[WIP] OSDOCS-15575 added a new assembly and updated topic map #96769

wgabor0427 · 2025-07-28T19:52:31Z

Version(s):
4.19+

Issue:

Link to docs preview:
https://96769--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/zero_trust_workload_identity_manager/zero-trust-manager-upstream-authority.html

QE review:

QE has approved this change.

Additional information:

ocpdocs-previewbot · 2025-07-28T20:00:18Z

🤖 Tue Oct 21 13:05:55 - Prow CI generated the docs preview:

https://96769--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/zero_trust_workload_identity_manager/zero-trust-manager-upstream-authority.html

wgabor0427 · 2025-07-29T13:47:19Z

/label merge-review-needed

lahinson · 2025-07-29T14:34:48Z

Hi @wgabor0427 - Please make sure that QE has approved your PR before you submit it for merge review. Thanks!

lunarwhite · 2025-08-01T00:44:30Z

/lgtm

sabre1041

Good content. Requested a number of improvements

sabre1041 · 2025-08-21T09:35:11Z

modules/zero-trust-manager-cert-manager-crd.adoc

+<2> Set to `ClusterIssuer` if issuer is cluster-scoped. The default is `Issuer`.
+<3> The API group of the issuer. The default is `cert-manager.io`.
+<4> The namespace where the `CertificateRequest` is created. The default is `zero-trust-workload-identity-manager`.
+<5> The name of a Secret containing the `kubeconfig` to connect to the clsuter where `cert-manager` is running. If empy, an in-cluster configuration is used.


Suggested change

<5> The name of a Secret containing the `kubeconfig` to connect to the clsuter where `cert-manager` is running. If empy, an in-cluster configuration is used.

<5> The name of a Secret containing the `kubeconfig` to connect to the cluster where `cert-manager` is running. If empty, an in-cluster configuration is used.

sabre1041 · 2025-08-21T09:44:57Z

modules/zero-trust-manager-cert-manager-crd.adoc

+$ oc get certificaterequests -n <namespace>
+----
+
+. Run the following command ot inspect a specific `CertificateRequest`. Review the `Status` section to confirm the certificate has been signed and that  the certificate data is present.


Suggested change

. Run the following command ot inspect a specific `CertificateRequest`. Review the `Status` section to confirm the certificate has been signed and that the certificate data is present.

. Run the following command to inspect a specific `CertificateRequest`. Review the `Status` section to confirm the certificate has been signed and that the certificate data is present.

sabre1041 · 2025-08-21T09:46:28Z

modules/zero-trust-manager-cert-manager-upstream-authority.adoc

+
+The cert-manager plugin enables the SPIRE server to dynamically request and receive intermediate signing certificates from cert-manager. The plugin automates the management of the SPIRE server intermediate signing certificates by integrating with cert-manager.
+
+When a SPIRE server needs a new certificate, the cert-manager plugin creates a `CertificateRequest` custom resource in the configured Kubernetes namespace. The namespace has the Certificate Signing Request (CSR) generated by the SPIRE server. The cert-manager plugin processes the `CertificateRequest` and an associated `Issuer` signs the CSR. The signed intermediate certificate and the full Certificate Authority (CA) bundle are available in the `CertificateRequest` status. These signed credentials are available to the SPIRE server and used as its upstream signing authority.


Should OpenShift be used instead of Kubernetes?

I think that's a good idea

sabre1041 · 2025-08-21T09:46:55Z

modules/zero-trust-manager-cert-manager-upstream-authority.adoc

+
+The cert-manager plugin enables the SPIRE server to dynamically request and receive intermediate signing certificates from cert-manager. The plugin automates the management of the SPIRE server intermediate signing certificates by integrating with cert-manager.
+
+When a SPIRE server needs a new certificate, the cert-manager plugin creates a `CertificateRequest` custom resource in the configured Kubernetes namespace. The namespace has the Certificate Signing Request (CSR) generated by the SPIRE server. The cert-manager plugin processes the `CertificateRequest` and an associated `Issuer` signs the CSR. The signed intermediate certificate and the full Certificate Authority (CA) bundle are available in the `CertificateRequest` status. These signed credentials are available to the SPIRE server and used as its upstream signing authority.


