https://buildrunrepeat.com/tags/intermediateca/Recent content in Intermediateca on Build. Run. Repeat.HugoenMon, 01 Jan 2024 09:00:00 -0400https://buildrunrepeat.com/posts/hashicorp-vault-intermediate-ca-setup-with-cert-manager-and-ms-root-ca/Mon, 01 Jan 2024 09:00:00 -0400https://buildrunrepeat.com/posts/hashicorp-vault-intermediate-ca-setup-with-cert-manager-and-ms-root-ca/<p>In this post, we&rsquo;ll explore how to set up HashiCorp Vault as an Intermediate Certificate Authority (CA) on a Kubernetes cluster, using a Microsoft CA as the Root CA. We&rsquo;ll then integrate this setup with cert-manager, a powerful Kubernetes add-on for automating the management and issuance of TLS certificates.</p> <p>The following is an architecture diagram for the use case I&rsquo;ve built.</p> <p> <a href="https://buildrunrepeat.com/posts/hashicorp-vault-intermediate-ca-setup-with-cert-manager-and-ms-root-ca/images/019.png" data-dimbox data-dimbox-caption="Screenshot"> <img alt="Screenshot" src="https://buildrunrepeat.com/posts/hashicorp-vault-intermediate-ca-setup-with-cert-manager-and-ms-root-ca/images/019.png"/> </a> </p> <ul> <li>A Microsoft Windows server is used as the Root CA of the environment.</li> <li>A Kubernetes cluster hosting shared/common services, including HashiCorp Vault. This is a cluster that can serve many other purposes/solutions, consumed by other clusters. The Vault server is deployed on this cluster and serves as an intermediate CA server, under the Microsoft Root CA server.</li> <li>A second Kubernetes cluster hosting the application(s). Cert-Manager is deployed on this cluster, integrated with Vault, and handles the management and issuance of TLS certificates against Vault using the ClusterIssuer resource. A web application, exposed via ingress, is running on this cluster. The ingress resource consumes its TLS certificate from Vault.</li> </ul> <h2 id="prerequisites">Prerequisites</h2> <ul> <li>Atleast one running Kubernetes cluster. To follow along, you will need two Kubernetes clusters, one serving as the shared services cluster and the other as the workload/application cluster.</li> <li>Access to a Microsoft Root Certificate Authority (CA).</li> <li>The Helm CLI installed.</li> <li>Clone my <a href="https://github.com/itaytalmi/k8s-vault-int-ca.git">GitHub repository</a>. This repository contains all involved manifests, files and configurations needed.</li> </ul> <h2 id="setting-up-hashicorp-vault-as-intermediate-ca">Setting Up HashiCorp Vault as Intermediate CA</h2> <h3 id="deploy-initialize-and-configure-vault">Deploy Initialize and Configure Vault</h3> <p>Install the Vault CLI. In the following example, Linux Ubuntu is used. If you are using a different operating system, refer to <a href="https://developer.hashicorp.com/vault/install">these instructions</a>.</p>