search

nokia / adcs-issuer

BSD 3-Clause "New" or "Revised" License
41 stars 43 forks source link

Compiled Version? #1

Open makeacode opened 4 years ago

makeacode commented 4 years ago

I don't have the ability to build the CRDs or image at my organization because we limit the internet locations we can access. Is there any way you can build the image and push to DockerHub and make the CRDs part of a release?

makeacode commented 4 years ago

caveat...still learning about CRDs...I now realize the CRDs are actually in the config/crds path as the installation section states...but I would still need the image built

chojnack commented 4 years ago

Hi, We're working currently on making adcs-issuer compatibile with newest cert-manager release. We'll also try to create a builded and easily installable release soon. Thank you.

Marcin Chojnacki

makeacode commented 4 years ago

@chojnack Thanks fo rhte response...looking forward to testing this out soon. I'll probably experiment with the current release and see what I can get going...if anything.

eyolas commented 4 years ago

hi @chojnack, any news ?

ctrought commented 3 years ago

Also interested in a compiled version 👍

BatmaniNRobin commented 3 years ago

Interested in this as well ! 🙏

ctrought commented 3 years ago

Interested in this as well ! 🙏

I ended up building with kubebuilder as per their docs. The template it generates is available here, I have pushed the controller image to docker.io as well.

https://github.com/ctrought/adcs-issuer/blob/master/template.yaml https://hub.docker.com/r/ctrought/adcs-issuer

Antebios commented 3 years ago

@ctrought Thank you for the template and container image! I had to update the template to get it installed in my k8s 1.22.1 cluster. I also discovered that I needed to have the "certificate.yaml" applied to the adcs-issuer namespace first before the Pod would start up. Now I need to create an Issuer for my Active Directory Certificate Server, wish me luck!

ctrought commented 3 years ago

@ctrought Thank you for the template and container image! I had to update the template to get it installed in my k8s 1.22.1 cluster. I also discovered that I needed to have the "certificate.yaml" applied to the adcs-issuer namespace first before the Pod would start up. Now I need to create an Issuer for my Active Directory Certificate Server, wish me luck!

No problem, glad it helped! If you have trouble with the image let me know, I believe that image was built based an older version of certmanager which is mentioned in the (now) outdated readme.

ADCS Issuer has been tested with cert-manager v.0.11.0 and currently supports CertificateRequest CRD API version v1alpha2 only.

There are some kubernetes apis that were in these versions that were deprecated and are now removed in 1.22 which means that build I have likely won't work on 1.22, and I am guessing thats also probably why you had to update the template (beta webhook + admission apis were part of those removed in 1.22 as they are now v1) you can read about that here.

https://cert-manager.io/docs/release-notes/release-notes-1.5/#api-deprecation

There have been some commits by some other helpful people in this repo to bring it more up to date and leverage cert-manager 1.3+ and the v1 api, so I will likely rebuild and push a new version in case anyone has trouble building themselves.

Antebios commented 3 years ago

@ctrought Thank you for the feedback. I did use that documentation link to update the configuration file. I think I will absolutely like a newer build of the controller. It is failing to submit my CSR to my ADCS server because it is failing to find the Issuer Credentials, but I know it's all there in the same namespace. Secret \"test-adcs-issuer-credentials\" not found"

If I get this up and running successfully I hope to document my journey in some sort of guide in both here in GitHub and Medium.

ctrought commented 3 years ago

@ctrought Thank you for the feedback. I did use that documentation link to update the configuration file. I think I will absolutely like a newer build of the controller. It is failing to submit my CSR to my ADCS server because it is failing to find the Issuer Credentials, but I know it's all there in the same namespace. Secret \"test-adcs-issuer-credentials\" not found"

If I get this up and running successfully I hope to document my journey in some sort of guide in both here in GitHub and Medium.

There is a flag that is used to set this in the controller-manager pod args, if not set it uses kube-system to look for cluster resources including the secret. I ran into this issue too, it was quite a mystery to me :) So you can either add the flag to the deployment arg or move the secret to kube-system.

The code

flag.StringVar(&clusterResourceNamespace, "cluster-resource-namespace", "kube-system", "Namespace where cluster-level resources are stored.")

