Where do azure store proxy Ca certificate on AKS cluster or nodes?

Question

Where do azure store proxy Ca certificate on AKS cluster or nodes?

Chaitrali Deshmukh 41

Hi,

I have setup a proxy on AKS cluster, but would like to know where does these proxy certificates gets stored on the cluster or on the node vms for triaging purposes?

Thanks

Prrudram-MSFT 28,281 Reputation points Microsoft Employee Moderator

2023-09-05T04:38:21.0333333+00:00
Hi @Chaitrali Deshmukh

The certificates for the proxy are not stored on the AKS cluster or the node VMs. Instead, the certificates are passed as a base64-encoded string in the trustedCa field of the JSON configuration file used to configure the proxy. This configuration file is passed to the AKS cluster during creation or update using the az aks create or az aks update command.

If you need to retrieve the certificate for triaging purposes, you can decode the base64-encoded string and save it as a .pem file on your local machine. Here's an example command to decode the string and save it as a file:

echo "base64-encoded-string" | base64 -d > trusted-ca.pem

Replace base64-encoded-string with the actual base64-encoded string from the trustedCa field of your configuration file. This will create a file named trusted-ca.pem in your current directory containing the decoded certificate.
Prrudram-MSFT 28,281 Reputation points Microsoft Employee Moderator

2023-09-08T15:10:51.3+00:00

Hi @Chaitrali Deshmukh

Any update here.

Your answer

Prrudram-MSFT 28,281 Reputation points Microsoft Employee Moderator

2023-09-05T04:38:21.0333333+00:00

Hi @Chaitrali Deshmukh

The certificates for the proxy are not stored on the AKS cluster or the node VMs. Instead, the certificates are passed as a base64-encoded string in the trustedCa field of the JSON configuration file used to configure the proxy. This configuration file is passed to the AKS cluster during creation or update using the az aks create or az aks update command.

If you need to retrieve the certificate for triaging purposes, you can decode the base64-encoded string and save it as a .pem file on your local machine. Here's an example command to decode the string and save it as a file:

echo "base64-encoded-string" | base64 -d > trusted-ca.pem

Replace base64-encoded-string with the actual base64-encoded string from the trustedCa field of your configuration file. This will create a file named trusted-ca.pem in your current directory containing the decoded certificate.
Prrudram-MSFT 28,281 Reputation points Microsoft Employee Moderator

2023-09-08T15:10:51.3+00:00

Hi @Chaitrali Deshmukh

Any update here.

Share via

Where do azure store proxy Ca certificate on AKS cluster or nodes?

Your answer