mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Revise pki k8s docs
This commit is contained in:
Tuan Dang
@@ -5,7 +5,7 @@ sidebarTitle: "ACME"
|
||||
|
||||
## Concept
|
||||
|
||||
The ACME enrollment method allows you to issue and manage certificates against a specific [certificate profile](/documentation/platform/pki/certificates/profiles) using the [ACME protocol](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment).
|
||||
The ACME enrollment method allows Infisical to act as an ACME server. It lets you request and manage certificates against a specific [certificate profile](/documentation/platform/pki/certificates/profiles) using the [ACME protocol](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment).
|
||||
This method is suitable for web servers, load balancers, and other general-purpose servers that can run an [ACME client](https://letsencrypt.org/docs/client-options/) for automated certificate management.
|
||||
|
||||
Infisical's ACME enrollment method is based on [RFC 8555](https://datatracker.ietf.org/doc/html/rfc8555/).
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
title: "Apache Server"
|
||||
description: "Learn how to issue SSL/TLS certificates from Infisical using ACME enrollment on Apache Server with Certbot"
|
||||
description: "Learn how to issue TLS certificates from Infisical using ACME enrollment on Apache Server with Certbot"
|
||||
---
|
||||
|
||||
This guide demonstrates how to use Infisical to issue SSL/TLS certificates for your [Apache HTTP Server](https://httpd.apache.org/).
|
||||
This guide demonstrates how to use Infisical to issue TLS certificates for your [Apache HTTP Server](https://httpd.apache.org/).
|
||||
|
||||
It uses [Certbot](https://certbot.eff.org/), an installable [ACME](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment) client, to request and renew certificates from Infisical using the [ACME enrollment method](/documentation/platform/pki/enrollment-methods/acme) configured on a [certificate profile](/documentation/platform/pki/certificates/profiles). Apache benefits from excellent Certbot integration, allowing both certificate-only mode and automatic SSL configuration.
|
||||
|
||||
@@ -182,4 +182,5 @@ Before you begin, make sure you have:
|
||||
</Note>
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Steps>
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
---
|
||||
title: "Gloo Mesh"
|
||||
description: "Learn how to automatically provision and manage Istio intermediate CA certificates for Gloo Mesh using Infisical PKI"
|
||||
description: "Learn how to automatically provision and manage Istio intermediate CA certificates for Gloo Mesh using Infisical"
|
||||
---
|
||||
|
||||
This guide will provide a high level overview on how you can use Infisical PKI and cert-manager to issue Istio intermediate CA certificates for your Gloo Mesh workload clusters. For more background about Istio certificates, see the [Istio CA overview](https://istio.io/latest/docs/concepts/security/#pki).
|
||||
This guide will provide a high level overview on how you can use Infisical and [cert-manager](https://cert-manager.io/) to issue Istio intermediate CA certificates for your Gloo Mesh workload clusters. For more background about Istio certificates, see the [Istio CA overview](https://istio.io/latest/docs/concepts/security/#pki).
|
||||
|
||||
## Overview
|
||||
|
||||
In this setup, we will use Infisical PKI to generate and store your root CA and subordinate CAs that are used to generate Istio intermediate CAs for your Gloo Mesh workload clusters.
|
||||
In this setup, we will use Infisical to generate and store your root CA and subordinate CAs that are used to generate Istio intermediate CAs for your Gloo Mesh workload clusters.
|
||||
To manage the lifecycle of Istio intermediate CA certificates, you'll also install [cert-manager](https://cert-manager.io/).
|
||||
Cert-manager is a Kubernetes controller that helps you automate the process of obtaining and renewing certificates from various PKI providers.
|
||||
|
||||
@@ -21,19 +21,19 @@ With this approach, you get the following benefits:
|
||||
## General Setup
|
||||
|
||||
The certificate provisioning workflow begins with setting up your PKI hierarchy in Infisical, where you create root and subordinate certificate authorities.