Suggested change

When a SPIRE server needs a new certificate, the cert-manager plugin creates a `CertificateRequest` custom resource in the configured Kubernetes namespace. The namespace has the Certificate Signing Request (CSR) generated by the SPIRE server. The cert-manager plugin processes the `CertificateRequest` and an associated `Issuer` signs the CSR. The signed intermediate certificate and the full Certificate Authority (CA) bundle are available in the `CertificateRequest` status. These signed credentials are available to the SPIRE server and used as its upstream signing authority.

When a SPIRE server needs a new certificate, the cert-manager plugin creates a `CertificateRequest` custom resource in the configured Kubernetes namespace. The namespace includes the Certificate Signing Request (CSR) generated by the SPIRE server. The cert-manager plugin processes the `CertificateRequest` and an associated `Issuer` signs the CSR. The signed intermediate certificate and the full Certificate Authority (CA) bundle are available in the `CertificateRequest` status. These signed credentials are available to the SPIRE server and used as its upstream signing authority.

sabre1041 · 2025-08-21T09:47:49Z

modules/zero-trust-manager-configure-cert-manager.adoc

+
+.Prerequisites
+
+* Access to a Kubernetes cluster where the SPIRE server runs.


Suggested change

* Access to a Kubernetes cluster where the SPIRE server runs.

* Access to a OpenShift cluster where the SPIRE server runs.

sabre1041 · 2025-08-21T10:46:18Z

modules/zero-trust-manager-configure-vault.adoc

+<3> Name of the Kubernetes secret containing the client private key in PEM format.
+<4> The name of the Vault role to authenticate against.
+
+.. Configure the `tokenAuth` authentication in the `UpstreamAuthority` section of the `spireserver.yaml` file. This method uses a static Vault token.


Suggested change

.. Configure the `tokenAuth` authentication in the `UpstreamAuthority` section of the `spireserver.yaml` file. This method uses a static Vault token.

.. Configure the `tokenAuth` authentication in the `upstreamAuthority` section of the `spireserver.yaml` file. This method uses a static Vault token.

sabre1041 · 2025-08-21T10:46:57Z

modules/zero-trust-manager-configure-vault.adoc

+<2> The `AppRole` ID used for authentication.
+<3> the `AppRole` SecretID used for authentication.
+
+. Configure the `k8sAuth` authentication in the `UpstreamAuthority` section of the `spireserver.yaml` file. This method uses a Kubernetes ServiceAccount token for authentication.


Suggested change

. Configure the `k8sAuth` authentication in the `UpstreamAuthority` section of the `spireserver.yaml` file. This method uses a Kubernetes ServiceAccount token for authentication.

. Configure the `k8sAuth` authentication in the `upstreamAuthority` section of the `spireserver.yaml` file. This method uses a Kubernetes ServiceAccount token for authentication.

sabre1041 · 2025-08-21T10:47:10Z

modules/zero-trust-manager-configure-vault.adoc

+<4> The name used for the Mutual Transport Layer Security (mTLS) authentication with the Vault server.
+
+. Configure one of the authentication methods:
+.. Configure the `certAuth` authentication in the `UpstreamAuthority` section of the `spireserver.yaml` file. This method uses a client certificate and private key for authentication.


Suggested change

.. Configure the `certAuth` authentication in the `UpstreamAuthority` section of the `spireserver.yaml` file. This method uses a client certificate and private key for authentication.

.. Configure the `certAuth` authentication in the `upstreamAuthority` section of the `spireserver.yaml` file. This method uses a client certificate and private key for authentication.

sabre1041 · 2025-08-21T10:48:12Z

modules/zero-trust-manager-configure-vault.adoc

@@ -0,0 +1,140 @@
+// Module included in the following assemblies:
+//
+// * security/zero_trust_workload_identity_manager/zero-trust-manager.adoc


There are a lot of assumptions that the Vault server has been configured a certain way. Is there any other guidance that we will be providing for our customers?

