vertex/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md @@ -238,23 +238,42 @@ If you are working in Vim, press `i` to enter insert mode in the text editor. Pr ``` 19. If you have custom SSL certificates you want to apply to the image and pack registry, and the Spectro Cloud - Repository, copy the custom SSL certificates, in base64 PEM format, to the airgap support VM. The custom - certificates must be placed in the **/opt/spectro/ssl** folder. Include the following files: - - - **server.crt** - - **server.key** + Repository, copy the custom SSL certificates, in base64 PEM format, to the airgap support VM. If you do not provide a custom SSL certificate, the airgap setup process will generate a self-signed certificate for you. :::warning - The custom SSL certificates must be in base64 PEM format. If you have custom SSL certificates in a different format, - convert them to base64 PEM format before copying them to the support VM. The airgap setup process also expects the - files to be named **server.crt** and **server.key**. + Three items you need to keep in mind when providing custom SSL certificates: + + - The custom SSL certificates must be in base64 PEM format. If you have custom SSL certificates in a different + format, convert them to base64 PEM format before copying them to the support VM. The airgap setup process also + expects the certificate files to be named **server.crt** and **server.key**. + + - The custom certificate's Fully Qualified Domain Name (FQDN) must match the hostname or IP address you provide for + the airgap support VM. Otherwise, the airgap setup process will fail due to a certificate mismatch. + + - The custom SSL certificates files must have the following permissions bits set: + + - **server.crt**: 644 + - **server.key**: 600 ::: + The custom certificates must be placed in the **/opt/spectro/ssl** folder. Include the following files: + + - **server.crt** + - **server.key** + + You also need to update the permissions for the **/data/secret/cert/** directory. This folder is mounted to Harbor + during the airgap setup process and must have access to the custom SSL certificates. Use the following command to + ensure the permissions are set correctly. + + ```shell + chown -R 10000:10000 /data/secret/cert/* + ``` + 20. Start the airgap initialization process by issuing the following command. The script requires the hostname or IP address of the airgap support VM. Choose the preferred method for your environment. Be aware that the script will generate a self-signed certificate for the value you provide.