Cloudera Docs

Updating the Control Plane certificates in Cloudera Data Engineering Virtual Clusters

Learn about how to update the Control Plane certificates in Cloudera Data Engineering Virtual Clusters.

When you create a Cloudera Data Engineering Virtual Cluster, Cloudera Data Engineering automatically installs a self-signed TLS certificate. Perform the following steps to update the TLS certificate for Cloudera Data Engineering virtual clusters:

  1. In the Cloudera console, click the Data Engineering tile. The Cloudera Data Engineering Home page displays.
  2. Click Administration in the left navigation menu. The Administration page displays.
  3. In the Services column, select the service containing the virtual cluster for which you want to update the TLS certificate.
  4. In the Virtual Clusters column on the right, click the Cluster Details icon for the virtual cluster for which you want to update the TLS certificate.
  5. Click Actions > Copy Jobs API URL to copy the URL to your clipboard.
  6. Paste the URL into a text editor to identify the endpoint host. For example, the URL is similar to the following:
    http://dfdj6kgx.cde-2cdxw5x5.apps.ecs-demo.example.com/dex/api/v1

    The endpoint host is dfdj6kgx.cde-2cdxw5x5.apps.ecs-demo.example.com.

  7. Create your CA certificate and a private key. Make sure that your CA certificate includes the Subject Alternative Names (SAN) for all relevant endpoints.
    • CN (Common Name): *.cde-2cdxw5x5.apps.ecs-demo.example.com
    • Domain name for the Virutal Cluster: dfdj6kgx.cde-2cdxw5x5.apps.ecs-demo.example.com
  8. Sign in to Cloudera Data Engineering as VC Admin. The Cloudera Data Engineering Home page displays.
  9. Click Administration in the left navigation menu. The Administration page displays.
  10. In the Services column, select the service containing the virtual cluster for which you want to update the TLS certificate.
  11. In the Virtual Clusters column on the right, click the Cluster Details icon for the virtual cluster for which you want to update the TLS certificate.
  12. On the Configuration tab, click TLS Certificate.
  13. Click Upload Certificate.
  14. Under PEM file, click Select File and select your TLS certificate.
  15. Under Key file, click Select File and select your key file.
  16. (Optional) If your key file is encrypted with a password, then enter the password in the Passphrase field.
  17. Click Install Certificate.
  18. Repeat the preceding steps for all Virtual Clusters.
  1. Make sure that you are using the VCAdmin role for the corresponding Virtual Cluster and rotate Virtual Cluster TLS certificate.
    curl -H "Cookie: cdp-session-token=${CST}" \  '[***BASE-URL***]/dex/api/v1/cluster/<cluster-id>/instance/{id}/tls' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -X 'PUT' -d '{
certificate_details": {
"certificate": "base64 encoded.pem-file content",
"key": "<base64 encoded file content>",
"passphrase": "<base64 encoded passphrase for the key>" (optional) 
      }
}'
  2. Make sure that you are using the VCUser role for the corresponding Virtual Cluster and view the Virtual Cluster level TLS Certificate information.
    curl -H "Cookie: cdp-session-token=${CST}" \  '[***BASE-URL***]/dex/api/v1/cluster/<cluster-id>/instance/{id}/tls' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -X GET -d '{}'