Skip to content

Commit 93925b7

Browse files
ashish1099ashish1099
committed
feat: added step-certificates helm chart
1 parent 9f94ab6 commit 93925b7

23 files changed

Lines changed: 2239 additions & 0 deletions

File tree

‎argocd-helm-charts/step-ca/charts/step-certificates/.helmignore‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*~
18+
# Various IDEs
19+
.project
20+
.idea/
21+
*.tmproj
22+
.vscode/

‎argocd-helm-charts/step-ca/charts/step-certificates/Chart.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: v1
2+
appVersion: 0.28.4
3+
description: An online certificate authority and related tools for secure automated
4+
certificate management, so you can use TLS everywhere.
5+
home: https://smallstep.com
6+
icon: https://raw.githubusercontent.com/smallstep/certificates/master/icon.png
7+
keywords:
8+
- acme
9+
- authority
10+
- ca
11+
- certificate
12+
- certificates
13+
- certificate-authority
14+
- kubernetes
15+
- pki
16+
- security
17+
- security-tools
18+
- smallstep
19+
- ssh
20+
- step
21+
- step-ca
22+
- tls
23+
- x509
24+
maintainers:
25+
- email: mariano@smallstep.com
26+
name: Mariano Cano
27+
name: step-certificates
28+
sources:
29+
- https://github.com/smallstep/certificates
30+
version: 1.28.4

‎argocd-helm-charts/step-ca/charts/step-certificates/README.md‎

Lines changed: 372 additions & 0 deletions
Large diffs are not rendered by default.

‎argocd-helm-charts/step-ca/charts/step-certificates/examples/README.md‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# Helm Configuration Examples
2+
3+
## Self Hosted Single Instance Certificate Authority
4+
5+
1. Edit `./certificate_authority_single_instance/ca.config` to reflect your CA environment.
6+
7+
```json
8+
{
9+
"root_ca_name": "example-root-ca",
10+
"intermediate_ca_name": "example-intermediate-ca",
11+
"ca_org_name": "Example CA Org",
12+
"ca_country_name": "US",
13+
"ca_locality_name": "Minnesota",
14+
"ca_dns_names": [
15+
"ca.example.com",
16+
"mysteprelease-step-certificates.default.svc.cluster.local",
17+
"127.0.0.1"
18+
]
19+
}
20+
```
21+
22+
2. Run the following bash script
23+
24+
```bash
25+
# Navigate to the example directory.
26+
cd ./certificate_authority_single_instance
27+
28+
# Generate key material and inject into values.yaml
29+
./generate-values.sh
30+
31+
# Add the smallstep helm repo, if not already added
32+
helm repo add smallstep https://smallstep.github.io/helm-charts/
33+
34+
# Update helm repos to ensure you have the latest version
35+
helm repo update
36+
37+
# Install the step-certificates helm chart.
38+
helm install mysteprelease -f ./values.yml smallstep/step-certificate
39+
40+
# Save generated files somewhere safe then remove from your local machine
41+
rm -f ./*.yml ./*.json ./*.crt ./*.key ./*.pub ./*.password
42+
```
43+
44+
## Registration Authority Connected to Smallstep Certificate Manager Hosted Certificate Authority.
45+
46+
```bash
47+
CA_NAME='example-ca'
48+
CA_FINGERPRINT='ca-fingerprint'
49+
ORG_NAME='example-org'
50+
51+
# Install Step If Not already installed.
52+
brew install step
53+
54+
# Bootstrap Step against the CA if not already bootstrapped.
55+
step ca bootstrap --ca-url https://${CA_NAME}.${ORG_NAME}.ca.smallstep.com --fingerprint ${CA_FINGERPRINT}
56+
57+
# Create a registration-authority JWK Provisioner
58+
step beta ca provisioner add registration-authority --create
59+
60+
# Encode the JWK Provisioner password in base64
61+
JWK_ISSUER_PASSWORD=`echo 'your-password-here' | base64`
62+
63+
# Download the example values.yml
64+
curl -o step_values.yml https://raw.githubusercontent.com/smallstep/helm-charts/master/step-certificates/examples/registration_authority/values.yml
65+
66+
# Replace dummy values with your own values
67+
sed -e "s/your-ca-name/${CA_NAME}/g" -i step_values.yml
68+
sed -e "s/your-org/${ORG_NAME}/g" -i step_values.yml
69+
sed -e "s/your-ca-fingerprint-here/${CA_FINGERPRINT}/g" -i step_values.yml
70+
sed -e "s/your-base-64-encoded-key-password/${JWK_ISSUER_PASSWORD}/g" -i step_values.yml
71+
72+
# Add the smallstep helm repo, if not already added
73+
helm repo add smallstep https://smallstep.github.io/helm-charts/
74+
75+
# Update helm repos to ensure you have the latest version
76+
helm repo update
77+
78+
# Install the step-certificates helm chart.
79+
helm install -f step_values.yml smallstep/step-certificates
80+
```

