docs: document daemonset.injectCA.enabled Helm setting - #1337
Open
ekline[bot] wants to merge 6 commits into
Open
docs: document daemonset.injectCA.enabled Helm setting#1337ekline[bot] wants to merge 6 commits into
ekline[bot] wants to merge 6 commits into
Conversation
Document the new daemonset.injectCA.enabled setting on the Helm configuration page and add an 'Injecting the CA into cluster nodes' section to the bring-your-own-certificate page covering the containerd restart impact, the opt-out, and per-provider node trust-store options. Related to okteto/app#10368. ekline[bot] <202747777+ekline[bot]@users.noreply.github.com> Signed-off-by: ekline[bot] <202747777+ekline[bot]@users.noreply.github.com>
ekline
Bot
requested review from
codyjlandstrom,
ifbyol,
pchico83 and
rlamana
as code owners
August 27, 2026 14:03
✅ Deploy Preview for okteto-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Add a framing sentence on the shared goal (install the CA on every node and restart containerd) before the provider list, and clarify the Karpenter option to note the user supplies a bootstrap script that installs the CA and restarts containerd. ekline[bot] <202747777+ekline[bot]@users.noreply.github.com> Signed-off-by: ekline[bot] <202747777+ekline[bot]@users.noreply.github.com>
Clarify that because these provider mechanisms inject the CA as the node is provisioned, the containerd restart happens before the node is ready and before any pod runs on it, so it avoids the interruptions the daemonset causes on nodes already running workloads. ekline[bot] <202747777+ekline[bot]@users.noreply.github.com> Signed-off-by: ekline[bot] <202747777+ekline[bot]@users.noreply.github.com>
ekline[bot] <202747777+ekline[bot]@users.noreply.github.com>
rberrelleza
reviewed
Aug 27, 2026
| - `extraEnv`: Environment variables to be set on the daemonset containers. | ||
| - `labels`: Labels to add to the daemonset pods. | ||
| - `configurePrivateRegistriesInNodes.enabled`: Specifies if the daemonset should configure the private registry credentials in the nodes for kubelet or not. It defaults to `false`. It's disabled if `regcredsManager.pullSecrets.enabled=true`. | ||
| - `injectCA.enabled`: Controls whether the daemonset injects the CA into each node's trust store, so the kubelet can pull images from Okteto Registry when using a private CA. It defaults to `true`, and setting it to `false` skips only this task while every other daemon task keeps running and CA trust elsewhere in the Okteto Platform stays intact. This setting can only turn CA injection off, not on, so it has no effect when both `wildcardCertificate.privateCA` and `wildcardCertificate.create` are disabled. |
Member
There was a problem hiding this comment.
task keeps running and CA trust elsewhere in the Okteto Platform stays intact.
what do we mean by this?
Member
There was a problem hiding this comment.
When wildcardCertificate.privateCA.enabled is enabled, apart of enabling this task, Okteto does other things like mounting the CA in all Okteto components, so they can talk each other without issues. What we mean with that, is that we only disable the daemonset task, but the rest of things done by Okteto related to the private CA are still applied
| - **Amazon Elastic Kubernetes Service (EKS)**, depending on how you manage nodes: | ||
| - With Karpenter, by supplying a node bootstrap script through [`spec.userData`](https://karpenter.sh/docs/concepts/nodeclasses/#specuserdata) that installs the CA and restarts `containerd`. | ||
| - With a managed cluster configuration, following [Use private certificates to enable a container repository in Amazon EKS](https://aws.amazon.com/blogs/containers/use-private-certificates-to-enable-a-container-repository-in-amazon-eks/). | ||
| - On Bottlerocket nodes, through the [PKI settings](https://bottlerocket.dev/en/os/1.64.x/api/settings/pki/). |
Member
There was a problem hiding this comment.
does this mean that we support bottlerocket with this change @ifbyol @codyjlandstrom ? if not, we should remove this line.
Member
There was a problem hiding this comment.
No, for that, the whole daemonset has to be disabled. This would be one of the things needed to support that case, but only this wouldn't enable Bottlerocket support.
Removed the Bottlerocket reference here
|
|
||
| Because these mechanisms inject the CA as the node is provisioned, the `containerd` restart happens before the node is ready and before any pod runs on it. This avoids the interruptions the daemonset causes when it restarts `containerd` on nodes that already run workloads. | ||
|
|
||
| Alternatively, on any provider you can configure `containerd` to trust the CA for a specific registry with a [`hosts.toml` file](https://github.com/containerd/containerd/blob/main/docs/hosts.md) under `/etc/containerd/certs.d/`, instead of adding the CA to the node's system trust store. In this case you still place the CA certificate on the node, at the path the `hosts.toml` `ca` field references. No newline at end of file |
Member
There was a problem hiding this comment.
I think we should pick one recommendation per provider. there's an infinite ways that this can be configured, but we are not responsible for teaching this to the customer. Maybe we can keep an internal doc for suggestions for when the customer asks?
Member
There was a problem hiding this comment.
I think we should pick one recommendation per provider
@rberrelleza Does this apply to eks too? We show 2 options there: through Karpenter, or directly in AWS. Should we just choose 1 there?
Co-authored-by: Ramiro Berrelleza <rberrelleza@gmail.com>
- Fold the injectCA.enabled disable caveat into the setting description and drop the standalone warning callout. - Remove the Bottlerocket EKS option (not officially supported by Okteto). - Remove the node-provisioning interruption explanation and fix a double space in the provider-list intro. ekline[bot] <202747777+ekline[bot]@users.noreply.github.com> Signed-off-by: ekline[bot] <202747777+ekline[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents the new
daemonset.injectCA.enabledHelm setting introduced in okteto/app#10368.What changed
self-hosted/helm-configuration.mdx: Added theinjectCA.enabledsetting to thedaemonsetsection (defaulttrue), with a warning about the conditions required before disabling it. Noted the new gate on the two CA-installation task bullets.self-hosted/install/certificates/bring-your-own-certificate.mdx: Added an "Injecting the CA into cluster nodes" section under "Bring your own Certificate Authority" explaining the default CA injection, thecontainerdrestart impact, theinjectCA.enabledopt-out, per-provider node trust-store guides (GKE, AKS, EKS via Karpenter / cluster config / Bottlerocket), and acontainerdcerts.dalternative.Why
PR okteto/app#10368 adds
daemonset.injectCA.enabledso operators can stop the Okteto daemon from injecting the CA into node trust stores. Disabling it avoids thecontainerdrestart that interrupts running operations on the node, but shifts responsibility for node CA trust to the operator.How to verify
injectCA.enabledbullet and warning render in thedaemonsetsection of the Helm configuration page.yarn buildto validate links and anchors (not run in the authoring environment).📝 Created with EkLine · View session