I do not know that. Yuedong would have to confirm

sabre1041 · 2025-08-21T10:52:49Z

security/zero_trust_workload_identity_manager/zero-trust-manager-upstream-authority.adoc

+:FeatureName: Zero Trust Workload Identity Manager
+include::snippets/technology-preview.adoc[]
+
+Upstream authority plugins are components that allow the SPIRE server to integrate with an existing Public Key Infrastructure (PKI) to obtain intermediate signing certificates. The SPIRE server then uses these intermediate certificates to cryptographically sign the {svid-full} that it issues to workloads. The plugins also allow the SPIRE server to use a pre-existing root of trust, rather than establishing a new, isolated one.


Suggested change

Upstream authority plugins are components that allow the SPIRE server to integrate with an existing Public Key Infrastructure (PKI) to obtain intermediate signing certificates. The SPIRE server then uses these intermediate certificates to cryptographically sign the {svid-full} that it issues to workloads. The plugins also allow the SPIRE server to use a pre-existing root of trust, rather than establishing a new, isolated one.

Upstream authority plugins are components that allow the SPIRE server to integrate with an existing Public Key Infrastructure (PKI) to obtain intermediate signing certificates. The SPIRE server then uses these intermediate certificates to cryptographically sign the {svid-full} that it issues to workloads. The plugins also allow the SPIRE server to use a pre-existing root of trust, rather than establishing a new, isolated root of trust.

bergerhoffer · 2025-10-20T15:24:38Z

The branch/enterprise-4.21 label has been added to this PR.

This is because your PR targets the main branch and is labeled for enterprise-4.20. And any PR going into main must also target the latest version branch (enterprise-4.21).

If the update in your PR does NOT apply to version 4.21 onward, please re-target this PR to go directly into the appropriate version branch or branches (enterprise-4.x) instead of main.

wgabor0427 · 2025-10-21T12:42:35Z

/retest

openshift-ci · 2025-10-21T13:06:59Z

@wgabor0427: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

sabre1041 · 2025-10-21T13:52:42Z

/lgtm

wgabor0427 · 2025-10-21T13:54:52Z

/retest

openshift-ci bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jul 28, 2025

wgabor0427 force-pushed the OSDOCS-15575 branch 3 times, most recently from a2b2407 to 0ee8d81 Compare July 29, 2025 13:21

openshift-ci bot added the merge-review-needed Signifies that the merge review team needs to review this PR label Jul 29, 2025

lahinson added this to the Continuous Release milestone Jul 29, 2025

openshift-ci bot assigned lunarwhite Aug 1, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 1, 2025

wgabor0427 force-pushed the OSDOCS-15575 branch from 0ee8d81 to 7f8b2ad Compare August 7, 2025 13:01

openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed lgtm Indicates that a PR is ready to be merged. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Aug 7, 2025

wgabor0427 force-pushed the OSDOCS-15575 branch from 7f8b2ad to 9c33bb4 Compare August 7, 2025 13:03

wgabor0427 changed the title ~~OSDOCS-15575 added a new assembly and updated topic map~~ [WIP] OSDOCS-15575 added a new assembly and updated topic map Aug 8, 2025

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 8, 2025

wgabor0427 force-pushed the OSDOCS-15575 branch 2 times, most recently from 09cea55 to dd903e3 Compare August 13, 2025 13:15

wgabor0427 mentioned this pull request Aug 14, 2025

OSDOCS-15490 create documentation for cert-manager plugin #96717

Closed

1 task

wgabor0427 force-pushed the OSDOCS-15575 branch 2 times, most recently from 58e16f9 to 176910b Compare August 18, 2025 17:50

wgabor0427 changed the title ~~[WIP] OSDOCS-15575 added a new assembly and updated topic map~~ OSDOCS-15575 added a new assembly and updated topic map Aug 18, 2025

wgabor0427 force-pushed the OSDOCS-15575 branch 6 times, most recently from 9226aef to b6d420a Compare August 20, 2025 15:13

sabre1041 suggested changes Aug 21, 2025

View reviewed changes

wgabor0427 force-pushed the OSDOCS-15575 branch 4 times, most recently from 36ee519 to 7125277 Compare August 21, 2025 20:33

wgabor0427 force-pushed the OSDOCS-15575 branch 2 times, most recently from 2a0b127 to 892f2e1 Compare September 7, 2025 16:37

wgabor0427 changed the title ~~OSDOCS-15575 added a new assembly and updated topic map~~ [WIP] OSDOCS-15575 added a new assembly and updated topic map Sep 8, 2025

