Skip to content

Commit 2b23cef

Browse files
m8rmclarenm8rmclaren
authored
Merge pull request #15 from Keyfactor/docs
chore: Clarify hostname requirements, refactor examples to include extended capabilities
2 parents e9cb114 + 3c13468 commit 2b23cef

File tree

6 files changed

+87
-51
lines changed

6 files changed

+87
-51
lines changed

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# The version which will be reported by the --version argument of each binary
22
# and which will be used as the Docker image tag
3-
VERSION ?= v1.0.4
3+
VERSION ?= latest
44
# The Docker repository name, overridden in CI.
55
DOCKER_REGISTRY ?= ghcr.io
66
DOCKER_IMAGE_NAME ?= keyfactor/command-cert-manager-issuer

‎README.md‎

Lines changed: 41 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -45,42 +45,56 @@ kubectl get nodes
4545

4646
### Installation from Manifests
4747

48-
Once Kubernetes is running, a static installation of cert-manager can be installed with the following command:
49-
```shell
50-
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
51-
```
48+
1. Once Kubernetes is running, a static installation of cert-manager can be installed with the following command:
49+
```shell
50+
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
51+
```
5252

53-
###### :pushpin: Running the static cert-manager configuration is not recommended for production use. For more information, see [Installing cert-manager](https://cert-manager.io/docs/installation/).
53+
###### :pushpin: Running the static cert-manager configuration is not recommended for production use. For more information, see [Installing cert-manager](https://cert-manager.io/docs/installation/).
5454

55-
Then, install the custom resource definitions (CRDs) for the cert-manager external issuer for Keyfactor Command:
56-
```shell
57-
make install
58-
```
55+
2. Then, install the custom resource definitions (CRDs) for the cert-manager external issuer for Keyfactor Command:
56+
```shell
57+
make install
58+
```
5959

60-
Finally, deploy the controller to the cluster:
61-
```shell
62-
make deploy
63-
```
60+
3. Finally, deploy the controller to the cluster:
61+
```shell
62+
make deploy
63+
```
6464

6565
### Installation from Helm Chart
6666

6767
The cert-manager external issuer for Keyfactor Command can also be installed using a Helm chart. The chart is available in the [Command cert-manager Helm repository](https://keyfactor.github.io/command-cert-manager-issuer/).
6868

69-
First, add the Helm repository:
70-
```bash
71-
helm repo add command-issuer https://keyfactor.github.io/command-cert-manager-issuer
72-
helm repo update
73-
```
69+
1. Add the Helm repository:
70+
```bash
71+
helm repo add command-issuer https://keyfactor.github.io/command-cert-manager-issuer
72+
helm repo update
73+
```
7474

75-
Then, install the chart:
76-
```bash
77-
helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer
78-
```
75+
2. Then, install the chart:
76+
```bash
77+
helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer
78+
```
7979

80-
Modifications can be made by overriding the default values in the `values.yaml` file with the `--set` flag. For example, to override the `replicaCount` value, run the following command:
81-
```bash
82-
helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer --set replicaCount=2
83-
```
80+
a. Modifications can be made by overriding the default values in the `values.yaml` file with the `--set` flag. For example, to override the `replicaCount` value, run the following command:
81+
82+
helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \
83+
--set replicaCount=2
84+
85+
b. Modifications can also be made by modifying the `values.yaml` file directly. For example, to override the
86+
`replicaCount` value, modify the `replicaCount` value in the `values.yaml` file:
87+
88+
cat <<EOF > override.yaml
89+
replicaCount: 2
90+
EOF
91+
92+
Then, use the `-f` flag to specify the `values.yaml` file:
93+
94+
```yaml
95+
helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \
96+
-f override.yaml
97+
```
8498
8599
## Usage
86100
The cert-manager external issuer for Keyfactor Command can be used to issue certificates from Keyfactor Command using cert-manager.
@@ -115,7 +129,7 @@ The Issuer resource is namespaced, while the ClusterIssuer resource is cluster-s
115129
For example, ClusterIssuer resources can be used to issue certificates for resources in multiple namespaces, whereas Issuer resources can only be used to issue certificates for resources in the same namespace.
116130
117131
The `spec` field of both the Issuer and ClusterIssuer resources use the following fields:
118-
* `hostname` - The hostname of the Keyfactor Command server
132+
* `hostname` - The hostname of the Keyfactor Command server - The signer sets the protocol to `https` and automatically trims the trailing path from this field, if it exists. Additionally, the base Command API path is automatically set to `/KeyfactorAPI` and cannot be changed.
119133
* `commandSecretName` - The name of the Kubernetes `kubernetes.io/basic-auth` secret containing credentials to the Keyfactor instance
120134
* `certificateTemplate` - The short name corresponding to a template in Command that will be used to issue certificates.
121135
* `certificateAuthorityLogicalName` - The logical name of the CA to use to sign the certificate request

