{"id":13564203,"url":"https://github.com/smallstep/step-issuer","last_synced_at":"2026-04-02T00:26:36.427Z","repository":{"id":37078440,"uuid":"202023779","full_name":"smallstep/step-issuer","owner":"smallstep","description":"⚙️A certificate issuer for cert-manager using step certificates CA","archived":false,"fork":false,"pushed_at":"2026-03-18T00:39:45.000Z","size":1185,"stargazers_count":248,"open_issues_count":9,"forks_count":39,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-03-18T16:32:00.899Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/smallstep.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2019-08-12T23:21:40.000Z","updated_at":"2026-03-18T00:36:34.000Z","dependencies_parsed_at":"2023-11-06T13:27:23.887Z","dependency_job_id":"bc597b92-e5b8-4c18-9822-7ee7ee7c319b","html_url":"https://github.com/smallstep/step-issuer","commit_stats":{"total_commits":266,"total_committers":14,"mean_commits":19.0,"dds":0.5902255639097744,"last_synced_commit":"756f2f467dbb77a09c0a508850a5853cd6cda80e"},"previous_names":[],"tags_count":40,"template":false,"template_full_name":null,"purl":"pkg:github/smallstep/step-issuer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smallstep%2Fstep-issuer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smallstep%2Fstep-issuer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smallstep%2Fstep-issuer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smallstep%2Fstep-issuer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/smallstep","download_url":"https://codeload.github.com/smallstep/step-issuer/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smallstep%2Fstep-issuer/sbom","scorecard":{"id":343422,"data":{"date":"2025-08-11","repo":{"name":"github.com/smallstep/step-issuer","commit":"28c878cd9c830ae1d135729026ad33c9bc2020dd"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":7,"checks":[{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Code-Review","score":-1,"reason":"Found no human activity in the last 15 changesets","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Maintained","score":10,"reason":"18 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/ci.yml:22","Info: jobLevel 'contents' permission set to 'read': .github/workflows/ci.yml:23","Warn: jobLevel 'security-events' permission set to 'write': .github/workflows/ci.yml:24","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:56","Warn: topLevel 'contents' permission set to 'write': .github/workflows/actionlint.yml:11","Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Warn: no topLevel permission defined: .github/workflows/code-scan-cron.yml:1","Warn: topLevel 'contents' permission set to 'write': .github/workflows/dependabot-auto-merge.yml:5","Warn: no topLevel permission defined: .github/workflows/release.yml:1","Warn: no topLevel permission defined: .github/workflows/triage.yml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Pinned-Dependencies","score":1,"reason":"dependency not pinned by hash detected -- score normalized to 1","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/actionlint.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/smallstep/step-issuer/actionlint.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/smallstep/step-issuer/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/code-scan-cron.yml:7: update your workflow using https://app.stepsecurity.io/secureworkflow/smallstep/step-issuer/code-scan-cron.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/dependabot-auto-merge.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/smallstep/step-issuer/dependabot-auto-merge.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/smallstep/step-issuer/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/smallstep/step-issuer/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/triage.