User-provided certificates for default ingress

Overview
- Welcome
- Introduction to OpenShift Container Platform
- Learn more about OpenShift Container Platform
- Kubernetes overview
- OpenShift editions
- Providing documentation feedback
What's new?
- New features and enhancements
- Deprecated features
Architecture
- Architecture overview
- Product architecture
- Installation and update
- Control plane architecture
- Understanding OKD development
- Fedora CoreOS
- Admission plugins
Disconnected environments
- About disconnected environments
- Converting a connected cluster to a disconnected cluster
- About disconnected installation mirroring
- Creating a mirror registry with mirror registry for Red Hat OpenShift
- Mirroring images for a disconnected installation using oc-mirror plugin v2
- Migrating from oc-mirror plugin v1 to v2
- Mirroring images for a disconnected installation using the oc-mirror plugin v1
- Mirroring images for a disconnected installation by using the oc adm command
- Installing a cluster in a disconnected environment
- Using OLM in disconnected environments
- Updating a cluster in a disconnected environment
Installing
- Installation overview
- Installing on Alibaba Cloud
  - Installing a cluster on Alibaba Cloud using the Assisted Installer
- Installing on AWS
- Installing on Azure
- Installing on Azure Stack Hub
- Installing on Google Cloud
- Installing on IBM Cloud
- Installing on Nutanix
- Installing on a single node
  - Preparing to install OpenShift on a single node
  - Installing OpenShift on a single node
- Installing a Two Node OpenShift Cluster
  - Two-Node with Arbiter
  - Two-node with Fencing
- Installing on bare metal
- Installing IBM Cloud Bare Metal (Classic)
  - Prerequisites for IBM Cloud (Classic)
  - Installation workflow for IBM Cloud Bare Metal (Classic)
- Installing on OpenStack
- Installing on Oracle Distributed Cloud
  - Installing a cluster on Oracle Distributed Cloud by using the Assisted Installer
  - Installing a cluster on Oracle Distributed Cloud by using the Agent-based Installer
- Installing on VMware vSphere
- Installing on any platform
  - Installing a cluster on any platform
- Installation configuration
  - Customizing nodes
- Validation and troubleshooting
  - Validating an installation
  - Troubleshooting installation issues
Postinstallation configuration
- Configuring a private cluster
- Cluster tasks
- Node tasks
- Postinstallation network configuration
- Configuring image streams and image registries
- Storage configuration
- Preparing for users
- Changing the cloud provider credentials configuration
- Configuring alert notifications
- Converting a connected cluster to a disconnected cluster
- Day 2 operations for OpenShift Container Platform clusters
Updating clusters
- Updating clusters overview
- Understanding OpenShift updates
  - Introduction to OpenShift updates
  - Understanding OpenShift update duration
- Preparing to update a cluster
- Performing a cluster update
- Troubleshooting a cluster update
  - Gathering data about your cluster update
Support
- Support overview
- Managing your cluster resources
- Getting support
- Remote health monitoring with connected clusters
- Gathering data about your cluster
- Summarizing cluster specifications
- Troubleshooting
Web console
- Web console overview
- Accessing the web console
- Using the OpenShift Container Platform dashboard to get cluster information
- Adding user preferences
- Configuring the web console
- Customizing the web console
- Dynamic plugins
- Disabling the web console
- Creating quick start tutorials
- Optional capabilities and products
CLI tools
- CLI tools overview
- OpenShift CLI (oc)
- OpenShift CLI Manager
- Developer CLI (odo)
- Knative CLI (kn) for use with OpenShift Serverless
- opm CLI
  - Installing the opm CLI
  - opm CLI reference
- Hosted control planes CLI
Security and compliance
- Security and compliance overview
- Container security
- Configuring certificates
- Certificate types and descriptions
- Compliance Operator
- File Integrity Operator
