Configure Stork and PXE for S3

The following sections explain how you can add the secure S3 object store certificate to Stork and Portworx Enterprise component on application cluster:

Stork

You need to modify the Stork deployment file to add a secret mount with the custom certificate, and then add an environment variable pointing to the secret mount.

• Create a secret in the namespace where Stork is deployed with the S3 object store certificate, assuming the file public.crt contains the certificate:

  kubectl -n <stork-namespace> create secret generic px-s3-certs --from-file=public.crt

After performing the above task, you can deploy Stork using any one of the two methods specified below:

1. Portworx operator method with storage cluster - stc:

• Update the stork section of stc spec with the following configuration settings:
  

     spec:
       stork:
         enabled: true
         env:
           - name: AWS_CA_BUNDLE
             value: /etc/pwx/s3cert/public.crt
           - name: SSL_CERT_DIR
             value: /etc/pwx/s3cert
         volumes:
           - name: px-s3-certs
             mountPath: /etc/pwx/s3cert
             secret:
               secretName: px-s3-certs
               items:
                 - key: public.crt
                   path: public.crt

2. Directly applying stork.spec by modifying the Stork deployment:

To modify the Stork deployment, perform the below steps.

• Edit the Stork deployment:

  kubectl edit deployment stork -n <stork-namespace>

• Add AWS_CA_BUNDLE and SSL_CERT_DIR environment variables:

  env:
  - name: PX_SERVICE_NAME
    value: portworx-api
  - name: AWS_CA_BUNDLE
    value: /etc/pwx/s3cert/public.crt
  - name: SSL_CERT_DIR
    value: /etc/pwx/s3cert

• Add volume mounts:

  volumeMounts:
  - mountPath: /etc/pwx/s3cert
    name: px-s3-certs

• Add a volume:

  volumes:
  - name: px-s3-certs
    secret:
      defaultMode: 420
      secretName: px-s3-certs

• Save the changes and wait for the Stork pods to restart.

Portworx Enterprise

The configuration to Portworx Enterprise depends on how you deployed it. For more information, refer to Certificates as Kubernetes Secrets.