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/smallstep/step-issuer/triage.yml/master?enable=pin","Warn: containerImage not pinned by hash: docker/Dockerfile:3","Warn: containerImage not pinned by hash: docker/Dockerfile:12: pin your Docker image by updating alpine to alpine@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1","Info:   1 out of   8 third-party GitHubAction dependencies pinned","Info:   0 out of   2 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T06:31:18.210Z","repository_id":37078440,"created_at":"2025-08-18T06:31:18.210Z","updated_at":"2025-08-18T06:31:18.210Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31293376,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-01T21:15:39.731Z","status":"ssl_error","status_checked_at":"2026-04-01T21:15:34.046Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T13:01:27.943Z","updated_at":"2026-04-02T00:26:36.384Z","avatar_url":"https://github.com/smallstep.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# Step Issuer\n\nStep Issuer is a [Kubernetes](https://kubernetes.io/) [`cert-manager`](https://cert-manager.io) [`CertificateRequest`](https://cert-manager.io/docs/concepts/certificaterequest/) controller\nthat uses the [`step-ca`](https://github.com/smallstep/certificates) online Certificate Authority (CA) to sign certificate requests.\nIt's perfect for getting certificates for ingresses\nand other Kubernetes resources\nfrom an internal CA\ninstead of Let's Encrypt or another public CA.\n\n## Installation\n\n### Before you begin\n\nIn this guide, we assume that you have a Kubernetes environment\nwith `cert-manager` v1.0.0 or higher installed.\n\n### Overview\n\nThe general install process is:\n* Install `step-ca`\n* Install `step-issuer`\n* Generate and install `step-issuer` configuration\n* Create your first certificate!\n\n### 1. Install `step-ca`\n\nStep Issuer uses [`step-ca`](https://github.com/smallstep/certificates) as its backing Certificate Authority (CA) for signing `CertificateRequest` resources.\n\n#### Install `step-ca` via Helm \n\nThe easiest way to install `step-ca` in Kubernetes is via [Helm](https://helm.sh/).\n\n```sh\nhelm repo add smallstep  https://smallstep.github.io/helm-charts\nhelm repo update\nhelm install step-certificates smallstep/step-certificates\n```\n\n#### Install `step-ca` another way\n\nAlternatively, you can [install a `step-ca` server](https://smallstep.com/docs/step-ca/installation) that resides outside of Kubernetes,\nor use a [Certificate Manager](https://smallstep.com/certificate-manager/) cloud CA.\n\n### 2. Install `step-issuer`\n\nFinally, we need to install `step-issuer`.\nThe easiest way to install it is via Helm:\n\n```sh\nhelm install step-issuer smallstep/step-issuer\n```\n\n**Alternatively, see [Installing from Source](#installing-from-source), below.**\n\n### 3. Configure `step-issuer`\n\nTo connect `step-issuer` to our Certificate Authority,\nwe will need the following configuration information from our CA:\n\n* **The CA's URL**\n  When `step-ca` is installed via Helm, the default CA URL is:\n\n  ```sh\n  $ CA_URL=https://step-certificates.default.svc.cluster.local\n  ```\n\n* **The CA's root certificate**\n    The root certificate can be obtained from the `step-certificates-certs`\n    `ConfigMap`.\n\n    To retrieve it, run:\n\n    ```sh\n    $ kubectl get -o jsonpath=\"{.data['root_ca\\.crt']}\" configmaps/step-certificates-certs\n    -----BEGIN CERTIFICATE-----\n    MIIBizCCATGgAwIBAgIQO+EAh8y/0V9P0XpHrVj5NTAKBggqhkjOPQQDAjAkMSIw\n    IAYDVQQDExlTdGVwIENlcnRpZmljYXRlcyBSb290IENBMB4XDTE5MDgxMzE5MTUw\n    MloXDTI5MDgxMDE5MTUwMlowJDEiMCAGA1UEAxMZU3RlcCBDZXJ0aWZpY2F0ZXMg\n    Um9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAMVL7W0Pm3oJUfI4wXd\n    klDEnn5XSmj86X0amCA0gcO1tITPmCW3Bpe4pOoWUvZVeQdoScq7znkUt2/G2t1N\n    71ijRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1Ud\n    DgQWBBRucPrVnPvZN0r4AU9Lg2/eBrx7kjAKBggqhkjOPQQDAgNIADBFAiBRRAtk\n    5zLcGhCahmPnW20dLitC3EWMiQ4lDp7aEz+EPAIhAI9fVs5qoItmT8jp6ZKU5Q2u\n    aDPk8k2CnN27rFsYWupL\n    -----END CERTIFICATE-----\n    ```\n\n    For `step-issuer`, we will Base64-encode this PEM block:\n\n    ```sh\n    $ CA_ROOT_B64=$(kubectl get -o jsonpath=\"{.data['root_ca\\.crt']}\" configmaps/step-certificates-certs | step base64)\n    $ echo $CA_ROOT_B64\n    LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRHZ0F3SUJBZ0lRTytFQWg4eS8wVjlQMFhwSHJWajVOVEFLQmdncWhrak9QUVFEQWpBa01TSXcKSUFZRFZRUURFeGxUZEdWd0lFTmxjblJwWm1sallYUmxjeUJTYjI5MElFTkJNQjRYRFRFNU1EZ3hNekU1TVRVdwpNbG9YRFRJNU1EZ3hNREU1TVRVd01sb3dKREVpTUNBR0ExVUVBeE1aVTNSbGNDQkRaWEowYVdacFkyRjBaWE1nClVtOXZkQ0JEUVRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkFNVkw3VzBQbTNvSlVmSTR3WGQKa2xERW5uNVhTbWo4NlgwYW1DQTBnY08xdElUUG1DVzNCcGU0cE9vV1V2WlZlUWRvU2NxN3pua1V0Mi9HMnQxTgo3MWlqUlRCRE1BNEdBMVVkRHdFQi93UUVBd0lCQmpBU0JnTlZIUk1CQWY4RUNEQUdBUUgvQWdFQk1CMEdBMVVkCkRnUVdCQlJ1Y1ByVm5QdlpOMHI0QVU5TGcyL2VCcng3a2pBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCUlJBdGsKNXpMY0doQ2FobVBuVzIwZExpdEMzRVdNaVE0bERwN2FFeitFUEFJaEFJOWZWczVxb0l0bVQ4anA2WktVNVEydQphRFBrOGsyQ25OMjdyRnNZV3VwTAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n    ```\n\n* **CA credentials that `cert-manager` will use**\n  CA credentials include an admin provisioner name, key id (`kid`), and a secret containing the provisioner password.\n\n   The default Helm installation will configure one provisioner named `admin`:\n\n  ```sh\n  $ kubectl get -o jsonpath=\"{.data['ca\\.json']}\" configmaps/step-certificates-config | jq .authority.provisioners[0]\n  {\n    \"type\": \"JWK\",\n    \"name\": \"admin\",\n    \"key\": {\n      \"use\": \"sig\",\n      \"kty\": \"EC\",\n      \"kid\": \"MXxpNphrheA80gO5uUbGZ7_RdaXU8KrmKT0fVL181L8\",\n      \"crv\": \"P-256\",\n      \"alg\": \"ES256\",\n      \"x\": \"Pi8WGmlN7zduPRhom9pYeVd48n_Pby3GopsEdkDPVdA\",\n      \"y\": \"dvPWbf-CofXpBSW4uzEOPU5mEqfzi0QSjmLBnYc7nnA\"\n    },\n    \"encryptedKey\": \"eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjEwMDAwMCwicDJzIjoiUGpxRU1QZlJsOFU4X1dZQVFUZ1lKUSJ9.pawzDHDIr9Dmd49YYNkdSr5Ndl5EjKd1Q4Ac0O3S0dP0FDTRzn4gWA.aJmiBLNy-fEXKZDs.RZ2sob5zJ7oIUq02Btlb91M6w9P3Vr0yTVpp6CfvPRt9raieO4NmUOlGBB4Kg6_o2fYZxZFHFg9NqjfRzXusFpJVe1kF0qmVFAqhaT97_89nuncSMp9Guj-7e-hyrxp3WwIz6IDF1cqMtKIq3exWZJlqTPNtcjdPOT02qKzb3Msqp1ruifG6WrRNv34knCylq5H2bf5fOCaL_KIxWUQ-nE3KJoIqe-EgaigZtvBWdg-xO8M7SKYDsla4g1Gb0Vd23hBJl9Qg3UjlirmVqBY90dQF-cejF0JeCwQoiflqhN6c6kNjriZF4qNTkhWNnQOEhtiZQSdOoP9b9Ai6En4._QRZxj3vaGk2mJ3K2Oflog\"\n  }\n  ```\n\n   We recommend adding a separate provisioner for `cert-manager`,\n   but for this guide we will use the default one.\n   \n   The provisioner kid can be obtained from the `step-certificates-config`\n`ConfigMap`, or running:\n   \n  ```sh\n  $ CA_PROVISIONER_NAME=admin\n  $ CA_PROVISIONER_KID=$(kubectl get -o jsonpath=\"{.data['ca\\.json']}\" configmaps/step-certificates-config | jq -r .authority.provisioners[0].key.kid)\n  $ echo $CA_PROVISIONER_KID\n  MXxpNphrheA80gO5uUbGZ7_RdaXU8KrmKT0fVL181L8\n  ```\n\n  Fianlly, we need the password to decrypt the provisioner private key, this is\n  available in the secret `step-certificates-provisioner-password`.\n  Here's what it looks like:\n\n  ```sh\n  $ kubectl get -o jsonpath='{.data.password}' secret/step-certificates-provisioner-password | base64 --decode\n  MfKmjQrR1iw3ZvTd4CImQfhwIbdq2FRp\n  ```\n\n  We won't use the plain password to configure `step-issuer`, we will be\n  referencing the same secret.\n\nTo recap, we got:\n\n* The CA url `https://step-certificates.default.svc.cluster.local`\n* The root CA certificate PEM, base64-encoded\n* The provisioner name `admin`\n* The provisioner `kid` value\n* And the provisioner password secret `step-certificates-provisioner-password`\n  and key `password`\n\nNow let's generate the `StepIssuer` resource.\n\n```sh\n$ cat \u003c\u003cEOF \u003e step-issuer.yaml\n---\napiVersion: certmanager.step.sm/v1beta1\nkind: StepIssuer\nmetadata:\n  name: step-issuer\n  namespace: default\nspec:\n  # The CA URL:\n  url: $CA_URL\n  # The base64 encoded version of the CA root certificate in PEM format:\n  caBundle: $CA_ROOT_B64\n  # The provisioner name, kid, and a reference to the provisioner password secret:\n  provisioner:\n    name: $CA_PROVISIONER_NAME\n    kid: $CA_PROVISIONER_KID\n    passwordRef:\n      name: step-certificates-provisioner-password\n      key: password\n---\nEOF\n```\n\nFinally, we'll apply our configuration:\n\n```sh\n$ kubectl apply -f step-issuer.yaml\n```\n\nMoments later, the resource should be ready:\n\n```sh\n$ kubectl get stepissuers.certmanager.step.sm step-issuer -o yaml\napiVersion: certmanager.step.sm/v1beta1\nkind: StepIssuer\n...