- Security Profiles Operator
- Viewing audit logs
- Configuring the audit log policy
- Configuring TLS security profiles
- Configuring seccomp profiles
- Allowing JavaScript-based access to the API server from additional hosts
- Scanning pods for vulnerabilities
- Network-Bound Disk Encryption (NBDE)
Authentication and authorization
- Authentication and authorization overview
- Understanding authentication
- Configuring the internal OAuth server
- Configuring OAuth clients
- Managing user-owned OAuth access tokens
- Understanding identity provider configuration
- Configuring identity providers
  - Configuring an htpasswd identity provider
  - Configuring a Keystone identity provider
  - Configuring an LDAP identity provider
  - Configuring a basic authentication identity provider
  - Configuring a request header identity provider
  - Configuring a GitHub or GitHub Enterprise identity provider
  - Configuring a GitLab identity provider
  - Configuring a Google identity provider
  - Configuring an OpenID Connect identity provider
- Enabling direct authentication with an OIDC identity provider
- Using RBAC to define and apply permissions
- Removing the kubeadmin user
- Understanding and creating service accounts
- Using service accounts in applications
- Using a service account as an OAuth client
- Scoping tokens
- Using bound service account tokens
- Managing security context constraints
- Understanding and managing pod security admission
- Impersonating the system:admin user
- Syncing LDAP groups
- Managing cloud provider credentials
  - About the Cloud Credential Operator
  - About mint mode
  - About passthrough mode
  - About manual mode with long-term credentials for components
  - About manual mode with short-term credentials for components
Networking
- Networking overview
- Networking Operators
- Network Observability Operator
  - Network Observability Operator
- Network security
- Multiple networks
- Hardware networks
- OVN-Kubernetes network plugin
- Ingress and load balancing
- Configuring network settings
- Advanced networking
- Kubernetes NMState
  - Observing and updating node network state and configuration
  - Troubleshooting node network configuration
Storage
- Storage overview
- Understanding ephemeral storage
- Understanding persistent storage
- Configuring persistent storage
- Persistent storage using local storage
- Using Container Storage Interface (CSI)
- Generic ephemeral volumes
- Expanding persistent volumes
- Dynamic provisioning
- Detach volumes after non-graceful node shutdown
Registry
- Registry overview
- Image Registry Operator in OKD
- Setting up and configuring the registry
- Accessing the registry
- Exposing the registry
Operators
- Operators overview
- Understanding Operators
- User tasks
  - Creating applications from installed Operators
  - Installing Operators in your namespace
- Administrator tasks
- Developing Operators
  - Token authentication
- Cluster Operators reference
- OLM v1
  - About OLM v1
Extensions
- Extensions overview
- Architecture
- Common terms
- Catalogs
- Cluster extensions
CI/CD
- CI/CD overview
  - About CI/CD
- Builds using BuildConfig
Images
- Overview of images
- Configuring the Cluster Samples Operator
- Using the Cluster Samples Operator with an alternate registry
- Creating images
- Managing images
- Managing image streams
- Using image streams with Kubernetes resources
- Triggering updates on image stream changes
- Image configuration resources
- Using images
Building applications
- Building applications overview
- Projects
- Creating applications
- Viewing application composition by using the Topology view
- Exporting applications
- Working with Helm charts
- Deployments
- Quotas
  - Resource quotas per project
  - Resource quotas across multiple projects
- Using config maps with applications
- Monitoring project and application metrics using the Developer perspective
- Monitoring application health
- Editing applications
- Pruning objects to reclaim resources
- Idling applications
- Deleting applications
- Using the Red Hat Marketplace