‎argocd-helm-charts/step-ca/charts/step-certificates/examples/certificate_authority_single_instance/ca.config‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"root_ca_name": "example-root-ca",
3+
"intermediate_ca_name": "example-intermediate-ca",
4+
"ca_org_name": "Example CA Org",
5+
"ca_country_name": "US",
6+
"ca_locality_name": "Minnesota",
7+
"ca_dns_names": [
8+
"ca.example.com",
9+
"mysteprelease-step-certificates.default.svc.cluster.local",
10+
"127.0.0.1"
11+
],
12+
"jwk_provisioner_name": "admin",
13+
"ca_url": "mysteprelease-step-certificates.default.svc.cluster.local"
14+
}

‎argocd-helm-charts/step-ca/charts/step-certificates/examples/certificate_authority_single_instance/generate-values.sh‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
#!/bin/sh
2+
3+
ROOT_CA_NAME=`jq -r '.root_ca_name' ca.config`
4+
INTERMEDIATE_CA_NAME=`jq -r '.intermediate_ca_name' ca.config`
5+
CA_ORG_NAME=`jq -r '.ca_org_name' ca.config`
6+
CA_COUNTRY_NAME=`jq -r '.ca_country_name' ca.config`
7+
CA_LOCALITY_NAME=`jq -r '.ca_locality_name' ca.config`
8+
CA_DNS_NAMES=`jq -c .ca_dns_names ca.config`
9+
CA_URL=`jq -r .ca_url ca.config`
10+
JWK_PROVISIONER_NAME=`jq -r .jwk_provisioner_name ca.config`
11+
12+
export ROOT_CA_NAME INTERMEDIATE_CA_NAME CA_ORG_NAME CA_COUNTRY_NAME CA_LOCALITY_NAME CA_DNS_NAMES CA_URL JWK_PROVISIONER_NAME
13+
14+
# Write Out Root and Intermediate Certificate Templates
15+
cat root-tls.json.tpl | envsubst | tee root-tls.json
16+
cat intermediate-tls.json.tpl | envsubst | tee intermediate-tls.json
17+
18+
# Generate Root and Intermediate Passwords
19+
ROOT_TLS_PASSWORD_B64=`tr -dc 'A-Za-z0-9!"#$%&'\''()*+,-./:;<=>?@[\]^_\`{|}~' </dev/urandom | head -c 64 | tee root-tls.password | base64 --wrap=0`
20+
INTERMEDIATE_TLS_PASSWORD_B64=`tr -dc 'A-Za-z0-9!"#$%&'\''()*+,-./:;<=>?@[\]^_\`{|}~' </dev/urandom | head -c 64 | tee intermediate-tls.password | base64 --wrap=0`
21+
22+
# Generate Root CA Certificate Pair
23+
step certificate create \
24+
"${ROOT_CA_NAME}" \
25+
"root-tls.crt" \
26+
"root-tls.key" \
27+
--template="root-tls.json" \
28+
--kty="EC" \
29+
--curve="P-256" \
30+
--password-file="root-tls.password" \
31+
--not-before="0s" \
32+
--not-after="44520h" \
33+
--force
34+
35+
TLS_ROOT_CRT=`cat root-tls.crt | sed 's/^/ /'`
36+
TLS_ROOT_KEY=`cat root-tls.key | sed 's/^/ /'`
37+
TLS_ROOT_FINGERPRINT=`step certificate fingerprint root-tls.crt`
38+
39+
# Generate Intermediate CA Certificate Pair
40+
step certificate create \
41+
"${INTERMEDIATE_CA_NAME}" \
42+
"intermediate-tls.crt" \
43+
"intermediate-tls.key" \
44+
--template="intermediate-tls.json" \
45+
--kty="EC" \
46+
--curve="P-256" \
47+
--password-file="intermediate-tls.password" \
48+
--not-before="0s" \
49+
--not-after="17760h" \
50+
--ca="root-tls.crt" \
51+
--ca-key="root-tls.key" \
52+
--ca-password-file="root-tls.password" \
53+
--force
54+
55+
TLS_INTERMEDIATE_CRT=`cat intermediate-tls.crt | sed 's/^/ /'`
56+
TLS_INTERMEDIATE_KEY=`cat intermediate-tls.key | sed 's/^/ /'`
57+
58+
# Generate SSH Host CA Password
59+
SSH_HOST_PASSWORD=`tr -dc 'A-Za-z0-9!"#$%&'\''()*+,-./:;<=>?@[\]^_\`{|}~' </dev/urandom | head -c 64 | tee host-ssh.password`
60+