\nstatus:\n  conditions:\n  - lastTransitionTime: \"2019-08-14T00:11:22Z\"\n    message: StepIssuer verified and ready to sign certificates\n    reason: Verified\n    status: \"True\"\n    type: Ready\n```\n\nYour `StepIssuer` is ready to sign certificates.\n\n### 4. Create your first `Certificate`\n\nStep Issuer has a controller watching for CertificateRequest resources, when one\nis created, the controller checks that it belongs to it, looking for the group\n`certmanager.step.sm`, then it loads the issuer `step-issuer` that will be in\ncharge the certificate.\n\nTo create a CertificateRequest we first need a CSR. We can use\n[step](https://github.com/smallstep/cli) to create one, we will use the password\n`my-password` to encrypt the private key:\n\n```sh\n$ step certificate create --csr internal.smallstep.com internal.csr internal.key\nPlease enter the password to encrypt the private key:\nYour certificate signing request has been saved in internal.csr.\nYour private key has been saved in internal.key.\n$ cat internal.csr\n-----BEGIN CERTIFICATE REQUEST-----\nMIIBEDCBtwIBADAhMR8wHQYDVQQDExZpbnRlcm5hbC5zbWFsbHN0ZXAuY29tMFkw\nEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWYaOephFfhvfSyv7hoPOpKA8IwSBBfTV\nxLW3ROYGP1M5DuFE8NFSYICE2Hw7xdP9oaSy+v5Dou5KZNr53D2/4KA0MDIGCSqG\nSIb3DQEJDjElMCMwIQYDVR0RBBowGIIWaW50ZXJuYWwuc21hbGxzdGVwLmNvbTAK\nBggqhkjOPQQDAgNIADBFAiAqSDrJ29mK5QM2WEL5mtWVt9FZtpBWaPWUWQNuvHJl\nZAIhAP95OPGkCZnDiLxydwPiectue+c4HpUwdaaN4JmE1fyh\n-----END CERTIFICATE REQUEST-----\n$ cat internal.key\n-----BEGIN EC PRIVATE KEY-----\nProc-Type: 4,ENCRYPTED\nDEK-Info: AES-256-CBC,ad8a6717659e9ac184a900ba710b7254\n\nRjwPP0j64ERhCT7AaOQ9UPMNsKipYwJJfmYZJQhHbHopP7aX90/Qw/GBECGk2H6G\nMsSKpzGbQVk82VNf55ecgNYANVbZdQhzmOLXRiGTmoSym//mOR+AvDzSa2J174vQ\ngg0xRmbSiql+jIrjqjyKvLAt5PczoEi3B2u6L3rwDpQ=\n-----END EC PRIVATE KEY-----\n```\n\nIf your application does not support encrypted keys, you can add the flags\n`--no-password --insecure` to the previous command.\n\nWe are almost ready to create our CertificateRequest YAML, we only need to\nencode using base64 our new CSR:\n\n```sh\n$ CSR=$(cat internal.csr | base64)\n$ echo $CSR\nLS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQkVEQ0J0d0lCQURBaE1SOHdIUVlEVlFRREV4WnBiblJsY201aGJDNXpiV0ZzYkhOMFpYQXVZMjl0TUZrdwpFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVdZYU9lcGhGZmh2ZlN5djdob1BPcEtBOEl3U0JCZlRWCnhMVzNST1lHUDFNNUR1RkU4TkZTWUlDRTJIdzd4ZFA5b2FTeSt2NURvdTVLWk5yNTNEMi80S0EwTURJR0NTcUcKU0liM0RRRUpEakVsTUNNd0lRWURWUjBSQkJvd0dJSVdhVzUwWlhKdVlXd3VjMjFoYkd4emRHVndMbU52YlRBSwpCZ2dxaGtqT1BRUURBZ05JQURCRkFpQXFTRHJKMjltSzVRTTJXRUw1bXRXVnQ5Rlp0cEJXYVBXVVdRTnV2SEpsClpBSWhBUDk1T1BHa0NabkRpTHh5ZHdQaWVjdHVlK2M0SHBVd2RhYU40Sm1FMWZ5aAotLS0tLUVORCBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0K\n```\n\nAnd put everything together:\n\n```sh\n$ cat \u003c\u003cEOF \u003e csr.yaml\napiVersion: cert-manager.io/v1\nkind: CertificateRequest\nmetadata:\n  name: internal-smallstep-com\n  namespace: default\nspec:\n  # The base64 encoded version of the certificate request in PEM format.\n  request: $CSR\n  # The duration of the certificate\n  duration: 24h\n  # If the certificate will be a CA or not.\n  # Step certificates won't accept a certificate request if this value is true,\n  # you can also omit this.\n  isCA: false\n  # A reference to the issuer in charge of signing the CSR.\n  issuerRef:\n    group: certmanager.step.sm\n    kind: StepIssuer\n    name: step-issuer\nEOF\n```\n\nWe apply it using kubectl:\n\n```sh\n$ kubectl apply -f csr.yaml\ncertificaterequest.cert-manager.io/internal-smallstep-com configured\n```\n\nAnd moments later the bundled signed certificate with the intermediate as well\nas the root certificate will be available in the resource:\n\n```sh\n$ kubectl get certificaterequests.cert-manager.io internal-smallstep-com -o yaml\napiVersion: cert-manager.io/v1\nkind: CertificateRequest\n...