Skip to content

Commit 4b6a2c5

Browse files
spbsolublespbsoluble
committed
docs: organize certificate store use cases
1 parent ecb60cb commit 4b6a2c5

6 files changed

Lines changed: 170 additions & 4 deletions

File tree

‎README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,8 @@ kfutil logout
229229

230230
#### Bulk create cert stores
231231

232-
For full documentation, see [stores import](docs/kfutil_stores_import.md).
232+
For command documentation, see [stores import](docs/kfutil_stores_import.md). For a task-oriented walkthrough, see
233+
[Bulk Certificate Store Creation](docs/use-cases/Certificate%20Store%20Operations/bulk-certificate-store-creation.md).
233234

234235
This will attempt to process a CSV input file of certificate stores to create. The template can be generated by
235236
running: `kfutil stores import generate-template` command.
@@ -257,7 +258,7 @@ Use "kfutil stores import [command] --help" for more information about a command
257258

258259
#### Bulk update cert stores
259260

260-
For a task-oriented walkthrough, see [Bulk Certificate Store Updates](docs/use-cases/bulk-certificate-store-updates.md).
261+
For a task-oriented walkthrough, see [Bulk Certificate Store Updates](docs/use-cases/Certificate%20Store%20Operations/bulk-certificate-store-updates.md).
261262

262263
Bulk updates use the CSV import command with `--sync`. Export the target stores, edit the exported CSV, preserve the
263264
`Id` column, then sync the changes back to Keyfactor Command.

‎docs/use-cases/Certificate Store Operations/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Certificate Store Operations
2+
3+
Use cases for bulk certificate store workflows.
4+
5+
- [Bulk Certificate Store Creation](bulk-certificate-store-creation.md)
6+
- [Bulk Certificate Store Updates](bulk-certificate-store-updates.md)
7+
- [Migrate Static Store Credentials To A PAM Provider](migrate-static-store-credentials-to-pam.md)