Machine configuration
- Machine configuration overview
- Using machine config objects to configure nodes
- Using node disruption policies to minimize disruption from machine config changes
- Configuring MCO-related custom resources
- Pinning images to nodes
- Boot image management
- Managing unused rendered machine configs
- Image mode for OpenShift
- Machine Config Daemon metrics
Machine management
- Overview of machine management
- Managing compute machines with the Machine API
- Manually scaling a compute machine set
- Modifying a compute machine set
- Machine phases and lifecycle
- Deleting a machine
- Applying autoscaling to a cluster
- Creating infrastructure machine sets
- Managing user-provisioned infrastructure manually
- Managing control plane machines
- Managing machines with the Cluster API
- Deploying machine health checks
etcd
- Overview of etcd
- Recommended etcd practices
- Ensuring reliable etcd performance and scalability
- Backing up and restoring etcd data
- Enabling etcd encryption
- Guidance for clusters that span data centers
Hosted control planes
- Hosted control planes release notes
- Hosted control planes overview
- Preparing to deploy hosted control planes
- Deploying hosted control planes
- Managing hosted control planes
- Deploying hosted control planes in a disconnected environment
- Configuring certificates for hosted control planes
- Updating hosted control planes
- High availability for hosted control planes
- Authentication and authorization for hosted control planes
- Handling machine configuration for hosted control planes
- Feature gates in a hosted cluster
- Observability for hosted control planes
- Networking for hosted control planes
- Troubleshooting hosted control planes
- Destroying a hosted cluster
- Manually importing a hosted cluster
Nodes
- Overview of nodes
- Working with pods
- Automatically scaling pods with the Custom Metrics Autoscaler Operator
- Controlling pod placement onto nodes (scheduling)
- Using jobs and daemon sets
  - Running background tasks on nodes automatically with daemon sets
  - Running tasks in pods using jobs
- Working with nodes
- Working with containers
- Working with clusters
- Node metrics dashboard
- Manage secure signatures with sigstore
Windows Container Support for OpenShift
- Red Hat OpenShift support for Windows Containers overview
- Release notes
- Understanding Windows container workloads
- Enabling Windows container workloads
- Creating Windows machine sets
- Scheduling Windows container workloads
- Windows node updates
- Using Bring-Your-Own-Host Windows instances as nodes
- Removing Windows nodes
- Disabling Windows container workloads
- Troubleshooting Windows container workloads
Observability
- Observability overview
  - About Observability
- Cluster Observability Operator
  - Cluster Observability Operator overview
- Monitoring
  - About OpenShift Container Platform monitoring
- Logging
  - About Logging
- Network Observability
- Power Monitoring
  - About power monitoring
Scalability and performance
- Scalability and performance overview
- Recommended performance and scalability practices
  - Recommended control plane practices
  - Selecting a larger AWS instance type for control plane machines
  - Recommended infrastructure practices
- Telco core reference design specifications
- Telco RAN DU reference design specifications
- Telco hub reference design specifications
- Comparing cluster configurations
  - Understanding the cluster-compare plugin
  - Installing the cluster-compare plugin
  - Using the cluster-compare plugin
  - Creating a reference configuration
  - Performing advanced reference configuration customization
  - Troubleshooting cluster comparisons
- Planning your environment according to object maximums
- Compute Resource Quotas
- Using the Node Tuning Operator
- Using CPU Manager and Topology Manager
- Scheduling NUMA-aware workloads
- Scalability and performance optimization
  - Optimizing storage
  - Optimizing routing
  - Optimizing networking
  - Optimizing CPU usage
- Managing bare metal hosts
