djkormo / adcs-issuer Goto Github PK
View Code? Open in Web Editor NEWThis project forked from dimatha/adcs-issuer
License: BSD 3-Clause "New" or "Revised" License
This project forked from dimatha/adcs-issuer
License: BSD 3-Clause "New" or "Revised" License
I would prefer if you would connect to the Microsoft Certificate Services CEP/CES instead of the HTTP website. Because the authentication with client certificate or Kerberos would be more secure. And because we do not know how long Microsoft supports the quite old HTTP website and CEP/CES is widely used. I found for example an implementation here: cepces . Do you plan to support CEP/CES in future?
Hi. I'm running this in a mixed cluster with linux and windows nodes. So I need to limit the deployment to linux nodes only.
I'll prepare a quick PR ;)
After much struggle I cannot get a grasp on how to install this. Could you provide some more info in the documentation! I want to use this cool project.
TODO
Hardening deployment of adcs-issuer
Starting point
Grade: C
Score: 75%
polaris audit --color --format pretty --only-show-failed-tests
Deployment adcs-issuer-controller-manager in namespace adcs-issuer
missingPodDisruptionBudget ๐ฌ Warning
Reliability - Should have a PodDisruptionBudget
deploymentMissingReplicas ๐ฌ Warning
Reliability - Only one replica is scheduled
metadataAndInstanceMismatched ๐ฌ Warning
Reliability - Label app.kubernetes.io/instance must match metadata.name
automountServiceAccountToken ๐ฌ Warning
Security - The ServiceAccount will be automounted
missingNetworkPolicy ๐ฌ Warning
Security - A NetworkPolicy should match pod labels and contain applied egress and ingress rules
priorityClassNotSet ๐ฌ Warning
Reliability - Priority class should be set
topologySpreadConstraint ๐ฌ Warning
Reliability - Pod should be configured with a valid topology spread constraint
Container manager
insecureCapabilities ๐ฌ Warning
Security - Container should not have insecure capabilities
notReadOnlyRootFilesystem ๐ฌ Warning
Security - Filesystem should be read only
privilegeEscalationAllowed โ Danger
Security - Privilege escalation should not be allowed
linuxHardening ๐ฌ Warning
Security - Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
readinessProbeMissing ๐ฌ Warning
Reliability - Readiness probe should be configured
livenessProbeMissing ๐ฌ Warning
Reliability - Liveness probe should be configured
Adding adcs simulator as optional deployment in adcs issuer helm chart
spec:
containers:
- args:
- --enable-leader-election=true
- --cluster-resource-namespace=cert-manager
- --zap-log-level=5
- --disable-approved-check=false
-
env:
- name: ENABLE_WEBHOOKS
value: "false"
- name: ENABLE_DEBUG
value: "false"
I think I have it as described in the readme, but for some reason I cant get the issuer. Please find the logs attached below.
Aren't you missing sort of decodedCABundle, err := base64.StdEncoding.DecodeString(certs)
after https://github.com/djkormo/adcs-issuer/blob/master/issuers/issuer_factory.go#L118 ?
apiVersion: adcs.certmanager.csf.nokia.com/v1
kind: ClusterAdcsIssuer
metadata:
name: pki.some_company.xyz
spec:
caBundle: [ 'base64 -i bundle.p7b']
# (...) remainder omitted
ts=2024-03-12T12:13:17.357193955Z level=error msg="Couldn't get issuer" controller=adcsrequest controllerGroup=adcs.certmanager.csf.nokia.com controllerKind=AdcsRequest AdcsRequest="{tls.dev2.meta.some_company.xyz-v6g6h helm-chart-update}" namespace=helm-chart-update name=tls.dev2.meta.some_company.xyz-v6g6h reconcileID=a113859f-128f-469b-8065-e1aeaab998a3 adcsrequest="{tls.dev2.meta.some_company.xyz-v6g6h helm-chart-update}" issuer="{pki.some_company.xyz ClusterAdcsIssuer adcs.certmanager.csf.nokia.com}" error="error loading ADCS CA bundle" stacktrace="github.com/nokia/adcs-issuer/controllers.(*AdcsRequestReconciler).Reconcile\n\t/workspace/controllers/adcsrequest_controller.go:75\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227"
ts=2024-03-12T12:13:17.35727353Z level=error msg="Reconciler error" controller=adcsrequest controllerGroup=adcs.certmanager.csf.nokia.com controllerKind=AdcsRequest AdcsRequest="{tls.dev2.meta.some_company.xyz-v6g6h helm-chart-update}" namespace=helm-chart-update name=tls.dev2.meta.some_company.xyz-v6g6h reconcileID=a113859f-128f-469b-8065-e1aeaab998a3 error="error loading ADCS CA bundle" stacktrace="sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:329\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227"
ts=2024-03-12T12:14:39.277655181Z level=info msg="Processing request" controller=adcsrequest controllerGroup=adcs.certmanager.csf.nokia.com controllerKind=AdcsRequest AdcsRequest="{tls.dev2.meta.some_company.xyz-v6g6h helm-chart-update}" namespace=helm-chart-update name=tls.dev2.meta.some_company.xyz-v6g6h reconcileID=acbb4f24-6cda-4965-ab66-c29894f01275 adcsrequest="{tls.dev2.meta.some_company.xyz-v6g6h helm-chart-update}"```