\nstatus:\n  ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJqRENDQVRLZ0F3SUJBZ0lSQU1GREdMMVIzR3pGdW5qOU0vaEgxaVF3Q2dZSUtvWkl6ajBFQXdJd0pERWkKTUNBR0ExVUVBeE1aUTJWeWRDQk5ZVzVoWjJWeUlGUmxjM1FnVW05dmRDQkRRVEFlRncweE9UQTJNall4TmpVMgpNemxhRncweU9UQTJNak14TmpVMk16bGFNQ1F4SWpBZ0JnTlZCQU1UR1VObGNuUWdUV0Z1WVdkbGNpQlVaWE4wCklGSnZiM1FnUTBFd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFUYnFIUStHZzZZYzVOWlEzOHEKTkx1WWZKa2xMTHV2QjJobkRjaC9iM2ltZVFmRUFOQ2lYeE9CdG5PY0FKdVNQM3NxeE5HWlhQajZFeUppbmNBbQpFRXRUbzBVd1F6QU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCL3dJQkFUQWRCZ05WCkhRNEVGZ1FVOTFWSmxma0RmdzB6aWFXV2ZjeE9CSkdEN3hRd0NnWUlLb1pJemowRUF3SURTQUF3UlFJZ1p3cnMKTlNMTTdWMlBNVStiZ1NZa1BmdjdBVGU1TG9zNlJJMUQrUFpIcmlVQ0lRQ0xjZ3lXa0cyaDZKNGV0Vkh4cDRSTApaVEpreDh1eElOcHJLc05od2ZqZFdnPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n  certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNMVENDQWRPZ0F3SUJBZ0lRZXdHWE9GSzdjaEVxT2o5SmREaGwvVEFLQmdncWhrak9QUVFEQWpBc01Tb3cKS0FZRFZRUURFeUZEWlhKMElFMWhibUZuWlhJZ1ZHVnpkQ0JKYm5SbGNtMWxaR2xoZEdVZ1EwRXdIaGNOTVRrdwpPREV5TWpNd05UVXdXaGNOTVRrd09ERXpNREF3TmpVd1dqQWJNUmt3RndZRFZRUURFeEJVWlhOMElFTnZiVzF2CmJpQk9ZVzFsTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFSG1zMi9kVWNyYks2WlViZktIRWYKVzIvMW5BZEJMekcxMGZHek1lamFTNmtyejJiRmxYb1FkNWhCSnYzUStNbFJhckMwZXhtUG0yNjhkeTBraThmdQpmNk9CNXpDQjVEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUdDQ3NHCkFRVUZCd01DTUIwR0ExVWREZ1FXQkJUZWxEaS90TmZ6WGJ0dEFhdHJmNGFIRnpVZDFUQWZCZ05WSFNNRUdEQVcKZ0JTS01mb2JPRTJtT0NSenhFajNaM1FRM1J6aU5UQWhCZ05WSFJFRUdqQVlnaFpwYm5SbGNtNWhiQzV6YldGcwpiSE4wWlhBdVkyOXRNRkFHRENzR0FRUUJncVJreGloQUFRUkFNRDRDQVFFRURHTmxjblF0YldGdVlXZGxjZ1FyCldqSlRMV3RWV1dWWmNrVmtSRTR6TWxKWU1IcHFiREY0V1MxWVVuUndlSFZrUXpKb2JYQnNaMHMyVlRBS0JnZ3EKaGtqT1BRUURBZ05JQURCRkFpQTNDbEdHVjlPeXYxdGlHWjBUQzNsY1JrQWVOR1ZuOWZvcllhM0tuZHc5bWdJaApBTW1iL0xEOGt3S0x2RUcrRW04bkVMa0VaWnhHeDJHclcrQXd3R2YxSVRxLwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCc3pDQ0FWcWdBd0lCQWdJUVVyQ202NFYzcWtEWjdZTlZ2RklQenpBS0JnZ3Foa2pPUFFRREFqQWtNU0l3CklBWURWUVFERXhsRFpYSjBJRTFoYm1GblpYSWdWR1Z6ZENCU2IyOTBJRU5CTUI0WERURTVNRFl5TmpFMk5UWXoKT1ZvWERUSTVNRFl5TXpFMk5UWXpPVm93TERFcU1DZ0dBMVVFQXhNaFEyVnlkQ0JOWVc1aFoyVnlJRlJsYzNRZwpTVzUwWlhKdFpXUnBZWFJsSUVOQk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRXdzcU05QTVuCllnYkxPZHI3YVdXMWZOQ3F6bkxZcUUrVWdka054UytNbEhpN1RZWWpITVdNVEtKdFg0ZktDRXZkWG9pdm05MGIKQm5JVkFFNjBaQVZaRktObU1HUXdEZ1lEVlIwUEFRSC9CQVFEQWdFR01CSUdBMVVkRXdFQi93UUlNQVlCQWY4QwpBUUF3SFFZRFZSME9CQllFRklveCtoczRUYVk0SkhQRVNQZG5kQkRkSE9JMU1COEdBMVVkSXdRWU1CYUFGUGRWClNaWDVBMzhOTTRtbGxuM01UZ1NSZys4VU1Bb0dDQ3FHU000OUJBTUNBMGNBTUVRQ0lBcGFHYkNHS0tYcXZGaWQKdEtoL0pBeEJSSGRQTlc5K1l1NjBvQzEreFp0NUFpQmZScmFKNlFIcmpKQnFFZWQ3ODY1ZmRYZDFsR2FKQXkyMgp4b1VRWnNvSFl3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n  conditions:\n  - lastTransitionTime: \"2019-08-14T00:12:45Z\"\n    message: Certificate issued\n    reason: Issued\n    status: \"True\"\n    type: Ready\n```\n\n**Now you are ready to use the TLS certificate in your app. Happy signing 🎉**\n\n## Notes\n\n### Using the Certificate resource\n\nBefore supporting `CertificateRequest`,\ncert-manager supported the resource `Certificate`.\nThis allows you to create TLS certificates providing only X.509 properties\nlike the common name, DNS or IP addresses SANs.\nCert Manager now provides a method to support `Certificate` resources\nusing `CertificateRequest` controllers\nsuch as step-issuer.\n\nThe YAML for a `Certificate` resource looks like:\n\n```yaml\napiVersion: cert-manager.io/v1\nkind: Certificate\nmetadata:\n  name: backend-smallstep-com\n  namespace: default\nspec:\n  # The secret name to store the signed certificate\n  secretName: backend-smallstep-com-tls\n  # Common Name\n  commonName: backend.smallstep.com\n  # DNS SAN\n  dnsNames:\n    - localhost\n    - backend.smallstep.com\n  # IP Address SAN\n  ipAddresses:\n    - \"127.0.0.1\"\n  # Duration of the certificate\n  duration: 24h\n  # Renew 8 hours before the certificate expiration\n  renewBefore: 8h\n  # The reference to the step issuer\n  issuerRef:\n    group: certmanager.step.sm\n    kind: StepIssuer\n    