- Optimizing memory management for workloads by using huge pages
- Understanding low latency
- Tuning nodes for low latency with the performance profile
- Tuning hosted control planes for low latency with the performance profile
- Provisioning real-time and low latency workloads
- Debugging low latency tuning
- Performing latency tests for platform verification
- Improving cluster stability in high latency environments using worker latency profiles
- Workload partitioning
- Using the Node Observability Operator
Edge computing
- Challenges of the network far edge
- Preparing the hub cluster for ZTP
- Updating GitOps ZTP
- Installing managed clusters with RHACM and SiteConfig resources
- Manually installing a single-node OpenShift cluster with GitOps ZTP
- Migrating from SiteConfig CRs to ClusterInstance CRs
- Recommended single-node OpenShift cluster configuration for vDU application workloads
- Validating cluster tuning for vDU application workloads
- Advanced managed cluster configuration with SiteConfig resources
- Managing cluster policies with PolicyGenerator resources
- Managing cluster policies with PolicyGenTemplate resources
- Using hub templates in PolicyGenerator or PolicyGenTemplate CRs
- Updating managed clusters with the Topology Aware Lifecycle Manager
- Expanding single-node OpenShift clusters with GitOps ZTP
- Pre-caching images for single-node OpenShift deployments
- Image-based upgrade for single-node OpenShift clusters
- Image-based installation for single-node OpenShift
Specialized hardware and driver enablement
- About specialized hardware and driver enablement
- Driver Toolkit
- Node Feature Discovery Operator
- Kernel Module Management Operator
- Kernel Module Management Operator release notes
Hardware accelerators
- About hardware accelerators
- NVIDIA GPU architecture
- AMD GPU Operator
- Intel Gaudi AI accelerators
- Remote Direct Memory Access (RDMA)
- Dynamic Accelerator Slicer (DAS) Operator
Backup and restore
- Overview of backup and restore operations
- Shutting down a cluster gracefully
- Restarting a cluster gracefully
- Hibernating a cluster
- OADP Application backup and restore
- Control plane backup and restore
Migrating from version 3 to 4
- Migrating from version 3 to 4 overview
- About migrating from OKD 3 to 4
- Differences between OKD 3 and 4
- Network considerations
- About MTC
- Installing MTC
- Installing MTC in a disconnected environment
- Upgrading MTC
- Premigration checklists
- Migrating your applications
- Advanced migration options
- Troubleshooting
Migration Toolkit for Containers
- About MTC
- MTC release notes
- Installing MTC
- Installing MTC in a disconnected environment
- Upgrading MTC
- Premigration checklists
- Network considerations
- Direct Migration Requirements
- Migrating your applications
- Advanced migration options
- Migrating virtual machine storage
- Troubleshooting
API reference
- API overview
  - Understanding API tiers
  - API compatibility guidelines
  - Editing kubelet log level verbosity and gathering logs
  - API list
- Common object reference
  - Index
- Authorization APIs
  - About Authorization APIs
  - LocalResourceAccessReview [authorization.openshift.io/v1]
  - LocalSubjectAccessReview [authorization.openshift.io/v1]
  - ResourceAccessReview [authorization.openshift.io/v1]
  - SelfSubjectRulesReview [authorization.openshift.io/v1]
  - SubjectAccessReview [authorization.openshift.io/v1]
  - SubjectRulesReview [authorization.openshift.io/v1]
  - SelfSubjectReview [authentication.k8s.io/v1]
  - TokenRequest [authentication.k8s.io/v1]
  - TokenReview [authentication.k8s.io/v1]
  - LocalSubjectAccessReview [authorization.k8s.io/v1]
  - SelfSubjectAccessReview [authorization.k8s.io/v1]
  - SelfSubjectRulesReview [authorization.k8s.io/v1]
  - SubjectAccessReview [authorization.k8s.io/v1]
- Autoscale APIs
  - About Autoscale APIs
  - ClusterAutoscaler [autoscaling.openshift.io/v1]
  - MachineAutoscaler [autoscaling.openshift.io/v1beta1]
  - HorizontalPodAutoscaler [autoscaling/v2]
  - Scale [autoscaling/v1]
- Cluster APIs