There is an example on https://github.com/djkormo/adcs-issuer
metadata:
name: test-ingress
annotations:
cert-manager.io/issuer: "adcs-issuer" #use specific name of issuer
cert-manager.io/issuer-kind: "AdcsIssuer" #or AdcsClusterIssuer
cert-manager.io/issuer-group: "adcs.certmanager.csf.nokia.com"
Need to correct
metadata:
name: test-ingress
annotations:
cert-manager.io/issuer: "adcs-issuer" #use specific name of issuer
cert-manager.io/issuer-kind: "AdcsIssuer" #or ClusterAdcsIssuer
cert-manager.io/issuer-group: "adcs.certmanager.csf.nokia.com"
{"level":"error","ts":1651243965.581744,"logger":"setup","msg":"problem running manager","error":"open /tmp/k8s-webhook-server/serving-certs/tls.crt: no such file or directory","stacktrace":"main.main\n\t/workspace/main.go:162\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:255"}
For cert-manager deployed via helm chart it is important to correct RBAC permissions for accepting and denying ADCS issuers.
Hello,
I'm trying to test this issuer in my environment, and am having a really hard time trying to understand how to apply the CRDs to my environment.
trying to install the helm chart tells me that I need the CRDs installed.
Error: INSTALLATION FAILED: unable to build kubernetes objects from release manifest: resource mapping not found for name: "adcs-sim-adcsclusterissuer" namespace: "" from "": no matches for kind "ClusterAdcsIssuer" in version "adcs.certmanager.csf.nokia.com/v1"
I tried to make
the repository like the docs said, and see if that generated the CRDs , but I get the following error:
/home/mark/source/adcs-issuer/bin/controller-gen rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
bash: line 1: /home/mark/source/adcs-issuer/bin/controller-gen: No such file or directory
I feel like I'm missing something here in order to user this issuer.
The current chart is very strict.
Switching to a chart library template would give the chart instantly a lot more flexibility.
I used Common library recently and it's a treat
TODO
Hardening deployment of adcs simulator
Starting point
Grade: D
Score: 65%
polaris audit --color --format pretty --only-show-failed-tests
Deployment adcs-sim-deployment in namespace adcs-issuer
metadataAndInstanceMismatched ๐ฌ Warning
Reliability - Label app.kubernetes.io/instance must match metadata.name
missingPodDisruptionBudget ๐ฌ Warning
Reliability - Should have a PodDisruptionBudget
deploymentMissingReplicas ๐ฌ Warning
Reliability - Only one replica is scheduled
automountServiceAccountToken ๐ฌ Warning
Security - The ServiceAccount will be automounted
missingNetworkPolicy ๐ฌ Warning
Security - A NetworkPolicy should match pod labels and contain applied egress and ingress rules
priorityClassNotSet ๐ฌ Warning
Reliability - Priority class should be set
topologySpreadConstraint ๐ฌ Warning
Reliability - Pod should be configured with a valid topology spread constraint
Container manager
runAsRootAllowed โ Danger
Security - Should not be allowed to run as root
linuxHardening ๐ฌ Warning
Security - Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
notReadOnlyRootFilesystem ๐ฌ Warning
Security - Filesystem should be read only
privilegeEscalationAllowed โ Danger
Security - Privilege escalation should not be allowed
insecureCapabilities ๐ฌ Warning
Security - Container should not have insecure capabilities
livenessProbeMissing ๐ฌ Warning
Reliability - Liveness probe should be configured
readinessProbeMissing ๐ฌ Warning
Reliability - Readiness probe should be configured
ConfigMap adcs-sim-configmap in namespace adcs-issuer
sensitiveConfigmapContent โ Danger
Security - Potentially sensitive content is detected in the ConfigMap keys or values
Customize how long the generated certificate is valid.
https://github.com/search?q=repo%3Adjkormo/adcs-issuer%20NotAfter&type=code
Hello,
Is there a way to bypass the TLS check when calling the ADCS Certserv.
In my company, the ADCS server certificate is expired, and I'm not able to renew it by myself. I've encountered the following error :
ts=2024-03-13T17:28:38.789851847Z level=error logger=RequestCertificate msg="ADCS Certserv error" template=WebServer error="Post \"https://<adcs_server>/certsrv/certfnsh.asp\": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2024-03-13T17:28:38Z is after 2019-06-12T14:47:53Z" stacktrace="github.com/nokia/adcs-issuer/adcs.(*NtlmCertsrv).RequestCertificate\n\t/workspace/adcs/ntlm_certsrv.go:262\ngithub.com/nokia/adcs-issuer/issuers.(*Issuer).Issue\n\t/workspace/issuers/issuer.go:57\ngithub.com/nokia/adcs-issuer/controllers.(*AdcsRequestReconciler).Reconcile\n\t/workspace/controllers/adcsrequest_controller.go:83\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227"
Can we ignore this kind of errors ?