|
||||
When you deploy a `Certificate` CRD in your workload cluster, `cert-manager` uses the Infisical PKI ACME server to authenticate with Infisical using EAB credentials and request an intermediate CA certificate.
|
||||
When you deploy a `Certificate` CRD in your workload cluster, `cert-manager` uses the [ACME enrollment method](/documentation/platform/pki/enrollment-methods/acme) configured on a [certificate profile](/documentation/platform/pki/certificates/profiles) to authenticate using EAB credentials and request an intermediate CA certificate.
|
||||
Infisical verifies the request against your certificate templates and returns the signed certificate.
|
||||
From there, Istio's control plane will automatically use this intermediate CA to sign leaf certificates for workloads in the service mesh, enabling secure mTLS communication across your entire Gloo Mesh infrastructure.
|
||||
|
||||
Follow the [Kubernetes cert-manager guide](/documentation/platform/pki/k8s-cert-manager) for detailed instructions on how to set up the Infisical PKI ACME certificate profile and cert-manager for your Istio intermediate CA certificates in Gloo Mesh clusters.
|
||||
Follow the [Kubernetes cert-manager guide](/documentation/platform/pki/k8s-cert-manager) for detailed instructions on how to set up the Infisical and cert-manager for your Istio intermediate CA certificates in Gloo Mesh clusters.
|
||||
|
||||
For Gloo Mesh-specific configuration, ensure that:
|
||||
|
||||
- The Certificate resource targets the `istio-system` namespace with `secretName: cacerts`
|
||||
- Certificate templates in Infisical PKI are configured for intermediate CA usage with appropriate key usage and constraints
|
||||
- Multiple workload clusters use the same Infisical PKI root to enable cross-cluster mTLS communication
|
||||
- Certificate profiles in Infisical are configured for intermediate CA usage with appropriate key usage and constraints
|
||||
- Multiple workload clusters use the same Infisical root to enable cross-cluster mTLS communication
|
||||
|
||||
## Using the certificates
|
||||
|
||||
Once the `cacerts` Kubernetes secret is created in the `istio-system` namespace, Istio automatically uses the custom CA certificate instead of the default self-signed certificate.
|
||||
When you deploy applications to your Gloo Mesh service mesh, the workloads will receive leaf certificates signed by your Infisical PKI intermediate CA, enabling secure mTLS communication across your entire mesh infrastructure.
|
||||
When you deploy applications to your Gloo Mesh service mesh, the workloads will receive leaf certificates signed by your Infisical intermediate CA, enabling secure mTLS communication across your entire mesh infrastructure.
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
title: "JBoss/WildFly"
|
||||
description: "Learn how to issue SSL/TLS certificates from Infisical using ACME enrollment on JBoss/WildFly with Certbot"
|
||||
description: "Learn how to issue TLS certificates from Infisical using ACME enrollment on JBoss/WildFly with Certbot"
|
||||
---
|
||||
|
||||
This guide demonstrates how to use Infisical to issue SSL/TLS certificates for your [JBoss](https://www.jboss.org/)/[WildFly](https://wildfly.org/) application server.
|
||||
This guide demonstrates how to use Infisical to issue TLS certificates for your [JBoss](https://www.jboss.org/)/[WildFly](https://wildfly.org/) application server.
|
||||
|
||||
It uses [Certbot](https://certbot.eff.org/), an installable [ACME](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment) client, to request and renew certificates from Infisical using the [ACME enrollment method](/documentation/platform/pki/enrollment-methods/acme) configured on a [certificate profile](/documentation/platform/pki/certificates/profiles). JBoss/WildFly requires certificates in Java keystore format, which this guide addresses through the certificate conversion process.
|
||||
|
||||
@@ -223,4 +223,5 @@ Before you begin, make sure you have:
|
||||
Certbot automatically renews certificates when they are within 30 days of expiration using its built-in systemd timer. The deploy hook above will run after each successful renewal, handling the keystore conversion and service restart automatically. Because JBoss/WildFly requires the standalone authenticator (which stops the service temporarily), plan for brief service interruptions during renewal.