  - About Cluster APIs
  - IPAddress [ipam.cluster.x-k8s.io/v1beta1]
  - IPAddressClaim [ipam.cluster.x-k8s.io/v1beta1]
- Config APIs
  - About Config APIs
  - APIServer [config.openshift.io/v1]
  - Authentication [config.openshift.io/v1]
  - Build [config.openshift.io/v1]
  - ClusterImagePolicy [config.openshift.io/v1]
  - ClusterOperator [config.openshift.io/v1]
  - ClusterVersion [config.openshift.io/v1]
  - Console [config.openshift.io/v1]
  - DNS [config.openshift.io/v1]
  - FeatureGate [config.openshift.io/v1]
  - HelmChartRepository [helm.openshift.io/v1beta1]
  - Image [config.openshift.io/v1]
  - ImageDigestMirrorSet [config.openshift.io/v1]
  - ImageContentPolicy [config.openshift.io/v1]
  - ImagePolicy [config.openshift.io/v1]
  - ImageTagMirrorSet [config.openshift.io/v1]
  - Infrastructure [config.openshift.io/v1]
  - Ingress [config.openshift.io/v1]
  - Network [config.openshift.io/v1]
  - Node [config.openshift.io/v1]
  - OAuth [config.openshift.io/v1]
  - OperatorHub [config.openshift.io/v1]
  - Project [config.openshift.io/v1]
  - ProjectHelmChartRepository [helm.openshift.io/v1beta1]
  - Proxy [config.openshift.io/v1]
  - Scheduler [config.openshift.io/v1]
- Console APIs
  - About Console APIs
  - ConsoleCLIDownload [console.openshift.io/v1]
  - ConsoleExternalLogLink [console.openshift.io/v1]
  - ConsoleLink [console.openshift.io/v1]
  - ConsoleNotification [console.openshift.io/v1]
  - ConsolePlugin [console.openshift.io/v1]
  - ConsoleQuickStart [console.openshift.io/v1]
  - ConsoleSample [console.openshift.io/v1]
  - ConsoleYAMLSample [console.openshift.io/v1]
- Extension APIs
  - About Extension APIs
  - APIService [apiregistration.k8s.io/v1]
  - CustomResourceDefinition [apiextensions.k8s.io/v1]
  - MutatingWebhookConfiguration [admissionregistration.k8s.io/v1]
  - ValidatingAdmissionPolicy [admissionregistration.k8s.io/v1]
  - ValidatingAdmissionPolicyBinding [admissionregistration.k8s.io/v1]
  - ValidatingWebhookConfiguration [admissionregistration.k8s.io/v1]
- Image APIs
  - About Image APIs
  - Image [image.openshift.io/v1]
  - ImageSignature [image.openshift.io/v1]
  - ImageStreamImage [image.openshift.io/v1]
  - ImageStreamImport [image.openshift.io/v1]
  - ImageStreamLayers [image.openshift.io/v1]
  - ImageStreamMapping [image.openshift.io/v1]
  - ImageStream [image.openshift.io/v1]
  - ImageStreamTag [image.openshift.io/v1]
  - ImageTag [image.openshift.io/v1]
  - SecretList [image.openshift.io/v1]
- Machine APIs
  - About Machine APIs
  - ContainerRuntimeConfig [machineconfiguration.openshift.io/v1]
  - ControllerConfig [machineconfiguration.openshift.io/v1]
  - ControlPlaneMachineSet [machine.openshift.io/v1]
  - KubeletConfig [machineconfiguration.openshift.io/v1]
  - MachineConfig [machineconfiguration.openshift.io/v1]
  - MachineConfigPool [machineconfiguration.openshift.io/v1]
  - MachineHealthCheck [machine.openshift.io/v1beta1]
  - Machine [machine.openshift.io/v1beta1]
  - MachineSet [machine.openshift.io/v1beta1]
  - MachineConfigNode [machineconfiguration.openshift.io/v1]
  - MachineOSBuild [machineconfiguration.openshift.io/v1]
  - MachineOSConfig [machineconfiguration.openshift.io/v1]
  - PinnedImageSet [machineconfiguration.openshift.io/v1]
- Metadata APIs
  - About Metadata APIs
  - APIRequestCount [apiserver.openshift.io/v1]
  - Binding [undefined/v1]
  - ComponentStatus [undefined/v1]
  - ConfigMap [undefined/v1]
  - ControllerRevision [apps/v1]
  - Event [events.k8s.io/v1]
  - Event [undefined/v1]
  - Lease [coordination.k8s.io/v1]
  - Namespace [undefined/v1]
- Monitoring APIs
  - About Monitoring APIs
  - Alertmanager [monitoring.coreos.com/v1]
  - AlertmanagerConfig [monitoring.coreos.com/v1beta1]
  - AlertRelabelConfig [monitoring.openshift.io/v1]
  - AlertingRule [monitoring.openshift.io/v1]
  - PodMonitor [monitoring.coreos.com/v1]
  - Probe [monitoring.coreos.com/v1]
  - Prometheus [monitoring.coreos.com/v1]
  - PrometheusRule [monitoring.coreos.com/v1]
  - ServiceMonitor [monitoring.coreos.com/v1]
  - ThanosRuler [monitoring.coreos.com/v1]