‎config/samples/certificate.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ apiVersion: cert-manager.io/v1
22
kind: Certificate
33
metadata:
44
name: command-certificate
5+
annotations:
6+
command-issuer.keyfactor.com/certificateTemplate: "Ephemeral2day"
7+
command-issuer.keyfactor.com/certificateAuthorityLogicalName: "InternalIssuingCA1"
8+
metadata.command-issuer.keyfactor.com/ResponsibleTeam: "[email protected]"
59
spec:
610
commonName: command-issuer-sample
711
secretName: command-certificate

‎config/samples/command-issuer_v1alpha1_clusterissuer.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,4 @@ spec:
1313
certificateTemplate: ""
1414
certificateAuthorityLogicalName: ""
1515
certificateAuthorityHostname: ""
16+
caSecretName: ""

‎config/samples/command-issuer_v1alpha1_issuer.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,12 @@ metadata:
55
app.kubernetes.io/name: issuer
66
app.kubernetes.io/instance: issuer-sample
77
app.kubernetes.io/part-of: command-issuer
8-
app.kubernetes.io/managed-by: kustomize
98
app.kubernetes.io/created-by: command-issuer
109
name: issuer-sample
1110
spec:
12-
# TODO(user): Add fields here
11+
hostname: ""
12+
commandSecretName: ""
13+
certificateTemplate: ""
14+
certificateAuthorityLogicalName: ""
15+
certificateAuthorityHostname: ""
16+
caSecretName: ""

‎deploy/charts/command-cert-manager-issuer/README.md‎

Lines changed: 34 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -31,30 +31,43 @@ helm install command-cert-manager-issuer command-issuer/command-cert-manager-iss
3131

3232
Modifications can be made by overriding the default values in the `values.yaml` file with the `--set` flag. For example, to override the `replicaCount` value, run the following command:
3333
```bash
34-
helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer --set replicaCount=2
34+
helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \
35+
--set replicaCount=2
36+
```
37+
38+
Modifications can also be made by modifying the `values.yaml` file directly. For example, to override the `replicaCount` value, modify the `replicaCount` value in the `values.yaml` file:
39+
```yaml
40+
cat <<EOF > override.yaml
41+
replicaCount: 2
42+
EOF
43+
```
44+
Then, use the `-f` flag to specify the `values.yaml` file:
45+
```bash
46+
helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \
47+
-f override.yaml
3548
```
3649

3750
## Configuration
3851

3952
The following table lists the configurable parameters of the `command-cert-manager-issuer` chart and their default values.
4053

41-
| Parameter | Description | Default |
42-
|-----------------------------------|-------------------------------------------------------|----------------------------------------------------------------|
43-
| `replicaCount` | Number of replica command-cert-manager-issuers to run | `1` |
44-
| `image.repository` | Image repository | `m8rmclarenkf/command-cert-manager-external-issuer-controller` |
45-
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
46-
| `image.tag` | Image tag | `1.0.3` |
47-
| `imagePullSecrets` | Image pull secrets | `[]` |
48-
| `nameOverride` | Name override | `""` |
49-
| `fullnameOverride` | Full name override | `""` |
50-
| `crd.create` | Specifies if CRDs will be created | `true` |
51-
| `crd.annotations` | Annotations to add to the CRD | `{}` |
52-
| `serviceAccount.create` | Specifies if a service account should be created | `true` |
53-
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
54-
| `serviceAccount.name` | Name of the service account to use | `""` (uses the fullname template if `create` is true) |
55-
| `podAnnotations` | Annotations for the pod | `{}` |
56-
| `podSecurityContext.runAsNonRoot` | Run pod as non-root | `true` |
57-
| `securityContext` | Security context for the pod | `{}` (with commented out options) |
58-
| `resources` | CPU/Memory resource requests/limits | `{}` (with commented out options) |
59-
| `nodeSelector` | Node labels for pod assignment | `{}` |
60-
| `tolerations` | Tolerations for pod assignment | `[]` |
54+
| Parameter | Description | Default |
55+
|-----------------------------------|-------------------------------------------------------|-------------------------------------------------------|
56+
| `replicaCount` | Number of replica command-cert-manager-issuers to run | `1` |
57+
| `image.repository` | Image repository | `ghcr.io/keyfactor/command-cert-manager-issuer` |
58+
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
59+
| `image.tag` | Image tag | `""` |
60+
| `imagePullSecrets` | Image pull secrets | `[]` |
61+
| `nameOverride` | Name override | `""` |
62+
| `fullnameOverride` | Full name override | `""` |
63+
| `crd.create` | Specifies if CRDs will be created | `true` |
64+
| `crd.annotations` | Annotations to add to the CRD | `{}` |
65+
| `serviceAccount.create` | Specifies if a service account should be created | `true` |
66+
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
67+
| `serviceAccount.name` | Name of the service account to use | `""` (uses the fullname template if `create` is true) |
68+
| `podAnnotations` | Annotations for the pod | `{}` |
69+
| `podSecurityContext.runAsNonRoot` | Run pod as non-root | `true` |
70+
| `securityContext` | Security context for the pod | `{}` (with commented out options) |
71+
| `resources` | CPU/Memory resource requests/limits | `{}` (with commented out options) |
72+
| `nodeSelector` | Node labels for pod assignment | `{}` |
73+
| `tolerations` | Tolerations for pod assignment | `[]` |

0 commit comments

Comments
 (0)