SSH_HOST_PASSWORD_B64=`echo ${SSH_HOST_PASSWORD} | base64 --wrap=0`
61+
62+
# Generate SSH Host CA Keypair
63+
ssh-keygen -q -t ecdsa -b 256 -f host-ssh.key -C "SSH Host Key" -N ${SSH_HOST_PASSWORD}
64+
65+
SSH_HOST_CRT=`cat host-ssh.key.pub`
66+
SSH_HOST_KEY=`cat host-ssh.key | sed 's/^/ /'`
67+
68+
# Generate SSH User CA Password
69+
SSH_USER_PASSWORD=`tr -dc 'A-Za-z0-9!"#$%&'\''()*+,-./:;<=>?@[\]^_\`{|}~' </dev/urandom | head -c 64 | tee user-ssh.password`
70+
SSH_USER_PASSWORD_B64=`echo ${SSH_USER_PASSWORD} | base64 --wrap=0`
71+
72+
# Generate SSH User CA Keypair
73+
ssh-keygen -q -t ecdsa -b 256 -f user-ssh.key -C "SSH User Key" -N ${SSH_USER_PASSWORD}
74+
75+
SSH_USER_CRT=`cat user-ssh.key.pub`
76+
SSH_USER_KEY=`cat user-ssh.key | sed 's/^/ /'`
77+
78+
JWK_PROVISIONER_PASSWORD_B64=`tr -dc 'A-Za-z0-9!"#$%&'\''()*+,-./:;<=>?@[\]^_\`{|}~' </dev/urandom | head -c 64 | tee jwk_provisioner.password | base64 --wrap=0`
79+
80+
step crypto jwk create \
81+
jwk_provisioner.pub \
82+
jwk_provisioner.key \
83+
--kty=EC \
84+
--curve=P-256 \
85+
--use=sig \
86+
--password-file=jwk_provisioner.password \
87+
--force
88+
89+
JWK_PROVISIONER_KEY=`cat jwk_provisioner.key | step crypto jose format | tee jwk_provisioner.compact.key`
90+
JWK_PROVISIONER_CRT_ALG=`jq '.alg' -r jwk_provisioner.pub`
91+
JWK_PROVISIONER_CRT_CRV=`jq '.crv' -r jwk_provisioner.pub`
92+
JWK_PROVISIONER_CRT_KID=`jq '.kid' -r jwk_provisioner.pub`
93+
JWK_PROVISIONER_CRT_KTY=`jq '.kty' -r jwk_provisioner.pub`
94+
JWK_PROVISIONER_CRT_USE=`jq '.use' -r jwk_provisioner.pub`
95+
JWK_PROVISIONER_CRT_X=`jq '.x' -r jwk_provisioner.pub`
96+
JWK_PROVISIONER_CRT_Y=`jq '.y' -r jwk_provisioner.pub`
97+
98+
export \
99+
ROOT_TLS_PASSWORD_B64 TLS_ROOT_CRT TLS_ROOT_KEY TLS_ROOT_FINGERPRINT \
100+
INTERMEDIATE_TLS_PASSWORD_B64 TLS_INTERMEDIATE_CRT TLS_INTERMEDIATE_KEY \
101+
SSH_HOST_PASSWORD_B64 SSH_HOST_CRT SSH_HOST_KEY \
102+
SSH_USER_PASSWORD_B64 SSH_USER_CRT SSH_USER_KEY \
103+
JWK_PROVISIONER_PASSWORD_B64 JWK_PROVISIONER_KEY JWK_PROVISIONER_CRT_ALG \
104+
JWK_PROVISIONER_CRT_CRV JWK_PROVISIONER_CRT_KID JWK_PROVISIONER_CRT_KTY \
105+
JWK_PROVISIONER_CRT_USE JWK_PROVISIONER_CRT_X JWK_PROVISIONER_CRT_Y
106+
107+
cat values.yml.tpl | envsubst | tee values.yml

‎argocd-helm-charts/step-ca/charts/step-certificates/examples/certificate_authority_single_instance/intermediate-tls.json.tpl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"subject": {
3+
"commonName": "${INTERMEDIATE_CA_NAME}",
4+
"organizationName": "${CA_ORG_NAME}",
5+
"countryName": "${CA_COUNTRY_NAME}",
6+
"localityName": "${CA_LOCALITY_NAME}"
7+
},
8+
"keyUsage": [ "certSign", "crlSign" ],
9+
"basicConstraints": {
10+
"isCA": true,
11+
"maxPathLen": 1
12+
}
13+
}

‎argocd-helm-charts/step-ca/charts/step-certificates/examples/certificate_authority_single_instance/root-tls.json.tpl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"subject": {
3+
"commonName": "${ROOT_CA_NAME}",
4+
"organizationName": "${CA_ORG_NAME}",
5+
"countryName": "${CA_COUNTRY_NAME}",
6+
"localityName": "${CA_LOCALITY_NAME}"
7+
},
8+
"keyUsage": [ "certSign", "crlSign" ],
9+
"basicConstraints": {
10+
"isCA": true,
11+
"maxPathLen": 1
12+
}
13+
}

0 commit comments

Comments
 (0)