You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Command must be properly configured according to the [product docs](https://software.keyfactor.com/Core-OnPrem/Current/Content/MasterTopics/Portal.htm).
@@ -55,7 +55,7 @@ Before starting, ensure that the following requirements are met:
55
55
56
56
## Configuring Command
57
57
58
-
Command Issuer enrolls certificates by submitting a POST request to the CSR Enrollment endpoint. Before using Command Issuer, you must create or identify a Certificate Authority _and_ Certificate Template suitable for your usecase. Additionally, you should ensure that the identity used by the Issuer/ClusterIssuer has the appropriate permissions in Command.
58
+
Command Issuer enrolls certificates by submitting a POST request to the Command CSR Enrollment endpoint. Before using Command Issuer, you must create or identify a Certificate Authority _and_ Certificate Template suitable for your usecase. Additionally, you should ensure that the identity used by the Issuer/ClusterIssuer has the appropriate permissions in Command.
59
59
60
60
1.**Create or identify a Certificate Authority**
61
61
@@ -75,11 +75,11 @@ Command Issuer enrolls certificates by submitting a POST request to the CSR Enro
75
75
76
76
You should make careful note of the allowed Key Types and Key Sizes on the Certificate Template. When creating cert-manager [Certificates](https://cert-manager.io/docs/usage/certificate/), you must make sure that the key `algorithm` and `size` are allowed by your Certificate Template in Command.
77
77
78
-
The same goes for **Subject DN Attributes** and **Other Subject Attributes**allowed by your Certificate Template. When creating cert-manager [Certificates](https://cert-manager.io/docs/usage/certificate/), you must make sure that the `subject`, `commonName`, `dnsNames`, etc. are allowed and/or configured correctly by your Certificate Template in Command.
78
+
The same goes for **Enrollment RegExes** and **Policies**defined on your Certificate Template. When creating cert-manager [Certificates](https://cert-manager.io/docs/usage/certificate/), you must make sure that the `subject`, `commonName`, `dnsNames`, etc. are allowed and/or configured correctly by your Certificate Template in Command.
79
79
80
80
3.**Configure Command Security Roles and Claims**
81
81
82
-
In Command, Security Roles define groups of users or administrators with specific permissions. Users and subjects are identified by Claims. By adding a Claim to a Security Role, you can dictate what actions the user or subject can perform and what parts of the system it can interact with.
82
+
In Command, Security Roles define groups of users or administrators with specific permissions. Users and subjects are identified by Claims. By adding a Claim to a Security Role, you can define what actions the user or subject can perform and what parts of the system it can interact with.
83
83
84
84
- If you haven't created Roles and Access rules before, [this guide](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) provides a primer on these concepts in Command.
85
85
@@ -94,7 +94,7 @@ Command Issuer enrolls certificates by submitting a POST request to the CSR Enro
94
94
95
95
Command Issuer is installed using a Helm chart. The chart is available in the [Command cert-manager Helm repository](https://keyfactor.github.io/command-cert-manager-issuer/).
96
96
97
-
1. Verify that at least one Kubernetes node is running
97
+
1. Verify that at least one Kubernetes node is running:
98
98
99
99
```shell
100
100
kubectl get nodes
@@ -128,9 +128,9 @@ These credentials must be configured using a Kubernetes Secret. By default, the
128
128
129
129
> Command Issuer can read secrets in the Issuer namespace if`--set "secretConfig.useClusterRoleForSecretAccess=true"` flag is set when installing the Helm chart.
130
130
131
-
Command Issuer also supports ambient authentication, where a token is fetched from an Authorization Server using a cloud provider's auth infrastructure and passed to Command directly.
131
+
Command Issuer also supports ambient authentication, where a token is fetched from an Authorization Server using a cloud provider's auth infrastructure and passed to Command directly. The following methods are supported:
132
132
133
-
- Azure Workload Identity (if running in [AKS](https://azure.microsoft.com/en-us/products/kubernetes-service))
133
+
- Managed Identity Using Azure Entra ID Workload Identity (if running in [AKS](https://azure.microsoft.com/en-us/products/kubernetes-service))
0 commit comments