name: step-issuer\n```\n\nTo apply the `Certificate` resource, run:\n\n```sh\n$ kubectl apply -f config/samples/certificate.yaml\ncertificates.cert-manager.io/backend-smallstep-com created\n```\n\nMoments later a CertificateRequest will be automatically created by\ncert-manager:\n\n```sh\n$ kubectl get certificates.cert-manager.io\nNAME                               READY   AGE\nbackend-smallstep-com-2152809657   True    22s\ninternal-smallstep-com             True    1h\n```\n\nThe Step Issuer gets this CertificateRequest and sends the sign request to `step\ncertificates`, and stores the signed certificate in the same resource. Cert\nmanager gets the signed certificate and stores the signed and root certificate\nas well as the generated key in the secret provided in the YAML file property\n`secretName`.\n\n```sh\n$ kubectl get secrets backend-smallstep-com-tls -o yaml\napiVersion: v1\ndata:\n  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRHZ0F3SUJBZ0lRTytFQWg4eS8wVjlQMFhwSHJWajVOVEFLQmdncWhrak9QUVFEQWpBa01TSXcKSUFZRFZRUURFeGxUZEdWd0lFTmxjblJwWm1sallYUmxjeUJTYjI5MElFTkJNQjRYRFRFNU1EZ3hNekU1TVRVdwpNbG9YRFRJNU1EZ3hNREU1TVRVd01sb3dKREVpTUNBR0ExVUVBeE1aVTNSbGNDQkRaWEowYVdacFkyRjBaWE1nClVtOXZkQ0JEUVRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkFNVkw3VzBQbTNvSlVmSTR3WGQKa2xERW5uNVhTbWo4NlgwYW1DQTBnY08xdElUUG1DVzNCcGU0cE9vV1V2WlZlUWRvU2NxN3pua1V0Mi9HMnQxTgo3MWlqUlRCRE1BNEdBMVVkRHdFQi93UUVBd0lCQmpBU0JnTlZIUk1CQWY4RUNEQUdBUUgvQWdFQk1CMEdBMVVkCkRnUVdCQlJ1Y1ByVm5QdlpOMHI0QVU5TGcyL2VCcng3a2pBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCUlJBdGsKNXpMY0doQ2FobVBuVzIwZExpdEMzRVdNaVE0bERwN2FFeitFUEFJaEFJOWZWczVxb0l0bVQ4anA2WktVNVEydQphRFBrOGsyQ25OMjdyRnNZV3VwTAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURIRENDQXNPZ0F3SUJBZ0lRWFg2V1BBTm5ZZmhGbUQ0UGUvZmdHVEFLQmdncWhrak9QUVFEQWpBc01Tb3cKS0FZRFZRUURFeUZUZEdWd0lFTmxjblJwWm1sallYUmxjeUJKYm5SbGNtMWxaR2xoZEdVZ1EwRXdIaGNOTVRrdwpPREUwTVRrd09URTVXaGNOTVRrd09ERTFNVGt3T1RFNVdqQTNNUlV3RXdZRFZRUUtFd3hqWlhKMExXMWhibUZuClpYSXhIakFjQmdOVkJBTVRGV0poWTJ0bGJtUXVjMjFoYkd4emRHVndMbU52YlRDQ0FTSXdEUVlKS29aSWh2Y04KQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU1OcHN3T3hyNytUYmNVeU9UQ2YrVHVvVUl4WDVUaGNvMmNkWEdnZApXazJ2S0JBa0ZlU3hYTlR1VXE5d1Z1UFZaWWdmbm5xdnVqUGx0WTBzVXhoa3V5QkhQelNzYXBjSEo3ZGFZWmVNCjBLaGlLekJNV05IT2dYUnFPWTlkWnBDY2tjT21ZL216QlpnbUVMaW1xSittRVBTall3V2NtUmVYMzV4V3ZlV2MKKzEvUnovU2xYb1FYU2tuWENhdTY0VzZsQjlRYnl3UFdYQThqbklQcU43WktHekhEdlNOWit3L1pWNkNvYjlCbApiQkhialZ0MUxiZXNCNVpCeS9zMko3S0p3Q3FHMWNWZUg0R2N2UlhXT3FJZkFOUzNBSmVueHZJSWlpeE9ueWlsCldhUm1Bd0x0b2JBQzRuei9mOFpDbXJtdlVpdTB1bHFNTkR4VnZRcm9ZU1BzVUVFQ0F3RUFBYU9COERDQjdUQU8KQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUZCd01DTUIwRwpBMVVkRGdRV0JCVDNoRGZxZk96dTBCaWpkQmFzbUhaVnA1eXovekFmQmdOVkhTTUVHREFXZ0JSMFFtU0V0Q1pVCkdUM01vbFZ4NkVqenA3VWZqekF4QmdOVkhSRUVLakFvZ2hWaVlXTnJaVzVrTG5OdFlXeHNjM1JsY0M1amIyMkMKQ1d4dlkyRnNhRzl6ZEljRWZ3QUFBVEJKQmd3ckJnRUVBWUtrWk1Zb1FBRUVPVEEzQWdFQkJBVmhaRzFwYmdRcgpUalpKT1RsWmRXczNhVWRFVFd0ZlpWY3pVV0ZPTW1Ga2JVTnpja001VlhWRVRqSTNaR3hHV0ZWUGN6QUtCZ2dxCmhrak9QUVFEQWdOSEFEQkVBaUJxYmsyd1NqR1p6VDRGVXdpVTZickMzd0l4U3V2U3hCODMwcUx1YUVWTmVRSWcKU3cwUUZhTGVXdkYrYUZCdUN0TWo1ajlMMFl0TGRJdVhqZ3dvaWFNSzFVVT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQotLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KTUlJQnREQ0NBVnFnQXdJQkFnSVFEamJ2MnRRK1ZaelJzejZ6ZkFDdTBEQUtCZ2dxaGtqT1BRUURBakFrTVNJdwpJQVlEVlFRREV4bFRkR1Z3SUVObGNuUnBabWxqWVhSbGN5QlNiMjkwSUVOQk1CNFhEVEU1TURneE16RTVNVFV3Ck1sb1hEVEk1TURneE1ERTVNVFV3TWxvd0xERXFNQ2dHQTFVRUF4TWhVM1JsY0NCRFpYSjBhV1pwWTJGMFpYTWcKU1c1MFpYSnRaV1JwWVhSbElFTkJNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVqVjVGVkUrNQppNlVjR1FZbjM1am5uSnl1Q3dWYnNYVTV3ZUdtMVVWSk04S04ydlNzMnpvbTNDN0d0SW1Va2hYd1RVbmI3cVBhCmNpQmhNUzZlQlNqTVNhTm1NR1F3RGdZRFZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQkFmOEMKQVFBd0hRWURWUjBPQkJZRUZIUkNaSVMwSmxRWlBjeWlWWEhvU1BPbnRSK1BNQjhHQTFVZEl3UVlNQmFBRkc1dwordFdjKzlrM1N2Z0JUMHVEYjk0R3ZIdVNNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJSERPNWpkQ1oraDNhdEVlCjdKSFJLWmNNNkdGazZjUkJUSTJDcElmRW5Yc0lBaUVBK3RwRHVpM1RPdnBLWDdXbE55NlR3ZXc1UmlaYjhvUnUKN0FYOVk4UXJHdUE9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\n  