hashicorp / hashicorp/vault-secrets-operator
Add support for mTLS CA and CRL chain
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Is your feature request related to a problem? Please describe.**
As already describe on the #452
We need to generate a secret from the PKI with the ca chain and the CRL chain.
But we don't need to generate a certificate from this PKI
our PKI is build from 2 PKI (the root and the public )
We can't use the vaultstaticsecret because it not support the PKI type (only kv)
The vaultPKISecret only generate new certificate but without the full ca chain and the full crl chain
**Describe the solution you'd like**
We need a new resource to read pki issuers and generate a secret that only contain the ca chain and the crl chain
the expected contain is :
```
ca.crt: "{% .ca_root.Secrets.certificate %}\n{% .ca_api.Secrets.certificate %}"
ca.crl: "{% .crl_root.Secrets.certificate %}\n{% .crl_api.Secrets.certificate %}"
```
With those paths:
```
ca_root: "pki/cert/ca"
ca_api: "pki_api/cert/ca"
crl_root: "pki/cert/crl"
crl_api: "pki_api/cert/crl"
```
What we need on the secret can be extracted with this cmd (as described [here](https://developer.hashicorp.com/vault/tutorials/secrets-management/pki-engine#step-9-create-a-cross-signed-intermediate)):
```
vault read -field=ca_chain pki_int/issuer/"$(vault read -field=default pki_int/config/issuers)"
```
But we need the same for the CRL
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.