  - NodeMetrics [metrics.k8s.io/v1beta1]
  - PodMetrics [metrics.k8s.io/v1beta1]
- Network APIs
  - About Network APIs
  - ClusterUserDefinedNetwork [k8s.ovn.org/v1]
  - AdminNetworkPolicy [policy.networking.k8s.io/v1alpha1]
  - AdminPolicyBasedExternalRoute [k8s.ovn.org/v1]
  - BaselineAdminNetworkPolicy [policy.networking.k8s.io/v1alpha1]
  - CloudPrivateIPConfig [cloud.network.openshift.io/v1]
  - EgressFirewall [k8s.ovn.org/v1]
  - EgressIP [k8s.ovn.org/v1]
  - EgressQoS [k8s.ovn.org/v1]
  - EgressService [k8s.ovn.org/v1]
  - Endpoints [undefined/v1]
  - EndpointSlice [discovery.k8s.io/v1]
  - EgressRouter [network.operator.openshift.io/v1]
  - GRPCRoute [gateway.networking.k8s.io/v1]
  - Gateway [gateway.networking.k8s.io/v1]
  - GatewayClass [gateway.networking.k8s.io/v1]
  - HTTPRoute [gateway.networking.k8s.io/v1]
  - Ingress [networking.k8s.io/v1]
  - IngressClass [networking.k8s.io/v1]
  - IPAddress [networking.k8s.io/v1]
  - IPAMClaim [k8s.cni.cncf.io/v1alpha1]
  - IPPool [whereabouts.cni.cncf.io/v1alpha1]
  - MultiNetworkPolicy [k8s.cni.cncf.io/v1beta1]
  - NetworkAttachmentDefinition [k8s.cni.cncf.io/v1]
  - NetworkPolicy [networking.k8s.io/v1]
  - NodeSlicePool [whereabouts.cni.cncf.io/v1alpha1]
  - OverlappingRangeIPReservation [whereabouts.cni.cncf.io/v1alpha1]
  - PodNetworkConnectivityCheck [controlplane.operator.openshift.io/v1alpha1]
  - ReferenceGrant [gateway.networking.k8s.io/v1beta1]
  - Route [route.openshift.io/v1]
  - Service [undefined/v1]
  - ServiceCIDR [networking.k8s.io/v1]
  - IPAddressClaim [ipam.cluster.x-k8s.io/v1beta1]
  - UserDefinedNetwork [k8s.ovn.org/v1]
- Node APIs
  - About Node APIs
  - Node [undefined/v1]
  - PerformanceProfile [performance.openshift.io/v2]
  - Profile [tuned.openshift.io/v1]
  - RuntimeClass [node.k8s.io/v1]
  - Tuned [tuned.openshift.io/v1]
- OAuth APIs
  - About OAuth APIs
  - OAuthAccessToken [oauth.openshift.io/v1]
  - OAuthAuthorizeToken [oauth.openshift.io/v1]
  - OAuthClientAuthorization [oauth.openshift.io/v1]
  - OAuthClient [oauth.openshift.io/v1]
  - UserOAuthAccessToken [oauth.openshift.io/v1]
- Operator APIs
  - About Operator APIs
  - Authentication [operator.openshift.io/v1]
  - CloudCredential [operator.openshift.io/v1]
  - ClusterCSIDriver [operator.openshift.io/v1]
  - Console [operator.openshift.io/v1]
  - Config [operator.openshift.io/v1]
  - Config [imageregistry.operator.openshift.io/v1]
  - Config [samples.operator.openshift.io/v1]
  - CSISnapshotController [operator.openshift.io/v1]
  - DNS [operator.openshift.io/v1]
  - DNSRecord [ingress.operator.openshift.io/v1]
  - Etcd [operator.openshift.io/v1]
  - ImageContentSourcePolicy [operator.openshift.io/v1alpha1]
  - ImagePruner [imageregistry.operator.openshift.io/v1]
  - IngressController [operator.openshift.io/v1]
  - InsightsOperator [operator.openshift.io/v1]
  - KubeAPIServer [operator.openshift.io/v1]
  - KubeControllerManager [operator.openshift.io/v1]
  - KubeScheduler [operator.openshift.io/v1]
  - KubeStorageVersionMigrator [operator.openshift.io/v1]
  - MachineConfiguration [operator.openshift.io/v1]
  - Network [operator.openshift.io/v1]
  - OpenShiftAPIServer [operator.openshift.io/v1]
  - OpenShiftControllerManager [operator.openshift.io/v1]
  - OperatorPKI [network.operator.openshift.io/v1]
  - ServiceCA [operator.openshift.io/v1]
  - Storage [operator.openshift.io/v1]
- OperatorHub APIs
  - About OperatorHub APIs
  - CatalogSource [operators.coreos.com/v1alpha1]
  - ClusterCatalog [olm.operatorframework.io/v1]
  - ClusterExtension [olm.operatorframework.io/v1]
  - ClusterServiceVersion [operators.coreos.com/v1alpha1]
  - InstallPlan [operators.coreos.com/v1alpha1]
  - OLMConfig [operators.coreos.com/v1]
  - Operator [operators.coreos.com/v1]
  - OperatorCondition [operators.coreos.com/v2]
  - OperatorGroup [operators.coreos.com/v1]
  - PackageManifest [packages.operators.coreos.com/v1]
  - Subscription [operators.coreos.com/v1alpha1]
- Policy APIs
  - About Policy APIs
  - Eviction [policy/v1]
  - PodDisruptionBudget [policy/v1]
- Project APIs
