Skip to content

Commit 4fc19b0

Browse files
irbyirby
authored
feat: release 2.5.0
2.5.0: CA Bundle with ConfigMap + GKE Ambient Credentials Documentation
1 parent e63fd01 commit 4fc19b0

25 files changed

Lines changed: 1960 additions & 50 deletions

‎CHANGELOG.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,14 @@
1+
# v2.5.0
2+
## Features
3+
- Add support to specify a ConfigMap for CA trust bundles in Issuer / ClusterIssuer resources via the `caBundleConfigMapName` specification.
4+
- Add support for specifying a key on a Secret / ConfigMap resource for the CA trust bundle via the `caBundleKey` specification on an Issuer / ClusterIssuer resource.
5+
- Add a timeout when fetching ambient Azure credentials to move onto other ambient credential methods.
6+
- Ability to specify environment variables on issuer deployment to set additional configuration options (i.e. HTTP proxy settings, etc.)
7+
8+
## Chores
9+
- Add documentation for how to configure command-cert-manager-issuer with ambient credentials on Google Kubernetes Engine (GKE).
10+
- Add documentation for configuring CA trust bundles via Secret and ConfigMap resources using trust-manager.
11+
112
# v2.4.0
213
## Features
314
- Add a `healthcheck` specification to Issuer / ClusterIssuer resources, allowing flexibility in the health check interval.

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ test: manifests generate fmt vet envtest ## Run tests.
6767
# Utilize Kind or modify the e2e tests to load the image locally, enabling compatibility with other vendors.
6868
.PHONY: test-e2e # Run the e2e tests against a Kind k8s instance that is spun up.
6969
test-e2e:
70-
go test ./test/e2e/ -v -ginkgo.v
70+
cd e2e && source .env && ./run_tests.sh
7171

7272
.PHONY: lint
7373
lint: golangci-lint ## Run golangci-lint linter & yamllint

