Dustin C. Hatch
0a9596d8bd
[Step CA] is an open-source online X.509 and SSH certificate authority service. It supports issuing certificates via various protocols, including ACME and its own HTTP API via the `step` command-line utility. Clients can authenticate using a variety of methods, such as JWK, Open ID Connect, or mTLS. This makes it very flexible and easy to introduce to an existing ecosystem. Although the CA service is mostly stateless, it does have an on-disk database where stores some information, notably the list of SSH hosts for which it has signed certificates. Most other operations, though, do not require any persistent state; the service does not keep track of every single certificate it signed, for example. It can be configured to store authentication information (referred to as "provisioners") in the database instead of the configuration file, by enabling the "remote provisioner management" feature. This has the advantage of being able to modify authentication configuration without updating a Kubernetes ConfigMap and restarting the service. The official Step CA documentation recommends using the `step ca init` command initialize a new certificate authority. This command performs a few steps: * Generates an ECDSA key pair and uses it to create a self-signed root certificate * Generates a second ECDSA key pair and signs an intermediate CA certificate using the root CA key * Generates an ECDSA key pair and SSH root certificate * Creates a `ca.json` configuration file These steps can be performed separately, and in fact, I created the intermediate CA certificate and signed it with the (offline) *dch Root CA* certificate. When the service starts for the first time, because `authority/enableAdmin` is `true` and `authority/provisioners` is empty, a new "Admin JWK" provisioner will be created automatically. This key will be encrypted with the same password used to encrypt the intermediate CA certificate private key, and can be used to create other provisioners. [Step CA]: https://smallstep.com/docs/step-ca/
129 lines
2.9 KiB
YAML
129 lines
2.9 KiB
YAML
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: step-ca
|
|
namespace: step-ca
|
|
labels:
|
|
app.kubernetes.io/name: step-ca
|
|
app.kubernetes.io/component: step-ca
|
|
app.kubernetes.io/instance: step-ca
|
|
app.kubernetes.io/part-of: step-ca
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: step-ca
|
|
namespace: step-ca
|
|
labels:
|
|
app.kubernetes.io/name: step-ca
|
|
app.kubernetes.io/component: step-ca
|
|
app.kubernetes.io/instance: step-ca
|
|
app.kubernetes.io/part-of: step-ca
|
|
spec:
|
|
ports:
|
|
- port: 32599
|
|
nodePort: 32599
|
|
name: step-ca
|
|
selector:
|
|
app.kubernetes.io/name: step-ca
|
|
app.kubernetes.io/component: step-ca
|
|
app.kubernetes.io/instance: step-ca
|
|
type: NodePort
|
|
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: step-ca
|
|
namespace: step-ca
|
|
labels:
|
|
app.kubernetes.io/name: step-ca
|
|
app.kubernetes.io/component: step-ca
|
|
app.kubernetes.io/instance: step-ca
|
|
app.kubernetes.io/part-of: step-ca
|
|
spec:
|
|
serviceName: step-ca
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: step-ca
|
|
app.kubernetes.io/component: step-ca
|
|
app.kubernetes.io/instance: step-ca
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: step-ca
|
|
app.kubernetes.io/component: step-ca
|
|
app.kubernetes.io/instance: step-ca
|
|
spec:
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: step-ca
|
|
image: docker.io/smallstep/step-ca:0.25.0
|
|
workingDir: /step
|
|
env:
|
|
- name: CONFIGPATH
|
|
value: /step/config/ca.json
|
|
- name: PWDPATH
|
|
value: /step/secrets/password
|
|
- name: STEPPATH
|
|
value: /step
|
|
ports:
|
|
- containerPort: 32599
|
|
name: step-ca
|
|
readinessProbe: &probe
|
|
httpGet:
|
|
port: 32599
|
|
path: /health
|
|
scheme: HTTPS
|
|
failureThreshold: 3
|
|
periodSeconds: 60
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
startupProbe:
|
|
<<: *probe
|
|
failureThreshold: 30
|
|
periodSeconds: 3
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
volumeMounts:
|
|
- mountPath: /step/certs
|
|
name: certs
|
|
readOnly: true
|
|
- mountPath: /step/config
|
|
name: config
|
|
readOnly: true
|
|
- mountPath: /step/db
|
|
name: data
|
|
subPath: db
|
|
- mountPath: /step/secrets
|
|
name: secrets
|
|
readOnly: true
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: step-ca-config
|
|
- name: certs
|
|
configMap:
|
|
name: step-ca-certs
|
|
- name: secrets
|
|
secret:
|
|
secretName: step-ca
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: step-ca
|
|
|
|
|