Skip to content

Commit f0c52d6

Browse files
spbsolublespbsoluble
committed
chore(docs): Update docs
1 parent 3641e96 commit f0c52d6

File tree

1 file changed

+63
-20
lines changed

1 file changed

+63
-20
lines changed

‎README.md‎

Lines changed: 63 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -561,18 +561,44 @@ credentials are provided, the extension assumes authentication is via system ass
561561
</details>
562562

563563

564-
## Create the AKV Certificate Store Type
564+
## AKV Certificate Store Type
565565

566566
To use the Azure Key Vault Universal Orchestrator extension, you **must** create the AKV Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance.
567567

568568

569569

570-
* **Create AKV using kfutil**:
571570

572-
```shell
573-
# Azure Keyvault
574-
kfutil store-types create AKV
575-
```
571+
### Supported Operations
572+
573+
| Operation | Is Supported |
574+
|--------------|------------------------------------------------------------------------------------------------------------------------|
575+
| Add | ✅ Checked |
576+
| Remove | ✅ Checked |
577+
| Discovery | ✅ Checked |
578+
| Reenrollment | 🔲 Unchecked |
579+
| Create | ✅ Checked |
580+
581+
### Creation Using kfutil:
582+
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to created certificate store types.
583+
For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart)
584+
585+
#### Using online definition from GitHub:
586+
This will reach out to GitHub and pull the latest store-type definition
587+
```shell
588+
# Azure Keyvault
589+
kfutil store-types create AKV
590+
```
591+
592+
#### Offline creation using integration-manifest file:
593+
If required, it is possible to create store types from the [integration-manifest.json](./integration-manifest.json) included in this repo.
594+
You would first download the [integration-manifest.json](./integration-manifest.json) and then run the following command
595+
in your offline environment.
596+
```shell
597+
kfutil store-types create --from-file integration-manifest.json
598+
```
599+
600+
### Manual Creation
601+
If you do not wish to use the `kfutil` CLI then certificate store types can be creating in the web UI as described below.
576602

577603
* **Create AKV manually in the Command UI**:
578604
<details><summary>Create AKV manually in the Command UI</summary>
@@ -628,8 +654,6 @@ To use the Azure Key Vault Universal Orchestrator extension, you **must** create
628654

629655
![AKV Custom Fields Tab](docsource/images/AKV-custom-fields-store-type-dialog.png)
630656

631-
632-
633657
#### Entry Parameters Tab
634658

635659
| Name | Display Name | Description | Type | Default Value | Entry has a private key | Adding an entry | Removing an entry | Reenrolling an entry |
@@ -642,13 +666,14 @@ To use the Azure Key Vault Universal Orchestrator extension, you **must** create
642666

643667

644668

645-
</details>
669+
646670

647671
## Installation
648672

649673
1. **Download the latest Azure Key Vault Universal Orchestrator extension from GitHub.**
650674

651675
Navigate to the [Azure Key Vault Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/azurekeyvault-orchestrator/releases/latest). Refer to the compatibility matrix below to determine whether the `net6.0` or `net8.0` asset should be downloaded. Then, click the corresponding asset to download the zip archive.
676+
652677
| Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `azurekeyvault-orchestrator` .NET version to download |
653678
| --------- | ----------- | ----------- | ----------- |
654679
| Older than `11.0.0` | | | `net6.0` |
@@ -678,15 +703,23 @@ To use the Azure Key Vault Universal Orchestrator extension, you **must** create
678703
Refer to [Starting/Restarting the Universal Orchestrator service](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/StarttheService.htm).
679704

680705

706+
6. **(optional) PAM Integration**
707+
708+
The Azure Key Vault Universal Orchestrator extension is compatible with all supported Keyfactor PAM extensions to resolve PAM-eligible secrets. PAM extensions running on Universal Orchestrators enable secure retrieval of secrets from a connected PAM provider.
681709

682-
> The above installation steps can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions).
710+
To configure a PAM provider, [reference the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) to select an extension, and follow the associated instructions to install it on the Universal Orchestrator (remote).
711+
712+
713+
> The above installation steps can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions).
683714
684715

685716

686717
## Defining Certificate Stores
687718

688719

689720

721+
### Store Creation
722+
690723
* **Manually with the Command UI**
691724

692725
<details><summary>Create Certificate Stores manually in the UI</summary>
@@ -698,6 +731,7 @@ To use the Azure Key Vault Universal Orchestrator extension, you **must** create
698731
2. **Add a Certificate Store.**
699732

700733
Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form.
734+
701735
| Attribute | Description |
702736
| --------- | ----------- |
703737
| Category | Select "Azure Keyvault" or the customized certificate store name from the previous step. |
@@ -710,12 +744,9 @@ To use the Azure Key Vault Universal Orchestrator extension, you **must** create
710744
| VaultRegion | The Azure Region to put newly created KeyVaults (only needed if needing to create new KeyVaults in your Azure subscription via Command) |
711745
| AzureCloud | The Azure Cloud where the KeyVaults are located (only necessary if not using the standard Azure Public cloud) |
712746
| PrivateEndpoint | The private endpoint of your vault instance (if a private endpoint is configured in Azure) |
713-
714-
715-
716-
717747
</details>
718748

749+
719750
* **Using kfutil**
720751

721752
<details><summary>Create Certificate Stores with kfutil</summary>
@@ -728,6 +759,7 @@ To use the Azure Key Vault Universal Orchestrator extension, you **must** create
728759
2. **Populate the generated CSV file**
729760

730761
Open the CSV file, and reference the table below to populate parameters for each **Attribute**.
762+
731763
| Attribute | Description |
732764
| --------- | ----------- |
733765
| Category | Select "Azure Keyvault" or the customized certificate store name from the previous step. |
@@ -740,18 +772,29 @@ To use the Azure Key Vault Universal Orchestrator extension, you **must** create
740772
| VaultRegion | The Azure Region to put newly created KeyVaults (only needed if needing to create new KeyVaults in your Azure subscription via Command) |
741773
| AzureCloud | The Azure Cloud where the KeyVaults are located (only necessary if not using the standard Azure Public cloud) |
742774
| PrivateEndpoint | The private endpoint of your vault instance (if a private endpoint is configured in Azure) |
743-
744-
745-
746-
747-
3. **Import the CSV file to create the certificate stores**
775+
3. **Import the CSV file to create the certificate stores**
748776

749777
```shell
750778
kfutil stores import csv --store-type-name AKV --file AKV.csv
751779
```
780+
781+
* **PAM Provider Eligible Fields**
782+
<details><summary>Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator</summary>
783+
784+
If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_.
785+
786+
| Attribute | Description |
787+
| --------- | ----------- |
788+
| ServerUsername | Username to use when connecting to server |
789+
| ServerPassword | Password to use when connecting to server |
790+
791+
Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side.
792+
793+
> Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself.
752794
</details>
753795

754-
> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
796+
797+
> The content in this section can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
755798

756799

757800
## Discovering Certificate Stores with the Discovery Job

0 commit comments

Comments
 (0)