<commit_before>// Module included in the following assemblies:
//
// * operators/admin/olm-configuring-proxy-support.adoc

[id="olm-inject-custom-ca_{context}"]
= Injecting a custom CA certificate

When a cluster administrator adds a custom CA certificate to a cluster using a config map, the Cluster Network Operator merges the user-provided certificates and system CA certificates into a single bundle. You can inject this merged bundle into your Operator running on Operator Lifecycle Manager (OLM), which is useful if you have a man-in-the-middle HTTPS proxy.

.Prerequisites

- Access to an {product-title} cluster using an account with
ifdef::openshift-enterprise,openshift-webscale,openshift-origin[]
`cluster-admin` permissions.
endif::[]
ifdef::openshift-dedicated[]
`dedicated-admins-cluster` permissions.
endif::[]
- Custom CA certificate added to the cluster using a config map.
- Desired Operator installed and running on OLM.

.Procedure

. Create an empty config map in the namespace where the subscription for your Operator exists and include the following label:
+
[source,yaml]
----
apiVersion: v1
kind: ConfigMap
metadata:
  name: trusted-ca <1>
  labels:
    config.openshift.io/inject-trusted-cabundle: "true" <2>
----
<1> Name of the config map.
<2> Requests the Cluster Network Operator to inject the merged bundle.
+
After creating this config map, it is immediately populated with the certificate contents of the merged bundle.

. Update your the `Subscription` object to include a `spec.config` section that mounts the `trusted-ca` config map as a volume to each container within a pod that requires a custom CA:
+
[source,yaml]
----
kind: Subscription
metadata:
  name: my-operator
spec:
  package: etcd
  channel: alpha
  config: <1>
  - selector:
      matchLabels:
        <labels_for_pods> <2>
    volumes: <3>
    - name: trusted-ca
      configMap:
        name: trusted-ca
        items:
          - key: ca-bundle.crt <4>
            path: tls-ca-bundle.pem <5>
    volumeMounts: <6>
    - name: trusted-ca
      mountPath: /etc/pki/ca-trust/extracted/pem
      readOnly: true
----
<1> Add a `config` section if it does not exist.
<2> Specify labels to match pods that are owned by the Operator.
<3> Create a `trusted-ca` volume.
<4> `ca-bundle.crt` is required as the config map key.
<5> `tls-ca-bundle.pem` is required as the config map path.
<6> Create a `trusted-ca` volume mount.<commit_msg>bz1973057:Removed erroneous hyphen from Yaml example<commit_after>// Module included in the following assemblies:
//
// * operators/admin/olm-configuring-proxy-support.adoc

[id="olm-inject-custom-ca_{context}"]
= Injecting a custom CA certificate

When a cluster administrator adds a custom CA certificate to a cluster using a config map, the Cluster Network Operator merges the user-provided certificates and system CA certificates into a single bundle. You can inject this merged bundle into your Operator running on Operator Lifecycle Manager (OLM), which is useful if you have a man-in-the-middle HTTPS proxy.

.Prerequisites

- Access to an {product-title} cluster using an account with
ifdef::openshift-enterprise,openshift-webscale,openshift-origin[]
`cluster-admin` permissions.
endif::[]
ifdef::openshift-dedicated[]
`dedicated-admins-cluster` permissions.
endif::[]
- Custom CA certificate added to the cluster using a config map.
- Desired Operator installed and running on OLM.

.Procedure

. Create an empty config map in the namespace where the subscription for your Operator exists and include the following label:
+
[source,yaml]
----
apiVersion: v1
kind: ConfigMap
metadata:
  name: trusted-ca <1>
  labels:
    config.openshift.io/inject-trusted-cabundle: "true" <2>
----
<1> Name of the config map.
<2> Requests the Cluster Network Operator to inject the merged bundle.
+
After creating this config map, it is immediately populated with the certificate contents of the merged bundle.

. Update your the `Subscription` object to include a `spec.config` section that mounts the `trusted-ca` config map as a volume to each container within a pod that requires a custom CA:
+
[source,yaml]
----
kind: Subscription
metadata:
  name: my-operator
spec:
  package: etcd
  channel: alpha
  config: <1>
    selector:
      matchLabels:
        <labels_for_pods> <2>
    volumes: <3>
    - name: trusted-ca
      configMap:
        name: trusted-ca
        items:
          - key: ca-bundle.crt <4>
            path: tls-ca-bundle.pem <5>
    volumeMounts: <6>
    - name: trusted-ca
      mountPath: /etc/pki/ca-trust/extracted/pem
      readOnly: true
----
<1> Add a `config` section if it does not exist.
<2> Specify labels to match pods that are owned by the Operator.
<3> Create a `trusted-ca` volume.
<4> `ca-bundle.crt` is required as the config map key.
<5> `tls-ca-bundle.pem` is required as the config map path.
<6> Create a `trusted-ca` volume mount.
{'fraction_non_alphanumeric': 0.09385839624566415, 'fraction_numerical': 0.008365639665374413, 'mean_word_length': 3.650853889943074, 'pattern_counts': {'":': 0, '<': 37, '<?xml version=': 0, '>': 37, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5984274', 'n_tokens_mistral': 1491, 'n_tokens_neox': 1431, 'n_words': 594}