Skip to main content
This guide explains how to install Astro Private Cloud in an environment that uses Private Certificate Authority (Private CA)–issued TLS certificates. In this setup, all platform components, including the control plane, data plane, and internal services, communicate over secure HTTPS connections that are validated against your organization’s internal CA. This procedure covers configuring trusted roots, deploying certificates to the appropriate namespaces, and ensures the Astro installation properly trusts and uses the Private CA during installation and runtime.
  1. Store the CA’s root public certificate to an Opaque Kubernetes secret in the Astro Private Cloud namespace with a descriptive name, such as private-root-ca, by running the following command.
Before you run this command, keep the following in mind:
  • The root certificate you specify should be the certificate of the authority that signed the Astro Private Cloud certificate. This isn’t the certificate associated with Astro Private Cloud or any other service.
  • The name of the secret file must be cert.pem for your certificate to be trusted properly.
  • The file must contain only a single certificate, it can’t be a certificate bundle.
  1. Add <secret name> to the list of secret names contained in global.privateCaCerts in values.yaml:
Step 3 and 4 are additional steps for Private CA on the control plane only
  1. Create a database secret and add <secret name> to the list of secret names.
  1. Add your Private CA to your Helm values.yaml.

​
LDAP over LDAPS with a private CA

Astro Private Cloud 2.1This feature was introduced in Astro Private Cloud 2.1. To access this feature, upgrade your Astro Private Cloud installation to 2.1 or later.
When your LDAP directory presents a server certificate signed by a Private CA, this configuration is what makes Houston trust the certificate at the LDAP layer. After completing the preceding steps, keep auth.ldap.tls.mode: ldaps and auth.ldap.tls.verifyServerCert: true in Houston’s configuration. For the LDAP-side configuration, see Configure LDAP authentication.