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Steps>
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
title: "Nginx"
|
||||
description: "Learn how to issue SSL/TLS certificates from Infisical using ACME enrollment on Nginx with Certbot"
|
||||
description: "Learn how to issue TLS certificates from Infisical using ACME enrollment on Nginx with Certbot"
|
||||
---
|
||||
|
||||
This guide demonstrates how to use Infisical to issue SSL/TLS certificates for your [Nginx](https://nginx.org/) server.
|
||||
This guide demonstrates how to use Infisical to issue TLS certificates for your [Nginx](https://nginx.org/) server.
|
||||
|
||||
It uses [Certbot](https://certbot.eff.org/), an installable [ACME](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment) client, to request and renew certificates from Infisical using the [ACME enrollment method](/documentation/platform/pki/enrollment-methods/acme) configured on a [certificate profile](/documentation/platform/pki/certificates/profiles).
|
||||
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
title: "Tomcat"
|
||||
description: "Learn how to issue SSL/TLS certificates from Infisical using ACME enrollment on Tomcat with Certbot"
|
||||
description: "Learn how to issue TLS certificates from Infisical using ACME enrollment on Tomcat with Certbot"
|
||||
---
|
||||
|
||||
This guide demonstrates how to use Infisical to issue SSL/TLS certificates for your [Apache Tomcat](https://tomcat.apache.org/) application server.
|
||||
This guide demonstrates how to use Infisical to issue TLS certificates for your [Apache Tomcat](https://tomcat.apache.org/) application server.
|
||||
|
||||
It uses [Certbot](https://certbot.eff.org/), an installable [ACME](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment) client, to request and renew certificates from Infisical using the [ACME enrollment method](/documentation/platform/pki/enrollment-methods/acme) configured on a [certificate profile](/documentation/platform/pki/certificates/profiles). Unlike web servers with native Certbot plugins, Tomcat requires certificates to be manually configured after issuance.
|
||||
|
||||
@@ -248,4 +248,5 @@ Before you begin, make sure you have:
|
||||
Since Tomcat reads certificates from the file system on startup, you only need to restart the service after certificate renewal. The certificate file paths in `/etc/letsencrypt/live/` are symbolic links that automatically point to the latest certificates.
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Steps>
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
title: "Windows Server"
|
||||
description: "Learn how to issue SSL/TLS certificates from Infisical using ACME enrollment on Windows Server with win-acme"
|
||||
description: "Learn how to issue TLS certificates from Infisical using ACME enrollment on Windows Server with win-acme"
|
||||
---
|
||||
|
||||
This guide demonstrates how to use Infisical to issue SSL/TLS certificates for your [Windows Server](https://www.microsoft.com/en-us/windows-server) environments.
|
||||
This guide demonstrates how to use Infisical to issue TLS certificates for your [Windows Server](https://www.microsoft.com/en-us/windows-server) environments.
|
||||
|
||||
It uses [win-acme](https://www.win-acme.com/), a feature-rich [ACME](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment) client designed specifically for Windows, to request and renew certificates from Infisical using the [ACME enrollment method](/documentation/platform/pki/enrollment-methods/acme) configured on a [certificate profile](/documentation/platform/pki/certificates/profiles). Win-acme offers excellent integration with IIS, Windows Certificate Store, and various certificate storage options.
|
||||
|
||||
@@ -191,4 +191,5 @@ Before you begin, make sure you have:
|
||||
</Tab>
|
||||
</Tabs>
|
||||
</Step>
|
||||
|
||||
</Steps>
|
||||
|
||||
@@ -1,15 +1,16 @@
|
||||
---
|
||||
title: "Kubernetes cert-manager"
|
||||
description: "Learn how to automatically provision and manage TLS certificates in Kubernetes using Infisical PKI"
|
||||
description: "Learn how to automatically provision and manage TLS certificates in Kubernetes using Infisical"
|
||||
---
|
||||
|
||||
## Concept
|
||||
|
||||
The Infisical PKI provides [ACME (Automated Certificate Management Environment)](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment) integration, enabling various ACME clients to issue and renew certificates automatically.