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 8, 2025

bergerhoffer added the branch/enterprise-4.21 label Oct 20, 2025

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 20, 2025

wgabor0427 force-pushed the OSDOCS-15575 branch from 892f2e1 to e90e7d7 Compare October 20, 2025 15:39

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 20, 2025

wgabor0427 requested a review from sabre1041 October 21, 2025 12:01

wgabor0427 added 2 commits October 21, 2025 08:44

OSDOCS-15575 updated several modules

e9c3e24

OSDOCS-1575 updated topic map

903b32e

wgabor0427 force-pushed the OSDOCS-15575 branch from 09c5999 to 903b32e Compare October 21, 2025 12:44

openshift-ci bot assigned sabre1041 Oct 21, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 21, 2025

	<5> The name of a Secret containing the `kubeconfig` to connect to the clsuter where `cert-manager` is running. If empy, an in-cluster configuration is used.
	<5> The name of a Secret containing the `kubeconfig` to connect to the cluster where `cert-manager` is running. If empty, an in-cluster configuration is used.

	. Run the following command ot inspect a specific `CertificateRequest`. Review the `Status` section to confirm the certificate has been signed and that the certificate data is present.
	. Run the following command to inspect a specific `CertificateRequest`. Review the `Status` section to confirm the certificate has been signed and that the certificate data is present.


		The cert-manager plugin enables the SPIRE server to dynamically request and receive intermediate signing certificates from cert-manager. The plugin automates the management of the SPIRE server intermediate signing certificates by integrating with cert-manager.

		When a SPIRE server needs a new certificate, the cert-manager plugin creates a `CertificateRequest` custom resource in the configured Kubernetes namespace. The namespace has the Certificate Signing Request (CSR) generated by the SPIRE server. The cert-manager plugin processes the `CertificateRequest` and an associated `Issuer` signs the CSR. The signed intermediate certificate and the full Certificate Authority (CA) bundle are available in the `CertificateRequest` status. These signed credentials are available to the SPIRE server and used as its upstream signing authority. No newline at end of file


		.Prerequisites

		* Access to a Kubernetes cluster where the SPIRE server runs.

	* Access to a Kubernetes cluster where the SPIRE server runs.
	* Access to a OpenShift cluster where the SPIRE server runs.

	.. Configure the `tokenAuth` authentication in the `UpstreamAuthority` section of the `spireserver.yaml` file. This method uses a static Vault token.
	.. Configure the `tokenAuth` authentication in the `upstreamAuthority` section of the `spireserver.yaml` file. This method uses a static Vault token.

	. Configure the `k8sAuth` authentication in the `UpstreamAuthority` section of the `spireserver.yaml` file. This method uses a Kubernetes ServiceAccount token for authentication.
	. Configure the `k8sAuth` authentication in the `upstreamAuthority` section of the `spireserver.yaml` file. This method uses a Kubernetes ServiceAccount token for authentication.

	.. Configure the `certAuth` authentication in the `UpstreamAuthority` section of the `spireserver.yaml` file. This method uses a client certificate and private key for authentication.
	.. Configure the `certAuth` authentication in the `upstreamAuthority` section of the `spireserver.yaml` file. This method uses a client certificate and private key for authentication.

Uh oh!

[WIP] OSDOCS-15575 added a new assembly and updated topic map #96769

Are you sure you want to change the base?

[WIP] OSDOCS-15575 added a new assembly and updated topic map #96769

Uh oh!

Conversation

wgabor0427 commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wgabor0427 commented Jul 29, 2025

Uh oh!

lahinson commented Jul 29, 2025

Uh oh!

lunarwhite commented Aug 1, 2025

Uh oh!

sabre1041 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bergerhoffer commented Oct 20, 2025

Uh oh!

wgabor0427 commented Oct 21, 2025

Uh oh!

openshift-ci bot commented Oct 21, 2025

Uh oh!

sabre1041 commented Oct 21, 2025

Uh oh!

wgabor0427 commented Oct 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

wgabor0427 commented Jul 28, 2025 •

edited

Loading

ocpdocs-previewbot commented Jul 28, 2025 •

edited

Loading