From 687136131e1f871dda7aa9abf09962426c3c62d3 Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Wed, 2 Mar 2022 08:40:27 -0500 Subject: [PATCH] Place Confluent CA certs into TLS anchors When processes may update the certificate authorities, the confluent CA trust would be lost. Place it appropriately so that update-ca-trust will keep it in the appropriate place. --- confluent_osdeploy/el8/profiles/default/kickstart | 1 + 1 file changed, 1 insertion(+) diff --git a/confluent_osdeploy/el8/profiles/default/kickstart b/confluent_osdeploy/el8/profiles/default/kickstart index a7742e10..9352ed88 100644 --- a/confluent_osdeploy/el8/profiles/default/kickstart +++ b/confluent_osdeploy/el8/profiles/default/kickstart @@ -94,6 +94,7 @@ chmod +x /mnt/sysimage/opt/confluent/bin/firstboot.sh %post cat /etc/confluent/tls/*.pem >> /etc/pki/tls/certs/ca-bundle.crt +cp /etc/confluent/tls/*.pem /etc/pki/ca-trust/source/anchors systemctl enable firstboot chgrp ssh_keys /etc/ssh/ssh*key restorecon /etc/ssh/ssh*key /root/.shosts /etc/ssh/shosts.equiv /etc/ssh/ssh_config.d/* /opt/confluent/bin/firstboot.sh