Skip to content

Commit f0fffbb

Browse files
wgabor0427wgabor0427
committed
OSDOCS-15490 updated cert module
1 parent ff0490a commit f0fffbb

File tree

4 files changed

+135
-0
lines changed

4 files changed

+135
-0
lines changed

‎modules/zero-trust-manager-cert-manager-crd.adoc‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zero-trust-manager-upstream-authority plugins.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-cert-manager-crd_{context}"]
7+
= Configuring cert-manager plugin using the SPIRE server CRD
8+
9+
To configure the cert-manager plugin using the SPIRE server Custom Resource Defnition (CRD), performe the following steps:
10+
11+
.Procedure
12+
13+
. Create a YAML file containing the configuration for the `SpireServer` resource, for example `spireserver.yaml`:
14+
+
15+
.Example `spireserver.yaml`
16+
+
17+
[source,yaml]
18+
----
19+
apiVersion: operator.openshift.io/v1alpha1
20+
kind: SpireServer
21+
metadata:
22+
name: cluster
23+
spec:
24+
trustDomain: "example.org"
25+
upstreamAuthority:
26+
type: "cert-manager"
27+
upstreamAuthorityCertManager:
28+
issuerName: "ca-issuer" <1>
29+
issuerKind: "ClusterIssuer" <2>
30+
issuerGroup: "cert-manager.io" <3>
31+
namespace: "zero-trust-workload-identity-manager" <4>
32+
kubeConfigSecretName: "external-cluster-kubeconfig" <5>
33+
----
34+
<1> The name of the `cert-manager` Issuer or ClusterIssuer that signs the `certificateRequest`.
35+
<2> Set to `ClusterIssuer` if issuer is cluster-scoped. The default is `Issuer`.
36+
<3> The API group of the issuer. The default is `cert-manager.io`.
37+
<4> The namespace where the `CertificateRequest` is created. The default is `zero-trust-workload-identity-manager`.
38+
<5> The name of a Secret containing the `kubeconfig` to connect to the clsuter where `cert-manager` is running. If empy, an in-cluster configuration is used.
39+
40+
. Apply the configuration by running the following command:
41+
+
42+
[source, terminal]
43+
----
44+
$ oc apply -f spireserver.yaml
45+
----
46+
47+
.Verification
48+
49+
. Run the following command to list the `CertificateRequest` resources in the namespace where the SPIRE server creates them.
50+
+
51+
[source, terminal]
52+
----
53+
$ oc get certificaterequests -n <namespace>
54+
----
55+
56+
. Run the following command ot inspect a specific `CertificateRequest`. Review the `Status` section to confirm the certificate has been signed and that the certificate data is present.
57+
+
58+
[source, terminal]
59+
----
60+
$ oc describe certificaterequest <name-of-cert-request> -n <namespace>
61+
----

‎modules/zero-trust-manager-cert-manager-upstream-authority.adoc‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-overview.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="zero-trust-manager-cert-manager-upstream-authority_{context}"]
7+
= About the cert-manager upstream authority plugin
8+
9+
The cert-manager plugin for the SPIRE server is designed to automate the management of the SPIRE server's intermediate signing certificates by integrating with cert-manager in a Kubernetes environment. The cert-manager plugin enables the SPIRE server to dynamically request and receive intermediate signing certificates from cert-manager.
10+
11+
When a SPIRE server needs a new certificate, the cert-manager plugin creates a `CertificateRequest` custom resource in the configured Kubernetes namespace which contains the Certificate Signing Request (CSR) generated by the SPIRE server. The cert-manager plugin processes the `CertificateRequest` and an associated `Issuer` signs the CSR. The signed intermediate certificate and the full Certificate Authority (CA) bundle are made available in the `CertificateRequest` status. These signed credentials are made available to the SPIRE server to be used as its upstream signing authority.

‎modules/zero-trust-manager-configure-cert-manager.adoc‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zero-trust-manager-upstream-authority plugins.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="zero-trust-manager-configure-cert-manager_{context}"]
7+
= Configuring the cert-manager plugin
8+
9+
The cert-manager plugin for the SPIRE server is designed to automate the management of the SPIRE server intermediate signing certificates by integrating with cert-manager. The cert-manager plugin enables the SPIRE server to dynamically request and receive intermediate signing certificates from cert-manager.
10+
11+
.Prerequisites
12+
13+
* Access to a Kubernetes cluster where the SPIRE server runs.
14+
15+
* cert-manager must be installed and running within the Kubernetes cluster. For more information about installing cert-manager, see link:https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/security_and_compliance/index#cert-manager-operator-install[Installing the cert-manager Operator for Red{nbsp}Hat OpenShift].
16+
17+
* A pre-configured cert-manager `Issuer` capable of signing intermediate Certificate Authority (CA) certificates.
18+

‎modules/zero-trust-manager-configure-issuer.adoc‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zero-trust-manager-upstream-authority plugins.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-configure-issuer_{context}"]
7+
= Configuring the cert-manager issuer
8+
9+
Before the cert-manager plugin can be configured, an `Issuer` needs to be created since the `Issuer` represents the CA and defines how certificates are issued. You create a cert-manager `Issuer` by performing the following steps:
10+
11+
.Procedure
12+
13+
. Generate the Transport Layer Security (TLS) secret by running the following command:
14+
+
15+
[source,terminal]
16+
----
17+
$ oc create secret tls my-ca-key-pair-secret \
18+
--cert=path/to/your/ca.crt \
19+
--key=path/to/your/ca.key \
20+
--namespace=my-namespace
21+
----
22+
23+
. Create a YAML file that defines the `Issuer`, for example `ca-issuer.yaml`:
24+
+
25+
.Example `ca-issuer.yaml`
26+
+
27+
[source,yaml]
28+
----
29+
apiVersion: cert-manager.io/v1
30+
kind: Issuer
31+
metadata:
32+
name: my-ca-issuer
33+
namespace: my-namespace
34+
spec:
35+
ca:
36+
secretName: my-ca-key-pair-secret <1>
37+
----
38+
<1> The name of the Kubernetes Secret that holds the `tls.cert` and `tls.key` files. This secret must exist before you create the `Issuer`.
39+
40+
. Apply the configuration by running the following command:
41+
+
42+
[source, terminal]
43+
----
44+
$ oc apply -f ca-issuer.yaml
45+
----

0 commit comments

Comments
 (0)