+
+
+
+
+
+
+ + + Support + + · + + Installation + + · + + License + + · + + Related Integrations + +
-The Kubernetes Orchestrator allows for the remote management of certificate stores defined in a Kubernetes cluster. The following types of Kubernetes resources are supported: kubernetes secrets of `kubernetes.io/tls` or `Opaque` and kubernetes certificates `certificates.k8s.io/v1` +## Overview -#### Integration status: Production - Ready for use in production environments. +The Kubernetes Orchestrator allows for the remote management of certificate stores defined in a Kubernetes cluster. +The following types of Kubernetes resources are supported: kubernetes secrets of `kubernetes.io/tls` or `Opaque` and +kubernetes certificates `certificates.k8s.io/v1` + +The certificate store types that can be managed in the current version are: +- `K8SCert` - Kubernetes certificates of type `certificates.k8s.io/v1` +- `K8SSecret` - Kubernetes secrets of type `Opaque` +- `K8STLSSecret` - Kubernetes secrets of type `kubernetes.io/tls` +- `K8SCluster` - This allows for a single store to manage a k8s cluster's secrets or type `Opaque` and `kubernetes.io/tls`. + This can be thought of as a container of `K8SSecret` and `K8STLSSecret` stores across all k8s namespaces. +- `K8SNS` - This allows for a single store to manage a k8s namespace's secrets or type `Opaque` and `kubernetes.io/tls`. + This can be thought of as a container of `K8SSecret` and `K8STLSSecret` stores for a single k8s namespace. +- `K8SJKS` - Kubernetes secrets of type `Opaque` that contain one or more Java Keystore(s). These cannot be managed at the + cluster or namespace level as they should all require unique credentials. +- `K8SPKCS12` - Kubernetes secrets of type `Opaque` that contain one or more PKCS12(s). These cannot be managed at the + cluster or namespace level as they should all require unique credentials. + +This orchestrator extension makes use of the Kubernetes API by using a service account +to communicate remotely with certificate stores. The service account must have the correct permissions +in order to perform the desired operations. For more information on the required permissions, see the +[service account setup guide](#service-account-setup). -## About the Keyfactor Universal Orchestrator Extension +The Kubernetes Universal Orchestrator extension implements 7 Certificate Store Types. Depending on your use case, you may elect to use one, or all of these Certificate Store Types. Descriptions of each are provided below. -This repository contains a Universal Orchestrator Extension which is a plugin to the Keyfactor Universal Orchestrator. Within the Keyfactor Platform, Orchestrators are used to manage “certificate stores” — collections of certificates and roots of trust that are found within and used by various applications. +- [K8SCert](#K8SCert) -The Universal Orchestrator is part of the Keyfactor software distribution and is available via the Keyfactor customer portal. For general instructions on installing Extensions, see the “Keyfactor Command Orchestrator Installation and Configuration Guide” section of the Keyfactor documentation. For configuration details of this specific Extension see below in this readme. +- [K8SCluster](#K8SCluster) -The Universal Orchestrator is the successor to the Windows Orchestrator. This Orchestrator Extension plugin only works with the Universal Orchestrator and does not work with the Windows Orchestrator. +- [K8SJKS](#K8SJKS) -## Support for Kubernetes Orchestrator Extension +- [K8SNS](#K8SNS) -Kubernetes Orchestrator Extension is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com +- [K8SPKCS12](#K8SPKCS12) -###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab. +- [K8SSecret](#K8SSecret) ---- +- [K8STLSSecr](#K8STLSSecr) ---- +## Compatibility +This integration is compatible with Keyfactor Universal Orchestrator version 12.4 and later. +## Support +The Kubernetes Universal Orchestrator extension is community open source and there is **no SLA**. Keyfactor will address issues as resources become available. -## Keyfactor Version Supported +> To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute bug fixes or additional enhancements, use the **[Pull requests](../../pulls)** tab. -The minimum version of the Keyfactor Universal Orchestrator Framework needed to run this version of the extension is 10.x -## Platform Specific Notes +## Requirements & Prerequisites -The Keyfactor Universal Orchestrator may be installed on either Windows or Linux based platforms. The certificate operations supported by a capability may vary based what platform the capability is installed on. The table below indicates what capabilities are supported based on which platform the encompassing Universal Orchestrator is running. -| Operation | Win | Linux | -|-----|-----|------| -|Supports Management Add|✓ |✓ | -|Supports Management Remove|✓ |✓ | -|Supports Create Store|✓ |✓ | -|Supports Discovery|✓ |✓ | -|Supports Reenrollment| | | -|Supports Inventory|✓ |✓ | +Before installing the Kubernetes Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. -## PAM Integration +### Kubernetes API Access +This orchestrator extension makes use of the Kubernetes API by using a service account +to communicate remotely with certificate stores. The service account must exist and have the appropriate permissions. +The service account token can be provided to the extension in one of two ways: +- As a raw JSON file that contains the service account credentials +- As a base64 encoded string that contains the service account credentials -This orchestrator extension has the ability to connect to a variety of supported PAM providers to allow for the retrieval of various client hosted secrets right from the orchestrator server itself. This eliminates the need to set up the PAM integration on Keyfactor Command which may be in an environment that the client does not want to have access to their PAM provider. +#### Service Account Setup +To set up a service account user on