Issue and approve certificates with Venafi Control Plane

Learn how to configure Venafi Control Plane, cert-manager, approver-policy-enterprise, and venafi-enhanced-issuer so that application teams can help themselves to SSL certificates which comply with enterprise PKI policy.

Create a Test Certificate

Now that you've installed all the prerequisite software in your cluster and configured an issuer, it's time to create an SSL certificate.

First create a Certificate and see that it is not approved.

🔗 certificate.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: application-team-1
---

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: certificate-1
  namespace: application-team-1
spec:
  commonName: app1.example.com
  secretName: certificate-1
  issuerRef:
    name: application-team-1
    kind: VenafiClusterIssuer
    group: jetstack.io

Copy to clipboard

kubectl apply -f certificate.yaml

Copy to clipboard

You will notice that a CertificateRequest is created, but it is neither approver nor denied:

$ kubectl -n application-team-1 get cr
NAME                  APPROVED   DENIED   READY   ISSUER               REQUESTOR                                            AGE
certificate-1-tdc74                               application-team-1   system:serviceaccount:jetstack-secure:cert-manager   21s

Copy to clipboard

This is because we disabled the default cert-manager approver controller when we installed cert-manager earlier. And we have not yet created a policy for the approver-policy component.

$ kubectl -n application-team-1 describe cr
...
Events:
  Type    Reason       Age    From                    Message
  ----    ------       ----   ----                    -------
  Normal  Unprocessed  3m54s  policy.cert-manager.io  Request is not applicable for any policy so ignoring

Copy to clipboard

Create an Approval Policy

🔗 policy.yaml

apiVersion: policy.cert-manager.io/v1alpha1
kind: CertificateRequestPolicy
metadata:
  name: application-team-1
spec:
  allowed:
    commonName:
      value: "*"
  plugins:
    venafi:
      values:
        venafiConnectionName: application-team-1-connection
        zone: \VED\Policy\Teams\application-team-1
  selector:
    issuerRef:
      name: application-team-1
      kind: VenafiClusterIssuer
      group: jetstack.io
    namespace:
      matchNames:
        - application-team-1
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cert-manager-policy:application-team-1
rules:
  - apiGroups: ["policy.cert-manager.io"]
    resources: ["certificaterequestpolicies"]
    verbs: ["use"]
    resourceNames: ["application-team-1"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-policy:application-team-1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-policy:application-team-1
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: jetstack-secure

Copy to clipboard

kubectl apply -f policy.yaml

Copy to clipboard

After applying the CertificateRequestPolicy you will see that the CertificateRequest for your test Certificate is approved.

$ kubectl -n application-team-1 get certificaterequest certificate-1-q65m6
NAME                  APPROVED   DENIED   READY   ISSUER               REQUESTOR                                            AGE
certificate-1-q65m6   True                True    application-team-1   system:serviceaccount:jetstack-secure:cert-manager   38m

Copy to clipboard

And once it has been Approved, the CertificateRequest will be reconciled by venafi-enhanced-issuer, which will send the CertificateRequest data to Venafi TPP and get the signed SSL certificate, which cert-manager will then put in the Secret along side the private key.

$ kubectl -n application-team-1 describe secrets certificate-1

Name:         certificate-1
Namespace:    application-team-1
...
Type:  kubernetes.io/tls

Data
====
tls.crt:  3218 bytes
tls.key:  1679 bytes

Copy to clipboard

Screenshot of the certificate summary page in the Venafi TPP web UI

And you will see the certificate in the Venafi TPP policy folder:

Next Steps

Conclusion

Issue and approve certificates with Venafi Control Plane

Create a Test Certificate

Create an Approval Policy

Next Steps

On this page