hashicorp / hashicorp/vault-secrets-operator

Add support for mTLS CA and CRL chain

Open
#657 4 comments 1 reaction 0 assignees View on GitHub
enhancement PKI
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Is your feature request related to a problem? Please describe.**
As already describe on the #452
We need to generate a secret from the PKI with the ca chain and the CRL chain.
But we don't need to generate a certificate from this PKI

our PKI is build from 2 PKI (the root and the public )

We can't use the vaultstaticsecret because it not support the PKI type (only kv)
The vaultPKISecret only generate new certificate but without the full ca chain and the full crl chain


**Describe the solution you'd like**
We need a new resource to read pki issuers and generate a secret that only contain the ca chain and the crl chain

the expected contain is :
```
ca.crt: "{% .ca_root.Secrets.certificate %}\n{% .ca_api.Secrets.certificate %}"
ca.crl: "{% .crl_root.Secrets.certificate %}\n{% .crl_api.Secrets.certificate %}"
```
With those paths:
```
ca_root: "pki/cert/ca"
ca_api: "pki_api/cert/ca"
crl_root: "pki/cert/crl"
crl_api: "pki_api/cert/crl"
```

What we need on the secret can be extracted with this cmd (as described [here](https://developer.hashicorp.com/vault/tutorials/secrets-management/pki-engine#step-9-create-a-cross-signed-intermediate)):
```
vault read -field=ca_chain pki_int/issuer/"$(vault read -field=default pki_int/config/issuers)"
```
But we need the same for the CRL

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.