Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/cert-manager/google-cas-issuer
cert-manager issuer for Google CA Service
https://github.com/cert-manager/google-cas-issuer
Last synced: 4 days ago
JSON representation
cert-manager issuer for Google CA Service
- Host: GitHub
- URL: https://github.com/cert-manager/google-cas-issuer
- Owner: cert-manager
- License: apache-2.0
- Created: 2020-10-21T18:09:16.000Z (about 4 years ago)
- Default Branch: main
- Last Pushed: 2024-10-23T07:03:04.000Z (21 days ago)
- Last Synced: 2024-10-23T12:45:17.439Z (21 days ago)
- Language: Makefile
- Size: 790 KB
- Stars: 77
- Watchers: 7
- Forks: 30
- Open Issues: 20
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Google Certificate Authority Service Issuer for cert-manager
This repository contains an [external Issuer](https://cert-manager.io/docs/contributing/external-issuers/)
for cert-manager that issues certificates using [Google Cloud
Certificate Authority Service (CAS)](https://cloud.google.com/certificate-authority-service/), using managed private CAs to issue certificates.
> [!IMPORTANT]
> The Google CAS Issuer project is currently in maintenance mode. We will continue to provide support for bug fixes and security updates, but no new major features are planned. We are looking for maintainers/ partners (eg. the Google CAS team) to continue the development of this project and take some of the maintainership responsibilities. If you are interested, please reach out to us on the [`cert-manager-dev` Slack via @cert-manager-maintainers](https://groups.google.com/forum/#!forum/cert-manager-dev).
> [!IMPORTANT]
> The `GoogleCASIssuer` and `GoogleCASClusterIssuer` CRDs are part of the `cas-issuer.jetstack.io` API group. This `jetstack.io` API group is used for legacy reasons and will not be immediately changed to preserve backwards compatibility. This project however is no longer maintained or owned by Jetstack, instead it is maintained by the cert-manager team/ community.
> [!IMPORTANT]
> Starting from version v0.9.0, the docker image for the Google CAS Issuer controller is tagged with a v-prefix (v0.9.0 instead of 0.9.0). The helm chart for v0.9.0 will also refer to this image tag. Make sure to update your image replication rules if necessary.
## Getting started
### Prerequisites
#### CAS-enabled GCP project
Enable the Certificate Authority API (`privateca.googleapis.com`) in your GCP project by following the
[official documentation](https://cloud.google.com/certificate-authority-service/docs/quickstart).
#### CAS-managed Certificate Authorities
You can create a ca pool containing a certificate authority in your current Google project with:
```shell
gcloud privateca pools create my-pool --location us-east1
gcloud privateca roots create my-ca --pool my-pool --key-algorithm "ec-p384-sha384" --subject="CN=my-root,O=my-ca,OU=my-ou" --max-chain-length=2 --location us-east1
```
You should also enable the root CA you just created when prompted by `gcloud`.
> It is recommended to create subordinate CAs for signing leaf
> certificates. See the [official
> documentation](https://cloud.google.com/certificate-authority-service/docs/creating-certificate-authorities).
#### cert-manager
If not already running in the cluster, install cert-manager by following the [official documentation](https://cert-manager.io/docs/installation/kubernetes/).
### Installing Google CAS Issuer for cert-manager
```shell
helm repo add jetstack https://charts.jetstack.io --force-update
helm upgrade -i cert-manager-google-cas-issuer jetstack/cert-manager-google-cas-issuer -n cert-manager --wait
```
Or alternatively, assuming that you have installed cert-manager in the `cert-manager` namespace, you can use a single kubectl
command to install Google CAS Issuer.
Visit the [GitHub releases](https://github.com/cert-manager/google-cas-issuer/releases), select the latest release
and copy the command, e.g.
```shell
kubectl apply -f https://github.com/cert-manager/google-cas-issuer/releases/download/v0.6.1/google-cas-issuer-v0.6.1.yaml
```
You can then skip to the [Setting up Google Cloud IAM](#setting-up-google-cloud-iam) section.
##### Build and push the controller image
**Note**: you can skip this step if using the public images at [quay.io](https://quay.io/repository/jetstack/cert-manager-google-cas-issuer?tag=latest&tab=tags).
Build the docker image:
```shell
make docker-build
```
Push the docker image or load it into kind for testing
```shell
make docker-push || kind load docker-image quay.io/jetstack/cert-manager-google-cas-issuer:latest
```
#### Deploy the controller
Deploy the issuer controller:
```shell
cat <