Issue and approve certificates with Venafi Control Plane

Learn how to configure Venafi Control Plane, cert-manager, approver-policy-enterprise, and venafi-enhanced-issuer so that application teams can help themselves to SSL certificates which comply with enterprise PKI policy.

Create a Cluster Issuer

Now that you've installed all the prerequisite software in your cluster it's time to configure a cluster issuer.

ℹ️ VenafiClusterIssuer is recommended in this scenario because it prevents individual teams from altering the configuration. of the connection to Venafi, which should be the responsibility of the platform team.

This job would typically be performed by the platform team.

The following example shows a cluster issuer resource which uses a Kubernetes ServiceAccount Token to authenticate to HashiCorp Vault which contains the credentials for Venafi TPP.

🔗 venafi-cluster-issuer.yaml

# venafi-cluster-issuer.yaml
apiVersion: jetstack.io/v1alpha1
kind: VenafiClusterIssuer
metadata:
  name: application-team-1
spec:
  venafiConnectionName: application-team-1-connection
  zone: \VED\Policy\Teams\application-team-1

Copy to clipboard

kubectl apply -f venafi-cluster-issuer.yaml

Copy to clipboard

Next Steps

Create an Approval Policy

Issue and approve certificates with Venafi Control Plane

Create a Cluster Issuer

Next Steps

On this page