‎README.md‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -144,10 +144,25 @@ Command Issuer is installed using a Helm chart. The chart is available in the [C
144144
--create-namespace
145145
```
146146

147-
> For all possible configuration values for the command-cert-manager-issuer Helm chart, please refer to [this list](./deploy/charts/command-cert-manager-issuer/README.md#configuration)
147+
You can also install a specific version of the command-cert-manager-issuer Helm chart:
148+
149+
```shell
150+
helm search repo command-issuer/command-cert-manager-issuer --versions
151+
```
152+
153+
```shell
154+
helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \
155+
--namespace command-issuer-system \
156+
--version 2.4.0
157+
--create-namespace
158+
```
159+
160+
> For all possible configuration values for the command-cert-manager-issuer Helm chart, please refer to [this list](./deploy/charts/command-cert-manager-issuer/README.md#configuration)
148161

149162
> The Helm chart installs the Command Issuer CRDs by default. The CRDs can be installed manually with the `make install` target.
150163

164+
> A list of configurable Helm chart parameters can be found [in the Helm chart docs](./deploy/charts/command-cert-manager-issuer/README.md#configuration)
165+
151166
# Authentication
152167

153168
## Explicit Credentials
@@ -166,6 +181,7 @@ These credentials must be configured using a Kubernetes Secret. By default, the
166181
Command Issuer also supports ambient authentication, where a token is fetched from an Authorization Server using a cloud provider's auth infrastructure and passed to Command directly. The following methods are supported:
167182
168183
- [Managed Identity Using Azure Entra ID Workload Identity](./docs/ambient-providers/azure.md) (if running in [AKS](https://azure.microsoft.com/en-us/products/kubernetes-service))
184+
- [Workload Identity Using Google Kubernetes Engine](./docs/ambient-providers/google.md) (if running in [GKE](https://cloud.google.com/kubernetes-engine))
169185
170186
If you are running your Kubernetes workload in a cloud provider not listed above, you can use workload identity federation with [Azure AD](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation).
171187
@@ -212,11 +228,7 @@ This section has moved. Please refer to [this link](./docs/ambient-providers/azu
212228
213229
# CA Bundle
214230
215-
If the Command API is configured to use a self-signed certificate or with a certificate whose issuer isn't widely trusted, the CA certificate must be provided as a Kubernetes secret.
216-
217-
```shell
218-
kubectl -n command-issuer-system create secret generic command-ca-secret --from-file=ca.crt
219-
```
231+
This section has been moved. Please refer to the new [CA Bundle docs](./docs/ca-bundle/README.md) documentation regarding CA trust with command-cert-manager-issuer.
220232
221233
# Creating Issuer and ClusterIssuer resources
222234
@@ -243,7 +255,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
243255
| hostname | The hostname of the Command API Server. |
244256
| apiPath | (optional) The base path of the Command REST API. Defaults to `KeyfactorAPI`. |
245257
| commandSecretName | (optional) The name of the Kubernetes secret containing basic auth credentials or OAuth 2.0 credentials. Omit if using ambient credentials. |
246-
| caSecretName | (optional) The name of the Kubernetes secret containing the CA certificate. Required if the Command API uses a self-signed certificate or it was signed by a CA that is not widely trusted. |
258+
| caSecretName | (optional) The name of the Kubernetes secret containing the CA certificate trust chain. See the [CA Bundle docs](./docs/ca-bundle/README.md) for more information. |
259+
| caBundleConfigMapName | (optional) The name of the Kubernetes ConfigMap containing the CA certificate trust chain. See the [CA Bundle docs](./docs/ca-bundle/README.md) for more information. |
260+
| caBundleKey | (optional) The name of the key in the ConfigMap or Secret specified by `caSecretName` or `caBundleConfigMapName` that contains the CA bundle. If omitted, the last key of the ConfigMap / Secret resource will be used. |
247261
| certificateAuthorityLogicalName | The logical name of the Certificate Authority to use in Command. For example, `Sub-CA` |
248262
| certificateAuthorityHostname | (optional) The hostname of the Certificate Authority specified by `certificateAuthorityLogicalName`. This field is usually only required if the CA in Command is a DCOM (MSCA-like) CA. |
249263
| enrollmentPatternId | The ID of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternId` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified certificate template is not compatible with the enrollment pattern. |
@@ -276,7 +290,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
276290
hostname: "$HOSTNAME"
277291
apiPath: "/KeyfactorAPI" # Preceding & trailing slashes are handled automatically
278292
commandSecretName: "command-secret" # references the secret created above. Omit if using ambient credentials.
279-
caSecretName: "command-ca-secret" # references the secret created above
293+
# caSecretName: "command-ca-secret" # references a secret containing the CA trust chain (see CA Bundle docs for more info)
294+
