Skip to content

Commit 1ff19e8

Browse files
spbsolublespbsoluble
authored
Merge b0485ba into 2e046be 
2 parents 2e046be + b0485ba commit 1ff19e8

File tree

22 files changed

+3135
-1006
lines changed

22 files changed

+3135
-1006
lines changed

‎.github/workflows/keyfactor-starter-workflow.yml

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,18 @@ on:
1111

1212
jobs:
1313
call-starter-workflow:
14-
uses: keyfactor/actions/.github/workflows/starter.yml@v2
14+
uses: keyfactor/actions/.github/workflows/starter.yml@screenshots
15+
with:
16+
command_token_url: ${{ vars.COMMAND_TOKEN_URL }}
17+
command_hostname: ${{ vars.COMMAND_HOSTNAME }}
18+
command_base_api_path: ${{ vars.COMMAND_API_PATH }}
1519
secrets:
1620
token: ${{ secrets.V2BUILDTOKEN}}
1721
APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}}
1822
gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
1923
gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}
24+
scan_token: ${{ secrets.SAST_TOKEN }}
25+
entra_username: ${{ secrets.DOCTOOL_ENTRA_USERNAME }}
26+
entra_password: ${{ secrets.DOCTOOL_ENTRA_PASSWD }}
27+
command_client_id: ${{ secrets.COMMAND_CLIENT_ID }}
28+
command_client_secret: ${{ secrets.COMMAND_CLIENT_SECRET }}

‎CHANGELOG.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
1+
# 1.2.2
2+
3+
## Bug Fixes
4+
- fix(storetypes): `K8SJKS` and `K8SPKCS12` storetypes using a separate `k8s` secret for store password does not crash
5+
on missing or invalid secret field name.
6+
17
# 1.2.1
8+
9+
## Bug Fixes
210
- fix(management): `K8SNS` management jobs handle `storepath` parsed length is less than expected.
311

412
# 1.2.0

‎README.md

Lines changed: 1612 additions & 831 deletions
Large diffs are not rendered by default.

‎docs_old/README.md

Lines changed: 928 additions & 0 deletions
Large diffs are not rendered by default.

‎readme_source.md renamed to ‎docs_old/readme_source.md

File renamed without changes.

‎docsource/content.md

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
## Overview
2+
3+
The Kubernetes Orchestrator allows for the remote management of certificate stores defined in a Kubernetes cluster.
4+
The following types of Kubernetes resources are supported: kubernetes secrets of `kubernetes.io/tls` or `Opaque` and
5+
kubernetes certificates `certificates.k8s.io/v1`
6+
7+
The certificate store types that can be managed in the current version are:
8+
- `K8SCert` - Kubernetes certificates of type `certificates.k8s.io/v1`
9+
- `K8SSecret` - Kubernetes secrets of type `Opaque`
10+
- `K8STLSSecret` - Kubernetes secrets of type `kubernetes.io/tls`
11+
- `K8SCluster` - This allows for a single store to manage a k8s cluster's secrets or type `Opaque` and `kubernetes.io/tls`.
12+
This can be thought of as a container of `K8SSecret` and `K8STLSSecret` stores across all k8s namespaces.
13+
- `K8SNS` - This allows for a single store to manage a k8s namespace's secrets or type `Opaque` and `kubernetes.io/tls`.
14+
This can be thought of as a container of `K8SSecret` and `K8STLSSecret` stores for a single k8s namespace.
15+
- `K8SJKS` - Kubernetes secrets of type `Opaque` that contain one or more Java Keystore(s). These cannot be managed at the
16+
cluster or namespace level as they should all require unique credentials.
17+
- `K8SPKCS12` - Kubernetes secrets of type `Opaque` that contain one or more PKCS12(s). These cannot be managed at the
18+
cluster or namespace level as they should all require unique credentials.
19+
20+
This orchestrator extension makes use of the Kubernetes API by using a service account
21+
to communicate remotely with certificate stores. The service account must have the correct permissions
22+
in order to perform the desired operations. For more information on the required permissions, see the
23+
[service account setup guide](#service-account-setup).
24+
25+
## Requirements
26+
27+
### Kubernetes API Access
28+
This orchestrator extension makes use of the Kubernetes API by using a service account
29+
to communicate remotely with certificate stores. The service account must exist and have the appropriate permissions.
30+
The service account token can be provided to the extension in one of two ways:
31+
- As a raw JSON file that contains the service account credentials
32+
- As a base64 encoded string that contains the service account credentials
33+
34+
#### Service Account Setup
35+
To set up a service account user on your Kubernetes cluster to be used by the Kubernetes Orchestrator Extension. For full
36+
information on the required permissions, see the [service account setup guide](./scripts/kubernetes/README.md).
37+
38+
## Discovery
39+
40+
**NOTE:** To use discovery jobs, you must have the story type created in Keyfactor Command and the `needs_server`
41+
checkbox *MUST* be checked, if you do not select `needs_server` you will not be able to provide credentials to the
42+
discovery job and it will fail.
43+
44+
The Kubernetes Orchestrator Extension supports certificate discovery jobs. This allows you to populate the certificate stores with existing certificates. To run a discovery job, follow these steps:
45+
1. Click on the "Locations > Certificate Stores" menu item.
46+
2. Click the "Discover" tab.
47+
3. Click the "Schedule" button.
48+
4. Configure the job based on storetype. **Note** the "Server Username" field must be set to `kubeconfig` and the "Server Password" field is the `kubeconfig` formatted JSON file containing the service account credentials. See the "Service Account Setup" section earlier in this README for more information on setting up a service account.
49+
![discover_schedule_start.png](./docs/screenshots/discovery/discover_schedule_start.png)
50+
![discover_schedule_config.png](./docs/screenshots/discovery/discover_schedule_config.png)
51+
![discover_server_username.png](./docs/screenshots/discovery/discover_server_username.png)
52+
![discover_server_password.png](./docs/screenshots/discovery/discover_server_password.png)
53+
5. Click the "Save" button and wait for the Orchestrator to run the job. This may take some time depending on the number of certificates in the store and the Orchestrator's check-in schedule.
54+

