{"id":16861365,"url":"https://github.com/sgtcodfish/rotate-roots","last_synced_at":"2025-03-18T19:48:59.260Z","repository":{"id":174034198,"uuid":"619977604","full_name":"SgtCoDFish/rotate-roots","owner":"SgtCoDFish","description":"Sister repo for my talk at KubeCon EU 2023","archived":false,"fork":false,"pushed_at":"2024-06-24T08:50:55.000Z","size":22,"stargazers_count":7,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-24T22:28:42.653Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SgtCoDFish.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-03-27T19:39:18.000Z","updated_at":"2025-01-14T21:57:09.000Z","dependencies_parsed_at":null,"dependency_job_id":"fa144bd1-188b-4c3f-b670-68431ba3fcc5","html_url":"https://github.com/SgtCoDFish/rotate-roots","commit_stats":{"total_commits":10,"total_committers":4,"mean_commits":2.5,"dds":0.4,"last_synced_commit":"f3cfe015c1740e2ecc1956c22813bb9a05ca4d04"},"previous_names":["sgtcodfish/rotate-roots"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SgtCoDFish%2Frotate-roots","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SgtCoDFish%2Frotate-roots/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SgtCoDFish%2Frotate-roots/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SgtCoDFish%2Frotate-roots/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SgtCoDFish","download_url":"https://codeload.github.com/SgtCoDFish/rotate-roots/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244294916,"owners_count":20430063,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T14:31:39.812Z","updated_at":"2025-03-18T19:48:59.228Z","avatar_url":"https://github.com/SgtCoDFish.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Rotate Roots Right Round\n\nThis repo is a companion to my KubeCon EU 2023 talk, [🎥 Rotate Roots Right Round: Using cert-manager for Safer Private PKI](https://youtu.be/uvL7SHhVKUY?feature=shared).\n\nIt provides example configuration and steps for setting up private PKI in Kubernetes using:\n\n1. cert-manager (of course!)\n2. [approver-policy](https://cert-manager.io/docs/projects/approver-policy/)\n3. and [trust-manager](https://cert-manager.io/docs/projects/trust-manager/)\n\nSubfolders are numbered in order; follow them in numerical order.\n\nUsing this repo, along with the talk, you should be able to safely set up a private PKI that's free of cost, free of rate limits and which gives you complete control!\n\n## Prerequisites\n\nOn your development machine, you'll need to have installed [cmctl](https://cert-manager.io/docs/reference/cmctl/).\n\nYou'll also need a Kubernetes cluster running up-to-date versions of the following:\n\n- cert-manager (with default approver disabled)\n- approver-policy\n- trust-manager\n\n⚠️ An existing cert-manager installation might not work for approver-policy; see [the docs](https://cert-manager.io/docs/projects/approver-policy/)\nfor details on how to install properly. Alternatively, the instructions below should work!\n\nNote that trust-manager's Helm chart includes a Certificate which you'll need to approve manually.\n\nInstallation instructions are given below as a guide, using either [kind](https://kind.sigs.k8s.io/) or whatever cluster you have configured.\n\n```bash\n# if you already have a cluster, skip this step\nkind create cluster --name ap\n\n# install cert-manager with approver disabled\nhelm upgrade -i -n cert-manager cert-manager jetstack/cert-manager --set extraArgs={--controllers='*\\,-certificaterequests-approver'} --set installCRDs=true --create-namespace\n\n# install approver-policy\nhelm upgrade -i -n cert-manager cert-manager-approver-policy jetstack/cert-manager-approver-policy --wait\n\n# install trust-manager; this might appear to hang because it'll be waiting for the certificate to be issued.\n# if it hangs, use the command below to approve the CertificateRequest!\nhelm upgrade -i -n cert-manager trust-manager jetstack/trust-manager --wait\n\n# approve trust-manager CertificateRequest (this actually approves all certs in the cert-manager namespace; you might want to be more careful in prod)\nkubectl get -n cert-manager cr -o go-template=\"{{range .items}}{{printf \\\"%s\\n\\\" .metadata.name}}{{end}}\" | xargs -I% cmctl approve -n cert-manager %\n```\n\n### Links\n\n[Session description on Sched](https://kccnceu2023.sched.com/event/1HyZ6).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsgtcodfish%2Frotate-roots","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsgtcodfish%2Frotate-roots","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsgtcodfish%2Frotate-roots/lists"}