# caBundleConfigMapName: "command-ca-configmap" # references a configmap containing the CA trust chain (see CA Bundle docs for more info)
295+
# caBundleKey: "ca.crt" # references the key in the secret/configmap containing the CA trust chain (see CA Bundle docs for more info)
280296
281297
# certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required
282298
certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME"
@@ -309,7 +325,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
309325
hostname: "$HOSTNAME"
310326
apiPath: "/KeyfactorAPI" # Preceding & trailing slashes are handled automatically
311327
commandSecretName: "command-secret" # references the secret created above. Omit if using ambient credentials.
312-
caSecretName: "command-ca-secret" # references the secret created above
328+
# caSecretName: "command-ca-secret" # references a secret containing the CA trust chain (see CA Bundle docs for more info)
329+
# caBundleConfigMapName: "command-ca-configmap" # references a configmap containing the CA trust chain (see CA Bundle docs for more info)
330+
# caBundleKey: "ca.crt" # references the key in the secret/configmap containing the CA trust chain (see CA Bundle docs for more info)
313331
314332
# certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required
315333
certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME"

‎api/v1alpha1/issuer_types.go‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,10 +106,24 @@ type IssuerSpec struct {
106106

107107
// The name of the secret containing the CA bundle to use when verifying
108108
// Command's server certificate. If specified, the CA bundle will be added to
109-
// the client trust roots for the Command issuer.
109+
// the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
110+
// are specified, caBundleConfigMapName will take precedence.
110111
// +optional
111112
CaSecretName string `json:"caSecretName,omitempty"`
112113

114+
// The name of the ConfigMap containing the CA bundle to use when verifying
115+
// Command's server certificate. If specified, the CA bundle will be added to
116+
// the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
117+
// are specified, caBundleConfigMapName will take precedence.
118+
// +optional
119+
CaBundleConfigMapName string `json:"caBundleConfigMapName,omitempty"`
120+
121+
// The key in the Secret or ConfigMap containing the CA certificate bundle.
122+
// Applies to both caSecretName and caBundleConfigMapName.
123+
// If unspecified, the last key alphabetically in the Secret or ConfigMap data will be used.
124+
// +optional
125+
CaBundleKey string `json:"caBundleKey,omitempty"`
126+
113127
// A list of comma separated scopes used when requesting a Bearer token from an ambient token provider implied
114128
// by the environment, rather than by commandSecretName. For example, could be set to
115129
// api://{tenant ID}/.default when requesting an access token for Entra ID (DefaultAzureCredential). Has no

‎cmd/main.go‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ func main() {
7171
var clusterResourceNamespace string
7272
var disableApprovedCheck bool
7373
var secretAccessGrantedAtClusterLevel bool
74+
var configMapAccessGrantedAtClusterLevel bool
7475

7576
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
7677
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
@@ -88,6 +89,8 @@ func main() {
8889
"Disables waiting for CertificateRequests to have an approved condition before signing.")
8990
flag.BoolVar(&secretAccessGrantedAtClusterLevel, "secret-access-granted-at-cluster-level", false,
9091
"Set this flag to true if the secret access is granted at cluster level. This will allow the controller to access secrets in any namespace. ")
92+
flag.BoolVar(&configMapAccessGrantedAtClusterLevel, "configmap-access-granted-at-cluster-level", false,
93+
"Set this flag to true if the config map access is granted at cluster level. This will allow the controller to access config maps in any namespace. ")
9194
opts := zap.Options{
9295
Development: true,
9396
}
@@ -130,16 +133,31 @@ func main() {
130133
}
131134

132135
var cacheOpts cache.Options
133-
if secretAccessGrantedAtClusterLevel {
134-
setupLog.Info("expecting SA to have Get+List+Watch permissions for corev1 Secret resources at cluster level")
135-
} else {
136-
setupLog.Info(fmt.Sprintf("expecting SA to have Get+List+Watch permissions for corev1 Secret resources in the %q namespace", clusterResourceNamespace))
136+
137+
// Build the ByObject map if either resource is namespace-scoped
138+
if !secretAccessGrantedAtClusterLevel || !configMapAccessGrantedAtClusterLevel {
139+
byObject := make(map[client.Object]cache.ByObject)
140+
141+
if !secretAccessGrantedAtClusterLevel {
142+
setupLog.Info(fmt.Sprintf("expecting SA to have Get+List+Watch permissions for corev1 Secret resources in the %q namespace", clusterResourceNamespace))
143+
byObject[&corev1.Secret{}] = cache.ByObject{
144+
Namespaces: map[string]cache.Config{clusterResourceNamespace: {}},
145+
}
146+
} else {
147+
setupLog.Info("expecting SA to have Get+List+Watch permissions for corev1 Secret resources at cluster level")
148+
}
149+
150+
if !configMapAccessGrantedAtClusterLevel {
151+
setupLog.Info(fmt.Sprintf("expecting SA to have Get+List+Watch permissions for corev1 ConfigMap resources in the %q namespace", clusterResourceNamespace))