  - About Project APIs
  - Project [project.openshift.io/v1]
  - ProjectRequest [project.openshift.io/v1]
- Provisioning APIs
  - About Provisioning APIs
  - BMCEventSubscription [metal3.io/v1alpha1]
  - BareMetalHost [metal3.io/v1alpha1]
  - DataImage [metal3.io/v1alpha1]
  - FirmwareSchema [metal3.io/v1alpha1]
  - HardwareData [metal3.io/v1alpha1]
  - HostFirmwareComponents [metal3.io/v1alpha1]
  - HostFirmwareSettings [metal3.io/v1alpha1]
  - HostUpdatePolicy [metal3.io/v1alpha1]
  - Metal3Remediation [infrastructure.cluster.x-k8s.io/v1beta1]
  - Metal3RemediationTemplate [infrastructure.cluster.x-k8s.io/v1beta1]
  - PreprovisioningImage [metal3.io/v1alpha1]
  - Provisioning [metal3.io/v1alpha1]
- RBAC APIs
  - About RBAC APIs
  - ClusterRoleBinding [rbac.authorization.k8s.io/v1]
  - ClusterRole [rbac.authorization.k8s.io/v1]
  - RoleBinding [rbac.authorization.k8s.io/v1]
  - Role [rbac.authorization.k8s.io/v1]
- Role APIs
  - About Role APIs
  - ClusterRoleBinding [authorization.openshift.io/v1]
  - ClusterRole [authorization.openshift.io/v1]
  - RoleBindingRestriction [authorization.openshift.io/v1]
  - RoleBinding [authorization.openshift.io/v1]
  - Role [authorization.openshift.io/v1]
- Schedule and quota APIs
  - About Schedule and quota APIs
  - AppliedClusterResourceQuota [quota.openshift.io/v1]
  - ClusterResourceQuota [quota.openshift.io/v1]
  - FlowSchema [flowcontrol.apiserver.k8s.io/v1]
  - LimitRange [undefined/v1]
  - PriorityClass [scheduling.k8s.io/v1]
  - PriorityLevelConfiguration [flowcontrol.apiserver.k8s.io/v1]
  - ResourceQuota [undefined/v1]
- Security APIs
  - About Security APIs
  - CertificateSigningRequest [certificates.k8s.io/v1]
  - CredentialsRequest [cloudcredential.openshift.io/v1]
  - PodSecurityPolicyReview [security.openshift.io/v1]
  - PodSecurityPolicySelfSubjectReview [security.openshift.io/v1]
  - PodSecurityPolicySubjectReview [security.openshift.io/v1]
  - RangeAllocation [security.openshift.io/v1]
  - Secret [undefined/v1]
  - SecurityContextConstraints [security.openshift.io/v1]
  - ServiceAccount [undefined/v1]
- Storage APIs
  - About Storage APIs
  - CSIDriver [storage.k8s.io/v1]
  - CSINode [storage.k8s.io/v1]
  - CSIStorageCapacity [storage.k8s.io/v1]
  - PersistentVolume [undefined/v1]
  - PersistentVolumeClaim [undefined/v1]
  - StorageClass [storage.k8s.io/v1]
  - StorageState [migration.k8s.io/v1alpha1]
  - StorageVersionMigration [migration.k8s.io/v1alpha1]
  - VolumeAttachment [storage.k8s.io/v1]
  - VolumePopulator [populator.storage.k8s.io/v1beta1]
  - VolumeSnapshot [snapshot.storage.k8s.io/v1]
  - VolumeSnapshotClass [snapshot.storage.k8s.io/v1]
  - VolumeSnapshotContent [snapshot.storage.k8s.io/v1]
- Template APIs
  - About Template APIs
  - BrokerTemplateInstance [template.openshift.io/v1]
  - PodTemplate [undefined/v1]
  - Template [template.openshift.io/v1]
  - TemplateInstance [template.openshift.io/v1]
- User and group APIs
  - About User and group APIs
  - Group [user.openshift.io/v1]
  - Identity [user.openshift.io/v1]
  - UserIdentityMapping [user.openshift.io/v1]
  - User [user.openshift.io/v1]
- Workloads APIs
  - About Workloads APIs
  - BuildConfig [build.openshift.io/v1]
  - Build [build.openshift.io/v1]
  - BuildLog [build.openshift.io/v1]
  - BuildRequest [build.openshift.io/v1]
  - CronJob [batch/v1]
  - DaemonSet [apps/v1]
  - Deployment [apps/v1]
  - DeploymentConfig [apps.openshift.io/v1]
  - DeploymentConfigRollback [apps.openshift.io/v1]
  - DeploymentLog [apps.openshift.io/v1]
  - DeploymentRequest [apps.openshift.io/v1]
  - Job [batch/v1]
  - Pod [undefined/v1]
  - ReplicationController [undefined/v1]
  - ReplicaSet [apps/v1]
  - StatefulSet [apps/v1]
Virtualization
- About
- Getting started
  - Getting started with OKD Virtualization
- Installing
- Postinstallation configuration
- Updating
  - Updating OKD Virtualization
- Creating a virtual machine
- Advanced VM creation
- Managing VMs
- Networking
- Storage
- Live migration
- Nodes
- Monitoring
- Support
  - Support overview
  - Troubleshooting
- Backup and restore

