OSDOCS-14879: add link to certificate procedure

[jldohmann]

Version(s): 4.19+

Issue: https://issues.redhat.com/browse/OSDOCS-14945

Link to docs preview: https://100982--ocpdocs-pr.netlify.app/openshift-enterprise/latest/networking/ingress_load_balancing/configuring_ingress_cluster_traffic/ingress-gateway-api.html#nw-ingress-gateway-api-enable_ingress-gateway-api

QE review:

• QE has approved this change.

Additional information:

[openshift-ci-robot]

@jldohmann: This pull request references OSDOCS-14879 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "4.21." or "openshift-4.21.", but it targets "openshift-4.19" instead.

Details

In response to this:

Version(s): 4.19+

Issue: https://issues.redhat.com/browse/OSDOCS-14945

Link to docs preview:

QE review:

• QE has approved this change.

Additional information:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ocpdocs-previewbot]

🤖 Wed Oct 22 22:18:04 - Prow CI generated the docs preview:

https://100982--ocpdocs-pr.netlify.app/openshift-enterprise/latest/networking/ingress_load_balancing/configuring_ingress_cluster_traffic/ingress-gateway-api.html

[openshift-ci]

@jldohmann: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@jldohmann: This pull request references OSDOCS-14879 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "4.21." or "openshift-4.21.", but it targets "openshift-4.19" instead.

Details

In response to this:

Version(s): 4.19+

Issue: https://issues.redhat.com/browse/OSDOCS-14945

Link to docs preview: https://100982--ocpdocs-pr.netlify.app/openshift-enterprise/latest/networking/ingress_load_balancing/configuring_ingress_cluster_traffic/ingress-gateway-api.html#nw-ingress-gateway-api-enable_ingress-gateway-api

QE review:

• QE has approved this change.

Additional information:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jldohmann]

@candita i've updated the Gateway API getting started doc to include a link to our doc "Replacing the default ingress certificate" which showswildcard.crt and wildcard.keyare created. wdyt? does this cover everything from your perspective?

[candita]

I'm not sure about this one. What's the real link that it points to?

/hold

[jldohmann]

I'm not sure about this one. What's the real link that it points to?

it is pointing to this content: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/security_and_compliance/configuring-certificates#replacing-default-ingress_replacing-default-ingress

[candita]

The introduction and instructions for creating an ssl certificate should look something like this. Is there anything in our docs that looks like this, especially using the command openssl or acquiring a certificate from a certificate authority (A Certificate Authority (CA) is an entity that issues SSL certificates. ).

First, we will need a certificate for configuring the TLS termination. Acquire a certificate with the common name that you want to use from your CA.

For testing purposes, you can create your own CA and serving certificate as follows:

$ mkdir certs
$ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj "/O=MyCompany/CN=gwapi.${DOMAIN}" -keyout certs/ca.key -out certs/ca.crt
$ openssl req -out certs/edge.csr -newkey rsa:2048 -nodes -keyout certs/edge.key -subj "/CN=*.gwapi.${DOMAIN}/O=MyCompany"
$ openssl x509 -req -sha256 -days 365 -CA certs/ca.crt -CAkey certs/ca.key -set_serial 0 -in certs/edge.csr -out certs/edge.crt

[jldohmann]

@candita we do, but it's in the serverless docs: https://docs.redhat.com/en/documentation/red_hat_openshift_serverless/1.36/html/integrations/serverless-ossm-setup#serverlesss-ossm-external-certs_serverless-ossm-setup

do you think this makes sense to link out to? or just replicate with the pertinent info? cc: @ahardin-rh

[candita]

@candita we do, but it's in the serverless docs: https://docs.redhat.com/en/documentation/red_hat_openshift_serverless/1.36/html/integrations/serverless-ossm-setup#serverlesss-ossm-external-certs_serverless-ossm-setup

do you think this makes sense to link out to? or just replicate with the pertinent info? cc: @ahardin-rh

If @Miciah or @alebedev87 agree, I think it makes sense to replicate it. But, since it is only for testing purposes, I'm not sure we should publish it (or if serverless should have published it either.)