152+
byObject[&corev1.ConfigMap{}] = cache.ByObject{
153+
Namespaces: map[string]cache.Config{clusterResourceNamespace: {}},
154+
}
155+
} else {
156+
setupLog.Info("expecting SA to have Get+List+Watch permissions for corev1 ConfigMap resources at cluster level")
157+
}
158+
137159
cacheOpts = cache.Options{
138-
ByObject: map[client.Object]cache.ByObject{
139-
&corev1.Secret{}: {
140-
Namespaces: map[string]cache.Config{clusterResourceNamespace: cache.Config{}},
141-
},
142-
},
160+
ByObject: byObject,
143161
}
144162
}
145163

‎config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,11 +52,25 @@ spec:
5252
the URL of your Command environment.Has no effect on OAuth 2.0 Client Credential configuration - please specify
5353
the audience for this method in an Opaque secret.
5454
type: string
55+
caBundleConfigMapName:
56+
description: |-
57+
The name of the ConfigMap containing the CA bundle to use when verifying
58+
Command's server certificate. If specified, the CA bundle will be added to
59+
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
60+
are specified, caBundleConfigMapName will take precedence.
61+
type: string
62+
caBundleKey:
63+
description: |-
64+
The key in the Secret or ConfigMap containing the CA certificate bundle.
65+
Applies to both caSecretName and caBundleConfigMapName.
66+
If unspecified, the last key alphabetically in the Secret or ConfigMap data will be used.
67+
type: string
5568
caSecretName:
5669
description: |-
5770
The name of the secret containing the CA bundle to use when verifying
5871
Command's server certificate. If specified, the CA bundle will be added to
59-
the client trust roots for the Command issuer.
72+
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
73+
are specified, caBundleConfigMapName will take precedence.
6074
type: string
6175
certificateAuthorityHostname:
6276
description: |-

‎config/crd/bases/command-issuer.keyfactor.com_issuers.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,11 +52,25 @@ spec:
5252
the URL of your Command environment.Has no effect on OAuth 2.0 Client Credential configuration - please specify
5353
the audience for this method in an Opaque secret.
5454
type: string
55+
caBundleConfigMapName:
56+
description: |-
57+
The name of the ConfigMap containing the CA bundle to use when verifying
58+
Command's server certificate. If specified, the CA bundle will be added to
59+
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
60+
are specified, caBundleConfigMapName will take precedence.
61+
type: string
62+
caBundleKey:
63+
description: |-
64+
The key in the Secret or ConfigMap containing the CA certificate bundle.
65+
Applies to both caSecretName and caBundleConfigMapName.
66+
If unspecified, the last key alphabetically in the Secret or ConfigMap data will be used.
67+
type: string
5568
caSecretName:
5669
description: |-
5770
The name of the secret containing the CA bundle to use when verifying
5871
Command's server certificate. If specified, the CA bundle will be added to
59-
the client trust roots for the Command issuer.
72+
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
73+
are specified, caBundleConfigMapName will take precedence.
6074
type: string
6175
certificateAuthorityHostname:
6276
description: |-

‎deploy/charts/command-cert-manager-issuer/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,5 +83,6 @@ The following table lists the configurable parameters of the `command-cert-manag
8383
| `resources` | CPU/Memory resource requests/limits | `{}` (with commented out options) |
8484
| `nodeSelector` | Node labels for pod assignment | `{}` |
8585
| `tolerations` | Tolerations for pod assignment | `[]` |
86+
| `env` | Environmental variables set for pod | `{}` |
8687
| `secretConfig.useClusterRoleForSecretAccess` | Specifies if the ServiceAccount should be granted access to the Secret resource using a ClusterRole | `false` |
8788
| `defaultHealthCheckInterval` | Specifies the default health check interval for issuers | `""` (uses the default in the code which is 60s) |

‎deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,25 @@ spec:
4646
description: APIPath is the base path of the Command API. KeyfactorAPI
4747
by default
4848
type: string
49+
caBundleConfigMapName:
50+
description: |-
51+
The name of the ConfigMap containing the CA bundle to use when verifying
52+
Command's server certificate. If specified, the CA bundle will be added to
53+
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
54+
are specified, caBundleConfigMapName will take precedence.
55+
type: string
56+
caBundleKey:
57+
description: |-
58+
The key in the Secret or ConfigMap containing the CA certificate bundle.
59+
Applies to both caSecretName and caBundleConfigMapName.
60+
If unspecified, the last key alphabetically in the Secret or ConfigMap data will be used.
61+
type: string
4962
caSecretName:
5063
description: |-
5164
The name of the secret containing the CA bundle to use when verifying
5265
Command's server certificate. If specified, the CA bundle will be added to
53-
the client trust roots for the Command issuer.
66+
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
67+
are specified, caBundleConfigMapName will take precedence.
5468
type: string
5569
certificateAuthorityHostname:
5670
description: |-

0 commit comments

Comments
 (0)