|
||||
In Kubernetes environments, [cert-manager](https://cert-manager.io) is the most popular tool for issuing certificates via ACME.
|
||||
The issuer is perfect at obtaining X.509 certificates for Ingresses and other Kubernetes resources and can automatically renew them before expiration.
|
||||
This guide demonstrates how to use Infisical to issue TLS certificates back to your Kubernetes environment using [cert-manager](https://cert-manager.io/).
|
||||
|
||||
The typical workflow involves installing `cert-manager` and configuring resources that represent the connection details to your Infisical PKI as well as the certificates you want to issue.
|
||||
It uses the [ACME issuer type](https://cert-manager.io/docs/configuration/acme/) to request and renew certificates automatically from Infisical
|
||||
using the [ACME enrollment method](/documentation/platform/pki/enrollment-methods/acme) configured on a [certificate profile](/documentation/platform/pki/certificates/profiles). The issuer is perfect at obtaining X.509 certificates for Ingresses and other Kubernetes resources and can automatically renew them before expiration.
|
||||
|
||||
The typical workflow involves installing `cert-manager` and configuring resources that represent the connection details to Infisical as well as the certificates you want to issue.
|
||||
Each issued certificate and its corresponding private key are stored in a Kubernetes `Secret`.
|
||||
|
||||
We recommend reading the official [cert-manager documentation](https://cert-manager.io/docs/) for a complete overview.
|
||||
@@ -17,18 +18,18 @@ For the ACME-specific configuration, refer to the [ACME section](https://cert-ma
|
||||
|
||||
## Workflow
|
||||
|
||||
A typical workflow for using cert-manager with Infisical PKI via ACME consists of the following steps:
|
||||
A typical workflow for using cert-manager with Infisical via ACME consists of the following steps:
|
||||
|
||||
1. Create a certificate profile in Infisical with ACME as the enrollment method.
|
||||
1. Create a [certificate profile](/documentation/platform/pki/certificates/profiles) in Infisical with the [ACME enrollment method](/documentation/platform/pki/enrollment-methods/acme) configured on it.
|
||||
2. Install `cert-manager` in your Kubernetes cluster.
|
||||
3. Create a Kubernetes `Secret` containing the EAB (External Account Binding) credentials for the ACME certificate profile.
|
||||
4. Create an `Issuer` or `ClusterIssuer` resource that connects to the desired Infisical PKI certificate profile.
|
||||
4. Create an `Issuer` or `ClusterIssuer` resource that connects to the desired Infisical [certificate profile](/documentation/platform/pki/certificates/profiles).
|
||||
5. Create a `Certificate` resource defining the certificate you wish to issue and the target `Secret` where the certificate and private key will be stored.
|
||||
6. Use the resulting Kubernetes `Secret` in your Ingresses or other resources.
|
||||
|
||||
## Guide
|
||||
|
||||
The following steps show how to install cert-manager (using `kubectl`) and obtain certificates from Infisical PKI.
|
||||
The following steps show how to install cert-manager (using `kubectl`) and obtain certificates from Infisical.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create a certificate profile with ACME as the enrollment method in Infisical">
|
||||
@@ -43,7 +44,7 @@ The following steps show how to install cert-manager (using `kubectl`) and obtai
|
||||
These will be needed in later steps.
|
||||
|
||||
<Note>
|
||||
Currently, the Infisical PKI ACME server only supports authentication via dedicated EAB credentials generated per certificate profile.
|
||||
Currently, the Infisical ACME enrollment method only supports authentication via dedicated EAB credentials generated per certificate profile.
|
||||
|
||||
Support for [Kubernetes Auth](/documentation/platform/identities/kubernetes-auth) is planned for the near future.
|
||||
</Note>
|
||||
|
||||
Reference in New Issue
Block a user