:_mod-docs-content-type: ASSEMBLY
[id="setting-up-trusted-ca"]
= Setting up additional trusted certificate authorities for builds
ifndef::openshift-dedicated,openshift-rosa[]
include::_attributes/common-attributes.adoc[]
endif::[]
ifdef::openshift-dedicated,openshift-rosa[]
include::_attributes/attributes-openshift-dedicated.adoc[]
endif::[]
:context: setting-up-trusted-ca

toc::[]

ifdef::openshift-enterprise,openshift-rosa,openshift-dedicated,openshift-webscale,openshift-origin[]
Use the following sections to set up additional certificate authorities (CA) to be trusted by builds when pulling images from an image registry.

The procedure requires a cluster administrator to create a `ConfigMap` and add additional CAs as keys in the `ConfigMap`.

* The `ConfigMap` must be created in the `openshift-config` namespace.
* `domain` is the key in the `ConfigMap` and `value` is the PEM-encoded certificate.
** Each CA must be associated with a domain. The domain format is `hostname[..port]`.
* The `ConfigMap` name must be set in the `image.config.openshift.io/cluster` cluster scoped configuration resource's `spec.additionalTrustedCA` field.
//* No longer needs single PEM bundle

include::modules/configmap-adding-ca.adoc[leveloffset=+1]

[role="_additional-resources"]
== Additional resources

* link:https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#create-a-configmap[Create a `ConfigMap`]
* link:https://kubectl.docs.kubernetes.io/guides/config_management/secrets_configmaps/[Secrets and `ConfigMaps`]
ifndef::openshift-rosa,openshift-dedicated[]
* xref:../../networking/configuring_network_settings/configuring-a-custom-pki.adoc#configuring-a-custom-pki[Configuring a custom PKI]
endif::[]
endif::[]
