You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

Introduction

K8s Cert-Manager is an industry standard to issue X.509 certificates to K8s workloads. It provides simple, reliable, elastic and efficient way to issue certificates within K8s environment. Simple cause it relies on K8s custom resource definition mechanism, reliable cause without secret created by Cert-Manager K8s workload won't start, elastic cause it can provide certificates from many sources, including external providers and efficient - cause it may deliver hundreds of certificates per day.


Way forward

CertService was implemented some time back. It provides basic certificate enrollment functionality using CMPv2 over HTTP. Cause in ONAP we have a lot of components which issue certificates, it is wise to harmonize them and use forward just one of them. As a way forward, CertService should be a backend proxy service for K8s Cert-Manager. The same functionality which is currently implemented in CertService client should be implemented in Cert-Manager's external provider. Following diagram presents new setup.

cert_manager_cert_service_integration

Future

There is an open feature request (FR) to support CMPv2 natively in Cert-Manager - https://github.com/jetstack/cert-manager/issues/2619

If such would be implemented, it is beneficial to use it instead of our custom solution. During research phase we can even check if it is worth to implement CMPv2 support natively in the first place.

  • No labels