Thanks
Create helm chart for adcs-issuer operator
Hello,
I'm starting to use this plugin and I've noticed that the default version is still 2.0.8.
I imagine that the release 2.0.10 (for the docker image will arrive soon), so I made a PR to put in the meantime the version 2.0.9 by default.
Thank you for maintaining this plugin and for the work you've done.
@djkormo Czeลฤ Krzysztof
First of all, thank you for this repo.
I rolled out the controller using the helmet chart. It runs in the namespace adcs-isuer
.
The missing and claimed secret adcs-issuer-secret
is actually also in the same namespace.
namespace=adcs-issuer error="Secret \"adcs-issuer-secret\" not found"
So i don't understand why he can't find the secret.
Any idea what I am doing wrong here?
Pozdrowienia z Niemiec do Polski.
I just want to thank you for maintaining adcs-issuer.
I appreciate it because this software is useful for me and og repo by nokia seems to be inactive.
Thank you very much.
Using the 2.0.5 Helm Chart for installation, I'm getting this error
ts=2023-11-29T08:42:03.489508343Z level=info logger=setup msg="Starting ADCS Issuer" version=adcs-operator-by-djkormo buildtime=2022-12-18:11:00
ts=2023-11-29T08:42:03.489879343Z level=error logger=controller-runtime.client.config msg="unable to get kubeconfig" error="invalid configuration: no configuration has been provided, try setting KUBERNETES_MASTER environment variable" errorCauses="["error=\"no configuration has been provided, try setting KUBERNETES_MASTER environment variable\""]" stacktrace="sigs.k8s.io/controller-runtime/pkg/client/config.GetConfigOrDie\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/client/config/config.go:153\nmain.main\n\t/workspace/main.go:112\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:255"
As far as I can tell, the missing "KUBERNETES_MASTER" variable is never set during installation.
Current Environment:
-Kubernetes v1.24.10 RKE2 Cluster
-Rancher 2.7.0
-Certmanager 1.12.0
I noticed in values.yaml, it's still pointing to 2.1.0 even though 2.1.1 is mentioned as the latest release. Is this accurate?
I just can't figure out why the adcs-issuer pod outputs this error on the console:
ts=2024-04-09T15:09:01.543158806Z level=error msg="Reconciler error" controller=adcsrequest
controllerGroup=adcs.certmanager.csf.nokia.com controllerKind=AdcsRequest AdcsRequest="{tls-bagetter-1 bagetter}"
namespace=bagetter name=tls-bagetter-1 reconcileID=5f20f147-1bf9-4317-a6b9-630b1c715416 error="Secret \"adcs-issuer-
credentials\" not found" stacktrace="sigs.k8s.io/controller-runtime/pkg/internal/controller.
(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-
[email protected]/pkg/internal/controller/controller.go:329\nsigs.k8s.io/controller-runtime/pkg/internal/controller.
(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-
[email protected]/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.
(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227"
These are the steps I took:
Secret
and a AdcsClusterIssuer
see belowIngress
and added the annotations---
apiVersion: v1
kind: Secret
metadata:
name: adcs-issuer-credentials
namespace: cert-manager
type: Opaque
data: # Base64 encoded
password: REDACTED # Password
username: REDACTED # Username
---
apiVersion: adcs.certmanager.csf.nokia.com/v1
kind: AdcsClusterIssuer
metadata:
name: my-adcs
namespace: cert-manager
spec:
caBundle: [ .... ]
credentialsRef:
name: adcs-issuer-credentials
statusCheckInterval: 5m
retryInterval: 5m
url: "http://myca/certsrv"
templateName: "My-Webserver-2Y"
This is from another helm chart
values:
ingress:
bagetter-ingress:
enabled: true
className: nginx
annotations:
kubernetes.io/ingress.class: nginx
cert-manager.io/issuer: my-adcs
cert-manager.io/issuer-kind: ClusterAdcsIssuer
cert-manager.io/issuer-group: adcs.certmanager.csf.nokia.com
cert-manager.io/renew-before: 48h
Ingress
shows event CreateCertificate
Certificate
shows events Requested
and Issuing
Certificate Request
shows events Pending
and approved by cert-manager
adcs-issuer
pod shows error message from up thereThe secret can be access via kubectl get secret adcs-issuer-credentials -n cert-manager
I just can't find the issue...
Hi, I am currently implementing the adcs plugin with cert-manager, and I can't see any reference to revoking certificates when deleting the certificate item from the cluster.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.