You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This integration is used to inventory and manage certificates in GCP.
1
+
# GCP Load Balancer
2
+
## Orchestrator
5
3
6
4
<!-- add integration specific information below -->
7
-
***
5
+
6
+
***
8
7
9
8
# Introduction
10
-
-TODO:
9
+
-The GCP Load Balancer Orchestrator allows for the management of Google Cloud Platform Load Balancer certificate stores. Inventory, Management-Add, and Management-Remove functions are supported. Also, re-binding to endpoints IS supported for certificate renewals (but NOT adding new certificates). The orchestrator uses the Google Cloud Compute Engine API to manage stores.
11
10
12
11
# Setting up GCP Cert Store Type
12
+
The certificate store type set up for the GCP Load Balancer Orchestrator should have the following options set:
13
+
14
+
**Name:** A descriptive name for the certificate store type
15
+
16
+
**Short Name:** Must be **GCP**
17
+
18
+
**Needs Server:** Unchecked
19
+
20
+
**Blueprint Allowed:** Unchecked
21
+
22
+
**Requires Store Password:** Unchecked
23
+
24
+
**Supports Entry Password:** Unchecked
25
+
26
+
**Supports Custom Alias:** Optional (If unselected, a random alias will be generated by the GCP LB Orchestrator)
27
+
28
+
**Uses PowerShell: ** Unchecked
29
+
30
+
**Store Path Type:** FreeForm
31
+
32
+
**Private Keys: ** Required (Adding a certificate to a GCP Load Balancer certificate store without the private key is not a valid use case)
33
+
34
+
**PFX Password Style:** Default
35
+
36
+
**Job Types:** Check Inventory, Add, and Remove. Leave Create, Discovery, and Reenrollment unchecked
37
+
38
+
**Parameters:** Add 1 custom parameter if authenticating to the GCP API library by passing the GCP service account key from Keyfactor Command (see Authentication):
39
+
40
+
- Name: Must be **jsonKey**
41
+
- Display Name: Desired custom display name
42
+
- Type: Secret
43
+
- Change Default Value: Unchecked
44
+
- Default Value: Leave blank
45
+
46
+
47
+
48
+
# Setting up GCP Cert Store
49
+
When creating a GCP certificate store in Keyfactor, the various options should be set up a follows:
50
+
51
+
**Category:** Must be GCP
52
+
53
+
**Container:** Optional container name if using this feature. Please consult the Keyfactor Command Reference Guide for more information on this feature.
54
+
55
+
**Client Machine:** The name or IP address of the Orchestrator server that will be handling GCP jobs.
56
+
57
+
**Store Path:** This should be your Google Cloud project ID. This will work against GCP Global resources. Optionally, you can append "/" with the region you wish to process against. Please refer to the following page for a list of valid region codes (GCP code column): https://gist.github.com/rpkim/084046e02fd8c452ba6ddef3a61d5d59.
58
+
59
+
**Service Account Key:** If you will be authenticating via passing credentials from Keyfactor Command, you must add this value as follows:
60
+
- No Service Account Key: Unchecked
61
+
- Secret Source: "Keyfactor Secrets" if you wish to store the GCP service account key in the Keyfactor secrets engine or "Load From PAM Provider" if you have set up a PAM provider integration within Keyfactor Command and wish to store this value there.
62
+
- Enter and Confirm Service Account Key: The JSON-based service account key you acquired from GCP (See Authentication).
63
+
64
+
**Inventory Schedule:** Set whether to schedule Inventory jobs for this certificate store, and if so, the frequency here.
65
+
13
66
14
67
# Authentication
15
68
A service account is necessary for authentication to GCP. The following are the required permissions:
@@ -26,12 +79,16 @@ Remember to assign the appropriate role/permissions for the service account.
26
79
Afterwards inside Keyfactor Command copy and paste the contents of the service account key in the password field for the GCP Certificate Store Type.