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBdzJtekE3R3Z2NU50eFRJNU1KLzVPNmhRakZmbE9GeWpaeDFjYUIxYVRhOG9FQ1FWCjVMRmMxTzVTcjNCVzQ5VmxpQitlZXErNk0rVzFqU3hUR0dTN0lFYy9OS3hxbHdjbnQxcGhsNHpRcUdJck1FeFkKMGM2QmRHbzVqMTFta0p5Unc2WmorYk1GbUNZUXVLYW9uNllROUtOakJaeVpGNWZmbkZhOTVaejdYOUhQOUtWZQpoQmRLU2RjSnE3cmhicVVIMUJ2TEE5WmNEeU9jZytvM3Rrb2JNY085STFuN0Q5bFhvS2h2MEdWc0VkdU5XM1V0CnQ2d0hsa0hMK3pZbnNvbkFLb2JWeFY0ZmdaeTlGZFk2b2g4QTFMY0FsNmZHOGdpS0xFNmZLS1ZacEdZREF1MmgKc0FMaWZQOS94a0thdWE5U0s3UzZXb3cwUEZXOUN1aGhJK3hRUVFJREFRQUJBb0lCQVFDZWV6ZnE5QTJFQXE1UQo4c1Y5RVJEUitGU3pMWW5DWnlkQ3RvWStEaWd4dnE5d1A4UGR3Slo0UG55aXVpcE9Cc0NjWUlCb0llS1N1bWErCmdzYzFqbVJRN2xkdGdiUEVudEh3R3dYeElnd0xzK293OW9wR1JnT3BoWWovSTVIT0VKMExId1FQKzhlNnVJeHgKSlFDMjBia0lud1h0QkM4SSttd280QlNNaHY4N21vTmh0M2dNRFZiNmZsenBzdUpMaDZhc1JnN1FkbVhYQVJHVgpDRm5NNnYyWjhsbnR5cVRObWlZSjlvang0L0JoV1poTDV6RXVYMXBYcGFxZWZ3Ynl0SU4xOThRYUVDQlZNeUlsCkdXZVc0dXdrTTVzUWRBM3FQaU51N2hEcGwyQUdVK0ZEZllEVzQ4SElFZDkrUXNmaUZZZk5BM0sybTZ4VXQwZ3QKNHRWQlc0b3RBb0dCQU5KUXNVVWw0ZlhkZ0NqU2FZL3VzajV6cnpQMWdyNDJTdGxDSi85a1AxSkhvYTY5VnVCVgo5alh2dmc3bEJoQjZyWDhCNUZsNnFYYXJ3ci9uVFhwc0JwNU4yM1Y3RHZlQnpFMjNrLzlLNlE3ayt0UVdZUGgwCjJkbnZqVktqYklSaVozK0ZnUUU0ZW90ekhHYzNKS3FKRCsySUF1clczZ3RuQk1QQTA1bEdGbkl6QW9HQkFPM2MKVDh2T1VjQm92OXhpUEg4dWxzSG00SXZLNVNQTStYNGJPMm1vdUdNVWtQcmxXMU1pcVBsNUdYMG9CR1hDODdyNApPUHhtYmRiOFoyTXRqdXQ4ZUFqS094MFZCZ2FqakRlL0hFS2hveG02d1ZFSm9CZXNmQkVIV1FJN25ZbWQyck5LCnBUdXdxdDJ5dnBNa2JST3dITXpOY29PUU1RNlJOQ1hTVlltVmVvZTdBb0dCQUtZamZsWHNmaHFXVnBabzJXRU4KSTVzNEViQlBBbkEyUFZ4dzZWM1RtRDNzUGlubWdrbUhQbzhQQ3ltQy9BNXFpc0dwQWZVNWM4TStIZ013dWtDNgpNMlE4aHQvQVRXdHlDcTFlRnJoMk9iTTlhWE8vRmUxUGlZU2l1eFlMNlQ2TzZjbVA4ZisvMlBadUFZTDd5YWc1CnkrNU5JbGpYVWVMYUI2YUhuZUFYd01XSEFvR0JBTXdQVmVYaSt2KzIzZUtUNUpLM3hWNVVWQStaNFRyMWZwVlIKaDRiOTJESW9VcmpzUzR6bkQwLzNOSWJLN2ZyZlpYbmh1Z0hQWGl3eUhnQlg5V1RSUTZsRzFhLzllVTM0d1RLUwpJZ3lIM3dVVDB3VlMzS1Z5dEgxbmNGVWFEKzBnSDUveFNoQUxZSXNSN2EwT2N3V1E4U1JDblJ1QmVKU212YlkwCjNHMU1iL0pCQW9HQUNkdkRoNVpSRVZzNGlGa25SSDcxQmNyeWFZN1pVbkQ1SzZSUkNHY0krRURQQ3FBOTZvK2MKdnBLSm5pLzVJK01USm8vQ3QrTENXNm56U3ZOS3dzT0N1eVJqSFRnaHZMUU5ESGdZZ2xJQll3a0l3bklFOXUzMQpiQzJIVlg0K3BEVjQzUCtna2t0Uks4ZG1ha2diNUF0dGtVNkJXLzdaL0VsSE4vNW4rTTNhYVpZPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=\nkind: Secret\nmetadata:\n  annotations:\n    cert-manager.io/alt-names: localhost,backend.smallstep.com\n    cert-manager.io/certificate-name: backend-smallstep-com\n    cert-manager.io/common-name: backend.smallstep.com\n    cert-manager.io/ip-sans: 127.0.0.1\n    cert-manager.io/issuer-kind: CertificateRequest\n    cert-manager.io/issuer-name: step-issuer\n    cert-manager.io/uri-sans: \"\"\n  creationTimestamp: \"2019-08-14T01:02:03Z\"\n  name: backend-smallstep-com-tls\n  namespace: default\n  resourceVersion: \"430738\"\n  selfLink: /api/v1/namespaces/default/secrets/backend-smallstep-com-tls\n  uid: 751e621c-426c-4493-b253-dc817fd6a64f\ntype: kubernetes.io/tls\n```\n\n## Upgrading\n\n### Migrating from kube-rbac-proxy to native metrics authentication\n\nThe `kube-rbac-proxy` sidecar has been removed. The controller manager now\nserves metrics directly over HTTP using controller-runtime's built-in server.\n\n**Breaking changes:**\n\n- The `--metrics-addr` flag has been renamed to `--metrics-bind-address`.\n- The default address changed from `:8080` (HTTP, always on) to `0` (disabled).\n  The provided manifests set `--metrics-bind-address=:8080`.\n- The `gcr.io/kubebuilder/kube-rbac-proxy` container image is no longer used.\n- RBAC resources have been renamed:\n  - `proxy-role` / `proxy-rolebinding` → `metrics-auth-role` / `metrics-auth-rolebinding`\n  - A new `metrics-reader` ClusterRole grants `GET /metrics` access.\n\n**Steps to upgrade:**\n\n1. **Update your deployment manifests.** Replace the `kube-rbac-proxy` sidecar\n   and the `--metrics-addr` flag:\n\n   Before:\n   ```yaml\n   containers:\n   - name: kube-rbac-proxy\n     image: gcr.io/kubebuilder/kube-rbac-proxy:v0.4.0\n     args:\n     - --secure-listen-address=0.0.0.0:8443\n     - --upstream=http://127.0.0.1:8080/\n   - name: manager\n     args:\n     - --metrics-addr=127.0.0.1:8080\n   ```\n\n   After:\n   ```yaml\n   containers:\n   - name: manager\n     args:\n     - --metrics-bind-address=:8080\n   ```\n\n2. **Update RBAC resources.