‎docs/use-cases/Certificate Store Operations/bulk-certificate-store-creation.md‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
# Bulk Certificate Store Creation
2+
3+
Use this workflow when you need to create many certificate stores of the same type from a CSV file.
4+
5+
This example creates ten Kubernetes certificate stores:
6+
7+
- Five `K8SSecret` stores.
8+
- Five `K8STLSSecr` stores.
9+
- Three stores of each type use static Keyfactor-encrypted credentials.
10+
- Two stores of each type use a PAM provider-backed `ServerPassword`.
11+
12+
## Contents
13+
14+
- [Before You Begin](#before-you-begin)
15+
- [Step 1: Choose The Store Types](#step-1-choose-the-store-types)
16+
- [Step 2: Prepare Static Credential Rows](#step-2-prepare-static-credential-rows)
17+
- [Step 3: Prepare PAM Provider Rows](#step-3-prepare-pam-provider-rows)
18+
- [Step 4: Create K8SSecret Stores](#step-4-create-k8ssecret-stores)
19+
- [Step 5: Create K8STLSSecr Stores](#step-5-create-k8stlssecr-stores)
20+
- [Step 6: Verify The Created Stores](#step-6-verify-the-created-stores)
21+
- [Notes](#notes)
22+
- [Related Commands](#related-commands)
23+
24+
## Before You Begin
25+
26+
You need:
27+
28+
- `kfutil` configured to authenticate to Keyfactor Command.
29+
- Permission to create certificate stores.
30+
- The target certificate store types already created in Command.
31+
- A registered orchestrator agent ID.
32+
- Static credential values or a configured PAM provider.
33+
34+
For Kubernetes stores, `ClientMachine` should match the orchestrator target expected by the extension, and `StorePath` should identify the Kubernetes namespace and secret name.
35+
36+
## Step 1: Choose The Store Types
37+
38+
This demo uses:
39+
40+
```text
41+
K8SSecret
42+
K8STLSSecr
43+
```
44+
45+
Each type gets its own CSV because `kfutil stores import csv` accepts one store type per command.
46+
47+
## Step 2: Prepare Static Credential Rows
48+
49+
Static credential rows use direct credential columns:
50+
51+
```text
52+
Properties.ServerUsername
53+
Properties.ServerPassword
54+
```
55+
56+
Example `K8SSecret` static row:
57+
58+
```csv
59+
ContainerId,ClientMachine,StorePath,CreateIfMissing,Properties.KubeSecretName,Properties.KubeSecretType,Properties.IncludeCertChain,Properties.SeparateChain,Properties.ServerUseSsl,AgentId,Properties.ServerUsername,Properties.ServerPassword
60+
0,kf-integrations,default/kfutil-demo-k8ssecret-1,true,kfutil-demo-k8ssecret-1,secret,true,true,true,275bcd31-9e7b-4c4a-bce9-1719e0c2168d,kubeconfig,"<kubeconfig-json>"
61+
```
62+
63+
If the credential value is JSON, keep it as a CSV string. `kfutil` treats credential fields as secret strings even when the cell value looks like JSON.
64+
65+
## Step 3: Prepare PAM Provider Rows
66+
67+
PAM-backed rows use provider columns instead of a direct `Properties.ServerPassword` value:
68+
69+
```text
70+
Properties.ServerPassword.Provider
71+
Properties.ServerPassword.Parameters.SecretName
72+
Properties.ServerPassword.Parameters.SecretType
73+
Properties.ServerPassword.Parameters.StaticSecretFieldName
74+
```
75+
76+
Example `K8SSecret` PAM row:
77+
78+
```csv
79+
ContainerId,ClientMachine,StorePath,CreateIfMissing,Properties.KubeSecretName,Properties.KubeSecretType,Properties.IncludeCertChain,Properties.SeparateChain,Properties.ServerUseSsl,AgentId,Properties.ServerUsername,Properties.ServerPassword.Provider,Properties.ServerPassword.Parameters.SecretName,Properties.ServerPassword.Parameters.SecretType,Properties.ServerPassword.Parameters.StaticSecretFieldName
80+
0,kf-integrations,default/kfutil-demo-k8ssecret-4,true,kfutil-demo-k8ssecret-4,secret,true,true,true,275bcd31-9e7b-4c4a-bce9-1719e0c2168d,kubeconfig,30,dev/aks/kf-integrations,static_json," "
81+
```
82+
83+
The provider ID and parameter names depend on your PAM provider type.
84+
85+
## Step 4: Create K8SSecret Stores
86+
87+
Create a CSV named `k8ssecret_bulk_create.csv` with five rows:
88+
89+
- Rows 1-3 use `Properties.ServerPassword`.
90+
- Rows 4-5 use `Properties.ServerPassword.Provider` and `Properties.ServerPassword.Parameters.*`.
91+
92+
Run:
93+
94+
```bash
95+
kfutil stores import csv \
96+
--file k8ssecret_bulk_create.csv \
97+
--store-type-name K8SSecret \
98+
--no-prompt \
99+
--results-path k8ssecret_bulk_create_results.csv
100+
```
101+
102+
Expected output:
103+
104+
```text
105+
5 records processed.
106+
5 certificate stores successfully created.
107+
Import results written to k8ssecret_bulk_create_results.csv
108+
```
109+
110+
## Step 5: Create K8STLSSecr Stores
111+
112+
Create a CSV named `k8stlssecr_bulk_create.csv` with five rows. Use the same credential pattern, but set the Kubernetes secret type values for TLS secret stores.
113+
114+
Run:
115+
116+
```bash
117+
kfutil stores import csv \
118+
--file k8stlssecr_bulk_create.csv \
119+
--store-type-name K8STLSSecr \
120+
--no-prompt \
121+
--results-path k8stlssecr_bulk_create_results.csv
122+
```
123+
124+
Expected output:
125+
126+
```text
127+
5 records processed.
128+
5 certificate stores successfully created.
129+
Import results written to k8stlssecr_bulk_create_results.csv
130+
```
131+
132+
## Step 6: Verify The Created Stores
133+
134+
Export each store type:
135+
136+
```bash
137+
kfutil stores export --store-type-name K8SSecret
138+
kfutil stores export --store-type-name K8STLSSecr
139+
```
140+
141+
Verify that the five new rows for each store type are present.
142+
143+
For the static rows, confirm that `Properties.ServerPassword.SecretValue` is present in the export.
144+
145+
For the PAM-backed rows, confirm that `Properties.ServerPassword.Provider` and the expected `Properties.ServerPassword.Parameters.*` columns are present.
146+
147+
## Notes
148+
149+
- Use unique `StorePath` and `Properties.KubeSecretName` values for each row.
150+
- Keep one CSV per store type.
151+
- Check the `Errors` column in the results CSV after every import.
152+
- CSV files may contain sensitive credentials. Protect the input and results files according to your operating procedures.
153+
154+
## Related Commands
155+
156+
- [kfutil stores import csv](../../kfutil_stores_import_csv.md)
157+
- [kfutil stores import generate-template](../../kfutil_stores_import_generate-template.md)
158+
- [kfutil stores export](../../kfutil_stores_export.md)
159+
- [Bulk Certificate Store Updates](bulk-certificate-store-updates.md)

docs/use-cases/bulk-certificate-store-updates.md renamed to docs/use-cases/Certificate Store Operations/bulk-certificate-store-updates.md

File renamed without changes.

docs/use-cases/migrate-static-store-credentials-to-pam.md renamed to docs/use-cases/Certificate Store Operations/migrate-static-store-credentials-to-pam.md

File renamed without changes.

‎docs/use-cases/README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,4 @@
22

33
Task-oriented guides for common `kfutil` workflows.
44

5-
- [Bulk Certificate Store Updates](bulk-certificate-store-updates.md)
6-
- [Migrate Static Store Credentials To A PAM Provider](migrate-static-store-credentials-to-pam.md)
5+
- [Certificate Store Operations](Certificate%20Store%20Operations/README.md)

0 commit comments

Comments
 (0)