‎docsource/k8scert.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
## Overview
2+
3+
The `K8SCert` store type is used to manage Kubernetes certificates of type `certificates.k8s.io/v1`.
4+
5+
**NOTE**: only `inventory` and `discovery` of these resources is supported with this extension. To provision these certs use the
6+
[k8s-csr-signer](https://github.com/Keyfactor/k8s-csr-signer).
7+

‎docsource/k8scluster.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
## Overview
2+
3+
The `K8SCluster` store type allows for a single store to manage a k8s cluster's secrets or type `Opaque` and `kubernetes.io/tls`.
4+
5+
## Certificate Store Configuration
6+
7+
In order for certificates of type `Opaque` and/or `kubernetes.io/tls` to be inventoried in `K8SCluster` store types, they must
8+
have specific keys in the Kubernetes secret.
9+
- Required keys: `tls.crt` or `ca.crt`
10+
- Additional keys: `tls.key`
11+
12+
### Storepath Patterns
13+
- `<cluster_name>`
14+
15+
### Alias Patterns
16+
- `<namespace_name>/secrets/<tls|opaque>/<secret_name>`
17+
18+

‎docsource/k8sjks.md

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
## Overview
2+
3+
The `K8SJKS` store type is used to manage Kubernetes secrets of type `Opaque`. These secrets
4+
must have a field that ends in `.jks`. The orchestrator will inventory and manage using a *custom alias* of the following
5+
pattern: `<k8s_secret_field_name>/<keystore_alias>`. For example, if the secret has a field named `mykeystore.jks` and
6+
the keystore contains a certificate with an alias of `mycert`, the orchestrator will manage the certificate using the
7+
alias `mykeystore.jks/mycert`. *NOTE* *This store type cannot be managed at the `cluster` or `namespace` level as they
8+
should all require unique credentials.*
9+
10+
## Discovery Job Configuration
11+
12+
For discovery of `K8SJKS` stores toy can use the following params to filter the certificates that will be discovered:
13+
- `Directories to search` - comma separated list of namespaces to search for certificates OR `all` to search all
14+
namespaces. *This cannot be left blank.*
15+
- `File name patterns to match` - comma separated list of K8S secret keys to search for PKCS12 or JKS data. Will use
16+
the following keys by default: `tls.pfx`,`tls.pkcs12`,`pfx`,`pkcs12`,`tls.jks`,`jks`.
17+
18+
## Certificate Store Configuration
19+
20+
In order for certificates of type `Opaque` to be inventoried as `K8SJKS` store types, they must have specific keys in
21+
the Kubernetes secret.
22+
- Valid Keys: `*.jks`
23+
24+
### Storepath Patterns
25+
- `<namespace_name>/<secret_name>`
26+
- `<namespace_name>/secrets/<secret_name>`
27+
- `<cluster_name>/<namespace_name>/secrets/<secret_name>`
28+
29+
### Alias Patterns
30+
- `<k8s_secret_field_name>/<keystore_alias>`
31+
32+
Example: `test.jks/load_balancer` where `test.jks` is the field name on the `Opaque` secret and `load_balancer` is
33+
the certificate alias in the `jks` data store.

‎docsource/k8sns.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
## Overview
2+
3+
The `K8SNS` store type is used to manage Kubernetes secrets of type `kubernetes.io/tls` and/or type `Opaque` in a single
4+
Keyfactor Command certificate store using an alias pattern of
5+
6+
## Discovery Job Configuration
7+
8+
For discovery of K8SNS stores toy can use the following params to filter the certificates that will be discovered:
9+
- `Directories to search` - comma separated list of namespaces to search for certificates OR `all` to search all
10+
namespaces. *This cannot be left blank.*
11+
12+
## Certificate Store Configuration
13+
14+
In order for certificates of type `Opaque` and/or `kubernetes.io/tls` to be inventoried in `K8SNS` store types, they must
15+
have specific keys in the Kubernetes secret.
16+
- Required keys: `tls.crt` or `ca.crt`
17+
- Additional keys: `tls.key`
18+
19+
### Storepath Patterns
20+
- `<namespace_name>`
21+
- `<cluster_name>/<namespace_name>`
22+
23+
### Alias Patterns
24+
- `secrets/<tls|opaque>/<secret_name>`
25+
26+

0 commit comments

Comments
 (0)