** Delete the old `proxy-role` and `proxy-rolebinding`\n   resources and apply the new `metrics-auth-role`, `metrics-auth-rolebinding`,\n   and `metrics-reader` resources from `config/rbac/` or `config/samples/deployment.yaml`.\n\n3. **Grant your Prometheus scraper access to `/metrics`.** The `metrics-reader`\n   ClusterRole must be bound to your Prometheus ServiceAccount. See the commented\n   example in `config/rbac/metrics_reader_rolebinding.yaml`. For kube-prometheus-stack:\n\n   ```yaml\n   apiVersion: rbac.authorization.k8s.io/v1\n   kind: ClusterRoleBinding\n   metadata:\n     name: step-issuer-metrics-reader-rolebinding\n   roleRef:\n     apiGroup: rbac.authorization.k8s.io\n     kind: ClusterRole\n     name: step-issuer-metrics-reader\n   subjects:\n   - kind: ServiceAccount\n     name: prometheus-k8s\n     namespace: monitoring\n   ```\n\n### Disabling Approval Check\n\n`StepIssuer` will wait for `CertificateRequest`s to have an [approved condition\nset](https://cert-manager.io/docs/concepts/certificaterequest/#approval) before\nsigning. If using an older version of cert-manager (pre v1.3), you can disable\nthis check by supplying the command line flag `-disable-approval-check` to the\nIssuer Deployment.\n\n### Local development\n\nTo run `step-issuer` locally, you can use a [Kind](https://kind.sigs.k8s.io/) cluster. Be sure to create a cluster with at least two workers:\n\n```sh\n$ cat \u003c\u003cEOF \u003e kind.yaml\n# three node (two workers) cluster config\nkind: Cluster\napiVersion: kind.x-k8s.io/v1alpha4\nnodes:\n- role: control-plane\n- role: worker\n- role: worker\nEOF\n$ kind create cluster --config kind.yaml\nCreating cluster \"kind\" ...\n ✓ Ensuring node image (kindest/node:v1.25.3) 🖼\n ✓ Preparing nodes 📦 📦 📦\n ✓ Writing configuration 📜\n ✓ Starting control-plane 🕹️\n ✓ Installing CNI 🔌\n ✓ Installing StorageClass 💾\n ✓ Joining worker nodes 🚜\nSet kubectl context to \"kind-kind\"\nYou can now use your cluster with:\n\nkubectl cluster-info --context kind-kind\n\nNot sure what to do next? 😅  Check out https://kind.sigs.k8s.io/docs/user/quick-start/\n```\n\n### Installing from Source\n\nThe `make deploy` recipe will install `step-issuer` manually from this repo.\n\nThese are the individual steps:\n\nFirst we install the CRDs:\n\n```sh\nkubectl apply -f config/crd/bases/certmanager.step.sm_stepissuers.yaml\nkubectl apply -f config/crd/bases/certmanager.step.sm_stepclusterissuers.yaml\n```\n\nThen we install the controller:\n\n```sh\nkubectl apply -f config/samples/deployment.yaml\n```\n\nOr, if you're using [`kustomize`](https://kustomize.io/):\n\n```sh\nkustomize build config/default | kubectl apply -f -\n```\n\nBy default,\nthe `step-issuer` controller will be installed in the `step-issuer-system` namespace,\nbut you can edit the YAML files as needed.\n\n```sh\n$ kubectl get -n step-issuer-system all\nNAME                                                 READY   STATUS    RESTARTS   AGE\npod/step-issuer-controller-manager-9d74f5bff-hnk2c   2/2     Running   0          1m\n\nNAME                                                     TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE\nservice/step-issuer-controller-manager-metrics-service   ClusterIP   10.96.212.99   \u003cnone\u003e        8443/TCP   1m\n\nNAME                                             READY   UP-TO-DATE   AVAILABLE   AGE\ndeployment.apps/step-issuer-controller-manager   1/1     1            1           1m\n\nNAME                                                       DESIRED   CURRENT   READY   AGE\nreplicaset.apps/step-issuer-controller-manager-9d74f5bff   1         1         1       1m\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsmallstep%2Fstep-issuer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsmallstep%2Fstep-issuer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsmallstep%2Fstep-issuer/lists"}