27
80
28
81
# Supported Functionality
29
-
- Inventory, Management
82
+
- Inventory
83
+
- Management-Add (including re-binding of existing bindings for certificate renewals, no binding functionality available for new certificate adds)
Copy file name to clipboardExpand all lines: README.md.tpl
+64-7Lines changed: 64 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -1,15 +1,68 @@
1
1
# {{ name }}
2
2
## {{ integration_type | capitalize }}
3
3
4
-
{{ description }}
5
-
6
4
<!-- add integration specific information below -->
7
-
***
5
+
6
+
***
8
7
9
8
# Introduction
10
-
- TODO:
9
+
- {{ description }}
11
10
12
11
# Setting up GCP Cert Store Type
12
+
The certificate store type set up for the GCP Load Balancer Orchestrator should have the following options set:
13
+
14
+
**Name:** A descriptive name for the certificate store type
15
+
16
+
**Short Name:** Must be **GCP**
17
+
18
+
**Needs Server:** Unchecked
19
+
20
+
**Blueprint Allowed:** Unchecked
21
+
22
+
**Requires Store Password:** Unchecked
23
+
24
+
**Supports Entry Password:** Unchecked
25
+
26
+
**Supports Custom Alias:** Optional (If unselected, a random alias will be generated by the GCP LB Orchestrator)
27
+
28
+
**Uses PowerShell: ** Unchecked
29
+
30
+
**Store Path Type:** FreeForm
31
+
32
+
**Private Keys: ** Required (Adding a certificate to a GCP Load Balancer certificate store without the private key is not a valid use case)
33
+
34
+
**PFX Password Style:** Default
35
+
36
+
**Job Types:** Check Inventory, Add, and Remove. Leave Create, Discovery, and Reenrollment unchecked
37
+
38
+
**Parameters:** Add 1 custom parameter if authenticating to the GCP API library by passing the GCP service account key from Keyfactor Command (see Authentication):
39
+
40
+
- Name: Must be **jsonKey**
41
+
- Display Name: Desired custom display name
42
+
- Type: Secret
43
+
- Change Default Value: Unchecked
44
+
- Default Value: Leave blank
45
+
46
+
47
+
48
+
# Setting up GCP Cert Store
49
+
When creating a GCP certificate store in Keyfactor, the various options should be set up a follows:
50
+
51
+
**Category:** Must be GCP
52
+
53
+
**Container:** Optional container name if using this feature. Please consult the Keyfactor Command Reference Guide for more information on this feature.
54
+
55
+
**Client Machine:** The name or IP address of the Orchestrator server that will be handling GCP jobs.
56
+
57
+
**Store Path:** This should be your Google Cloud project ID. This will work against GCP Global resources. Optionally, you can append "/" with the region you wish to process against. Please refer to the following page for a list of valid region codes (GCP code column): https://gist.github.com/rpkim/084046e02fd8c452ba6ddef3a61d5d59.
58
+
59
+
**Service Account Key:** If you will be authenticating via passing credentials from Keyfactor Command, you must add this value as follows:
60
+
- No Service Account Key: Unchecked
61
+
- Secret Source: "Keyfactor Secrets" if you wish to store the GCP service account key in the Keyfactor secrets engine or "Load From PAM Provider" if you have set up a PAM provider integration within Keyfactor Command and wish to store this value there.
62
+
- Enter and Confirm Service Account Key: The JSON-based service account key you acquired from GCP (See Authentication).
63
+
64
+
**Inventory Schedule:** Set whether to schedule Inventory jobs for this certificate store, and if so, the frequency here.
65
+
13
66
14
67
# Authentication
15
68
A service account is necessary for authentication to GCP. The following are the required permissions:
@@ -26,12 +79,16 @@ Remember to assign the appropriate role/permissions for the service account.
26
79
Afterwards inside Keyfactor Command copy and paste the contents of the service account key in the password field for the GCP Certificate Store Type.
27
80
28
81
# Supported Functionality
29
-
- Inventory, Management
82
+
- Inventory
83
+
- Management-Add (including re-binding of existing bindings for certificate renewals, no binding functionality available for new certificate adds)
"description": "This integration is used to inventory and manage certificates in GCP. "
3
+
"integration_type": "orchestrator",
4
+
"name": "GCP Load Balancer",
5
+
"status": "production",
6
+
"link_github": true,
7
+
"description": "The GCP Load Balancer Orchestrator allows for the management of Google Cloud Platform Load Balancer certificate stores. Inventory, Management-Add, and Management-Remove functions are supported. Also, re-binding to endpoints IS supported for certificate renewals (but NOT adding new certificates). The orchestrator uses the Google Cloud Compute Engine API to manage stores."
0 commit comments