User-provided certificates for default ingress reference
- Purpose
- Location
- Management
- Expiration
- Services
- Customization
Additional resources

Review user-provided ingress certificates in OKD, including transport layer security (TLS) secret storage, IngressController references, and replacing Operator-generated defaults.

Use user-provided certificates for the default IngressController CR to complete the following tasks:

Replace Operator-generated default certificates before production use.
Store TLS secrets in the correct namespace.
Reference the secret in the IngressController CR.

User-provided certificates for default ingress reference

Use user-provided default ingress certificates to allow applications on the default apps domain to present a custom TLS certificate to clients, so clients do not need to have cluster-managed certificate authority (CA) certificates installed.

Purpose

Applications are usually exposed at <route_name>.apps.<cluster_name>.<base_domain>. The <cluster_name> and <base_domain> come from the installation config file. <route_name> is the host field of the route, if specified, or the route name. For example, hello-openshift-default.apps.username.devcluster.openshift.com. hello-openshift is the name of the route and the route is in the default namespace. You might want clients to access the applications without distributing cluster-managed CA certificates to the clients. Cluster administrators must set a custom default certificate when serving application content.

The Ingress Operator generates a default certificate for an IngressController CR to serve as a placeholder until you configure a custom default certificate. Do not use Operator-generated default certificates in production clusters.

Location

Store user-provided certificates in a tls type Secret resource in the openshift-ingress namespace. Update the IngressController CR in the openshift-ingress-operator namespace to enable the use of the user-provided certificate. For more information, see "Setting a custom default certificate".

Management

User-provided certificates are managed by the user.

Expiration

Expiration and renewal are managed by the user.

Services

Applications deployed on the cluster use user-provided certificates for default ingress.

Customization

Update the secret containing the user-managed certificate as needed.