이 페이지에서는 실행 중인 관리자 클러스터와 사용자 클러스터에 변경사항을 알려야 하므로 vCenter CA 인증서가 변경된 경우 이에 대한 참조를 업데이트하는 방법을 설명합니다. 이는 관리자 클러스터 구성 파일의 vCenter.caCertPath 필드 및 Google Distributed Cloud의 사용자 클러스터 구성 파일에 영향을 줍니다.
여기에 설명된 대로 gkectl update 명령어를 사용하여 인증서 참조를 업데이트할 수 있습니다.
클러스터 구성 파일에서 참조된 vCenter CA 인증서 업데이트
새 인증서를 사용하도록 실행 중인 관리자 클러스터와 사용자 클러스터를 업데이트하려면 다음을 수행하세요.
VCENTER_IP_ADDRESS_OR_FQDN: vCenter Server의 IP 주소 또는 FQDN입니다.
VCENTER_USERNAME: vCenter Server의 사용자 이름입니다.
VCENTER_PASSWORD: 지정된 사용자 이름의 비밀번호입니다.
FULL_PATH_OF_EXTRACTED_LIN_FILE: 유효성 테스트를 수행할 Linux 인증서 파일의 전체 경로입니다.
vCenter 인증서가 유효한지 확인하려면 govc about 명령어를 실행합니다.
govc about
vCenter 인증서가 유효하면 govc about 명령어로 다음과 유사한 vCenter Server 관련 세부정보가 출력됩니다.
FullName: VMware Center Server 7.0.3 build-24322018
Name: VMware Center Server
Vendor: VMware, Inc.
Version: 7.0.3
Build: 24322018
OS type: linux-x64
API type: VirtualCenter
API version: 7.0.3.0
Product ID: vpx
UUID: 475fa366-faa9-43f0-9417-e6dadc55514c
인증서가 유효하지 않으면 x509 오류가 표시됩니다. x509 오류가 표시되면 추출된 ..../certs/lin 폴더의 다른 Linux 인증서 파일을 가리키도록 FULL_PATH_OF_EXTRACTED_LIN_FILE 환경 변수를 업데이트한 후 govc about 명령어를 다시 실행합니다. 유효한 인증서를 찾을 때까지 또는 추출된 ..../certs/lin 폴더에 있는 각 Linux 인증서 파일 테스트를 완료할 때까지 a단계와 b단계를 반복합니다.
관리자 클러스터 구성 파일의 vCenter.caCertPath 필드에 지정된 경로에 있는 이전 vCenter CA 인증서 파일을 백업하려면 이름을 vcenter-ca-cert.pem.old로 바꿉니다.
..../certs/lin 폴더에 있는 유효한 새 인증서 파일의 이름을 vcenter-ca-cert.pem으로 바꾼 후 관리자 클러스터 구성 파일의 vCenter.caCertPath 필드에 지정된 경로로 이동합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["This page describes how to update the reference to the vCenter CA certificate if it has changed, as your running admin cluster and user clusters must be informed of the change. This affects the `vCenter.caCertPath` field in the admin cluster configuration file and the user cluster configuration files for Google Distributed Cloud.\n\nYou can update the certificate references with the `gkectl update` command as described here.\n\nUpdate the referenced vCenter CA certificate in the cluster configuration files\n\nTo update the running admin and user clusters to use the new certificate:\n\n1. Retrieve the new vCenter CA certificate and extract it:\n\n ```\n curl -o certs.zip https://VCENTER_IP_ADDRESS_OR_FQDN/certs/download.zip\n unzip certs.zip\n ```\n\n You can use the `-k` flag if you want to allow unknown certificates. This is to avoid any certificate issues you may have accessing vCenter.\n2. Determine which of the vCenter certificates is valid. Only one of the Linux certificate files in the extracted `..../certs/lin` folder is the valid vCenter certificate. To determine which file is the valid vCenter certificate, do the following:\n\n 1. Set the following environment variables from the Admin Workstation where `govc` is already installed. If not already done, [download and install govc tool](https://github.com/vmware/govmomi/tree/main/govc#binaries):\n\n ```\n export GOVC_URL=https://VCENTER_IP_ADDRESS_OR_FQDN\n export GOVC_USERNAME=VCENTER_USERNAME\n export GOVC_PASSWORD=VCENTER_PASSWORD\n export GOVC_TLS_CA_CERTS=FULL_PATH_OF_EXTRACTED_LIN_FILE\n export GOVC_INSECURE=false\n ```\n\n \u003cbr /\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eVCENTER_IP_ADDRESS_OR_FQDN\u003c/var\u003e: the IP address or FQDN of the vCenter Server.\n\n - \u003cvar translate=\"no\"\u003eVCENTER_USERNAME\u003c/var\u003e: the username of the vCenter Server.\n\n - \u003cvar translate=\"no\"\u003eVCENTER_PASSWORD\u003c/var\u003e: the password for the specified username.\n\n - \u003cvar translate=\"no\"\u003eFULL_PATH_OF_EXTRACTED_LIN_FILE\u003c/var\u003e: the full path to the Linux certificate file for which you are conducting a validity test.