your Kubernetes cluster to be used by the Kubernetes Orchestrator Extension. For full +information on the required permissions, see the [service account setup guide](./scripts/kubernetes/README.md). -The secrets that this orchestrator extension supports for use with a PAM Provider are: -| Name | Description | -|----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| ServerUsername | Must be set to `kubeconfig` if used. If you do not set it to `kubeconfig` the `ServerPassword` will be ignored. | -| ServerPassword | Must be set if `ServerUsername` is provided. The service account credentials for the Universal Orchestrator to use. Must be in `kubeconfig` format. For more information review [Kubernetes service account](https://github.com/Keyfactor/kubernetes-orchestrator/blob/main/scripts/kubernetes/README.md) docs and scripts. | - +## Certificate Store Types -It is not necessary to use a PAM Provider for all of the secrets available above. If a PAM Provider should not be used, simply enter in the actual value to be used, as normal. +To use the Kubernetes Universal Orchestrator extension, you **must** create the Certificate Store Types required for your use-case. This only needs to happen _once_ per Keyfactor Command instance. -If a PAM Provider will be used for one of the fields above, start by referencing the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam). The GitHub repo for the PAM Provider to be used contains important information such as the format of the `json` needed. What follows is an example but does not reflect the `json` values for all PAM Providers as they have different "instance" and "initialization" parameter names and values. +The Kubernetes Universal Orchestrator extension implements 7 Certificate Store Types. Depending on your use case, you may elect to use one, or all of these Certificate Store Types. -
+### K8SCert
+Click to expand details
-### Example PAM Provider Setup
+The `K8SCert` store type is used to manage Kubernetes certificates of type `certificates.k8s.io/v1`.
-To use a PAM Provider to resolve a field, in this example the __Server Password__ will be resolved by the `Hashicorp-Vault` provider, first install the PAM Provider extension from the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) on the Universal Orchestrator.
+**NOTE**: only `inventory` and `discovery` of these resources is supported with this extension. To provision these certs use the
+[k8s-csr-signer](https://github.com/Keyfactor/k8s-csr-signer).
-Next, complete configuration of the PAM Provider on the UO by editing the `manifest.json` of the __PAM Provider__ (e.g. located at extensions/Hashicorp-Vault/manifest.json). The "initialization" parameters need to be entered here:
-~~~ json
- "Keyfactor:PAMProviders:Hashicorp-Vault:InitializationInfo": {
- "Host": "http://127.0.0.1:8200",
- "Path": "v1/secret/data",
- "Token": "xxxxxx"
- }
-~~~
-After these values are entered, the Orchestrator needs to be restarted to pick up the configuration. Now the PAM Provider can be used on other Orchestrator Extensions.
-### Use the PAM Provider
-With the PAM Provider configured as an extenion on the UO, a `json` object can be passed instead of an actual value to resolve the field with a PAM Provider. Consult the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) for the specific format of the `json` object.
+#### Supported Operations
-To have the __Server Password__ field resolved by the `Hashicorp-Vault` provider, the corresponding `json` object from the `Hashicorp-Vault` extension needs to be copied and filed in with the correct information:
+| Operation | Is Supported |
+|--------------|------------------------------------------------------------------------------------------------------------------------|
+| Add | 🔲 Unchecked |
+| Remove | 🔲 Unchecked |
+| Discovery | ✅ Checked |
+| Reenrollment | 🔲 Unchecked |
+| Create | 🔲 Unchecked |
-~~~ json
-{"Secret":"my-kv-secret","Key":"myServerPassword"}
-~~~
+#### Store Type Creation
-This text would be entered in as the value for the __Server Password__, instead of entering in the actual password. The Orchestrator will attempt to use the PAM Provider to retrieve the __Server Password__. If PAM should not be used, just directly enter in the value for the field.
-
+ + + +### Example PAM Provider Setup + +To use a PAM Provider to resolve a field, in this example the __Server Password__ will be resolved by the `Hashicorp-Vault` provider, first install the PAM Provider extension from the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) on the Universal Orchestrator. + +Next, complete configuration of the PAM Provider on the UO by editing the `manifest.json` of the __PAM Provider__ (e.g. located at extensions/Hashicorp-Vault/manifest.json). The "initialization" parameters need to be entered here: + +~~~ json + "Keyfactor:PAMProviders:Hashicorp-Vault:InitializationInfo": { + "Host": "http://127.0.0.1:8200", + "Path": "v1/secret/data", + "Token": "xxxxxx" + } +~~~ + +After these values are entered, the Orchestrator needs to be restarted to pick up the configuration. Now the PAM Provider can be used on other Orchestrator Extensions. + +### Use the PAM Provider +With the PAM Provider configured as an extenion on the UO, a `json` object can be passed instead of an actual value to resolve the field with a PAM Provider. Consult the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) for the specific format of the `json` object. + +To have the __Server Password__ field resolved by the `Hashicorp-Vault` provider, the corresponding `json` object from the `Hashicorp-Vault` extension needs to be copied and filed in with the correct information: + +~~~ json +{"Secret":"my-kv-secret","Key":"myServerPassword"} +~~~ + +This text would be entered in as the value for the __Server Password__, instead of entering in the actual password. The Orchestrator will attempt to use the PAM Provider to retrieve the __Server Password__. If PAM should not be used, just directly enter in the value for the field. +
+