\n\n 2. To verify that the vCenter certificate is valid, run the `govc about` command:\n\n ```\n govc about\n ```\n\n If the vCenter certificate is valid, the `govc about` command prints details about the vCenter Server similar to the following: \n\n FullName: VMware Center Server 7.0.3 build-24322018\n Name: VMware Center Server\n Vendor: VMware, Inc.\n Version: 7.0.3\n Build: 24322018\n OS type: linux-x64\n API type: VirtualCenter\n API version: 7.0.3.0\n Product ID: vpx\n UUID: 475fa366-faa9-43f0-9417-e6dadc55514c\n\n If the certificate is invalid, you should see an `x509` error. If you see an `x509` error, update the `FULL_PATH_OF_EXTRACTED_LIN_FILE` environment variable to point at a different Linux certificate file in the extracted `..../certs/lin` folder, and then run the `govc about` command again. Repeat steps a. and b. until you locate the valid certificate, or until you are done testing each of the Linux certificate files in the extracted `..../certs/lin` folder.\n3. To backup the old vCenter CA certificate file (which is at the path specified in the [`vCenter.caCertPath`](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/admin-cluster-configuration-file-latest#vcenter-cacertpath-field) field of your admin cluster configuration file), rename it to `vcenter-ca-cert.pem.old`.\n\n4. Rename the new valid certificate file in the `..../certs/lin` folder to `vcenter-ca-cert.pem` and then move it to the path specified in the [`vCenter.caCertPath`](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/admin-cluster-configuration-file-latest#vcenter-cacertpath-field) field of your admin cluster configuration file.\n\n5. Update your admin cluster:\n\n ```\n gkectl update admin --config ADMIN_CLUSTER_CONFIG --kubeconfig ADMIN_CLUSTER_KUBECONFIG\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eADMIN_CLUSTER_CONFIG\u003c/var\u003e: the path of your admin cluster configuration file.\n\n After the update command completes, the admin cluster will use the new\n certificate.\n6. Verify that the admin cluster is healthy:\n\n ```\n gkectl diagnose cluster --kubeconfig ADMIN_CLUSTER_KUBECONFIG\n ```\n\n For more information, see\n [Diagnose an admin cluster](/kubernetes-engine/distributed-cloud/vmware/docs/troubleshooting/diagnose#diagnose_admin_cluster).\n7. In each of your user cluster configuration files, set [`vCenter.caCertPath`](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/user-cluster-configuration-file-latest#vcenter-cacertpath-field) to the path of your new `vcenter-ca-cert.pem` file.\n\n8. For each of your user clusters, run the `gkectl update` command:\n\n ```\n gkectl update cluster --config USER_CLUSTER_CONFIG --kubeconfig ADMIN_CLUSTER_KUBECONFIG\n ```\n\n \u003cbr /\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eUSER_CLUSTER_CONFIG\u003c/var\u003e: the path of your user cluster configuration file.\n\n After the update command completes for a particular user cluster, the cluster\n will use the new certificate.\n9. Verify that the user cluster is healthy:\n\n ```\n gkectl diagnose cluster --kubeconfig ADMIN_CLUSTER_KUBECONFIG \\\n --cluster-name USER_CLUSTER_NAME\n ```\n\n For more information, see\n [Diagnose a user cluster](/kubernetes-engine/distributed-cloud/vmware/docs/troubleshooting/diagnose#diagnose_user_cluster).\n\n| **Note:** The `vCenter.caCertPath` field also appears in the admin workstation configuration file. If you want to create a new admin workstation, make sure that you edit the `vCenter.caCertPath` field to reference the current certificate."]]