Example

spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: controller-manager
  template:
    metadata:
      labels:
        control-plane: controller-manager
    spec:
      containers:
      - args:
        - --metrics-addr=127.0.0.1:8080
        - --enable-leader-election
        - --cluster-resource-namespace="adcs-installed-namespace"
ctrought commented 3 years ago

@ctrought Thank for your help thus far, my error message is resolved. I finally have it attempting to submit a CSR, but now I am being challenged with authentication:

<title>401 - Unauthorized: Access is denied due to invalid credentials.</title>

It is obviously the credentials. apiVersion: v1 data: password: somepassword # base64 encoded username: MyDomain\LogonName # base64 encoded kind: Secret metadata: name: test-adcs-issuer-credentials namespace: adcs-issuer-system type: Opaque

What username and password should I be using? I am using my domain's logon and password, and I can see them clearly in the k8s dashboard. I am sooooo close.

Indeed you look very close! Unfortunately I can't really say for sure what credentials you should be using. In my case, I don't need to provide the domain with my username but I don't know whether that would be the same for you. Have you/are you able to try authenticating via web browser to verify that your ADCS is accepting those credentials?

Antebios commented 3 years ago

@ctrought I'm sorry, but I submitted that response by mistake. I had set my login User Name incorrectly. I corrected it and now I can authenticate the ADCS website and seeing in the log: 1 ntlm_certsrv.go:316] Getting CA Chain from ADCS Certsrv http://macross-dc.macross.com/certsrv/

The status message I see in the CertificateRequest object is ADCS request rejected. I attempted to submit a certificate manually using the ADCS website and I received the error message: Your Request Id is 6. The disposition message is "Error Parsing Request ASN1 bad tag value met. 0x8009310b (ASN: 267 CRYPT_E_ASN1_BADTAG)".

I suspect it might be because I had to remove the Organization attribute from the Certificate Request since cert-manager.io/v1 did not like it. But I am finally making good progress, thanks to you!

karezza commented 3 years ago

@ctrought I am also interested in an updated image

Given a note you posted before, maybe things are not going to work because I'm trying to use the latest and greatest cert-manager version:

ADCS Issuer has been tested with cert-manager v.0.11.0 and currently supports CertificateRequest CRD API version v1alpha2 only.
$ kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.3/cert-manager.yaml
customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io created
...
$ k apply -f template.yaml 
...
unable to recognize "template.yaml": no matches for kind "CustomResourceDefinition" in version "apiextensions.k8s.io/v1beta1"
unable to recognize "template.yaml": no matches for kind "CustomResourceDefinition" in version "apiextensions.k8s.io/v1beta1"
unable to recognize "template.yaml": no matches for kind "CustomResourceDefinition" in version "apiextensions.k8s.io/v1beta1"
unable to recognize "template.yaml": no matches for kind "MutatingWebhookConfiguration" in version "admissionregistration.k8s.io/v1beta1"
unable to recognize "template.yaml": no matches for kind "ValidatingWebhookConfiguration" in version "admissionregistration.k8s.io/v1beta1"
$ k version
Client Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.1", GitCommit:"632ed300f2c34f6d6d15ca4cef3d3c7073412212", GitTreeState:"clean", BuildDate:"2021-08-19T15:45:37Z", GoVersion:"go1.16.7", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.1", GitCommit:"632ed300f2c34f6d6d15ca4cef3d3c7073412212", GitTreeState:"clean", BuildDate:"2021-08-19T15:39:34Z", GoVersion:"go1.16.7", Compiler:"gc", Platform:"linux/amd64"}
Antebios commented 3 years ago

@karezza I also got those errors when applying the "template.yaml", so I had to manually update the failed components so they would work with k8s v1.22.x. It took me trial and error, but I did it. Now, did I do it correctly? I don't know. Everything looks like I did and you can see the challenges I had/have above.

ctrought commented 3 years ago

@ctrought I am also interested in an updated image

Given a note you posted before, maybe things are not going to work because I'm trying to use the latest and greatest cert-manager version:

ADCS Issuer has been tested with cert-manager v.0.11.0 and currently supports CertificateRequest CRD API version v1alpha2 only.
$ kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.3/cert-manager.yaml
customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io created
...
$ k apply -f template.yaml 
...
unable to recognize "template.yaml": no matches for kind "CustomResourceDefinition" in version "apiextensions.k8s.io/v1beta1"
unable to recognize "template.yaml": no matches for kind "CustomResourceDefinition" in version "apiextensions.k8s.io/v1beta1"
unable to recognize "template.yaml": no matches for kind "CustomResourceDefinition" in version "apiextensions.k8s.io/v1beta1"
unable to recognize "template.yaml": no matches for kind "MutatingWebhookConfiguration" in version "admissionregistration.k8s.io/v1beta1"
unable to recognize "template.yaml": no matches for kind "ValidatingWebhookConfiguration" in version "admissionregistration.k8s.io/v1beta1"
$ k version
Client Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.1", GitCommit:"632ed300f2c34f6d6d15ca4cef3d3c7073412212", GitTreeState:"clean", BuildDate:"2021-08-19T15:45:37Z", GoVersion:"go1.16.7", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.1", GitCommit:"632ed300f2c34f6d6d15ca4cef3d3c7073412212", GitTreeState:"clean", BuildDate:"2021-08-19T15:39:34Z", GoVersion:"go1.16.7", Compiler:"gc", Platform:"linux/amd64"}

I will post the latest compiled version and updated template next week (away from laptop at the moment).

ctrought commented 3 years ago

@Antebios @karezza I have pushed a newer build, tagged 0.3. The generated template.yaml assumes cert manager is installed under the cert-manager namespace. https://hub.docker.com/repository/docker/ctrought/adcs-issuer

karezza commented 2 years ago

@ctrought @Antebios, I've cloned ctrought's repository & followed the steps at the https://book.kubebuilder.io/quick-start.html#installation site. Some quick questions:

ctrought commented 2 years ago

@karezza

I end up with a pod adcs-issuer-controller-manager looking for a secret webhook-server-cert, but I don't see this in the instructions, do I need to set this up (or does this not matter if I set up to auto approve?)

This secret should contain a cert for the webhook service. In my case I am using OpenShift, so I am simply annotating the service and the cluster network operator takes care of creating the certificate signed by the internal CA.

For others that might mean using cert-manager to create an internally signed certificate for the adcs-issuer-webhook-service, you can find some examples here and it shows the annotations you'd need to add to the Mutating/Validating webhook CR's to have cert-manager inject the CA config into it (actually there are a bunch of lines in the kustomization.yaml configs that are commented, that if uncommented will do all this for you, see config/certmanager/certificate.yaml, config/crd/kustomization.yaml,config/default/kustomization.yaml When kubernetes calls the webhooks, it needs to be aware of the CA in order to verify the webhooks certificate.

You might even use the kubernetes provided api to do this if you didn't want to use cert-manager internal signer for some reason.

The example issuer has an attribute "url: " what is that url, or again, does this not matter if it is setup to auto approve?

If you're trying configuring an ADCS issuer, you will need to provide the URL for the ADCS endpoint that issues the certificates. It would be some external endpoint like this https://<internal-host>.ca/certsrv

caBundle: It's not obvious to me what this should be based on the instructions, it sounds like this is specific to the ADCS controller, ad not the actual ca, initially I would have thought this would be the public key of the ca ... rather than guess, what is it expecting?

This has to do with the ADCS url as it will be signed by some certificate authority, so we need to provide that to ADCS issuer so it can verify the cert during it's API requests when retrieving certs.

ps: if you had any specific errors from the template that I stuck in my fork, would you be able to open an issue there or let me know any errors you encountered relating to the spec?

lknite commented 2 years ago

It's not clear to me what to uncomment or not. Are you thinking to put together a helm chart and keep this going? Your efforts would certainly be appreciated.

xargyx commented 2 years ago

I got the new adcs-issuer working with the latest cert-manager and it produces a valid certificate (stored in the tls cert field). However the ca cert that is stored inside the the certificate is incorrect (idk what value it's getting now). It used to get the adcs issuer certificate in that field (same value in the caBundle field). Not exactly sure if the adcs-issuer or cert manager stores that field. If i manually edit the certificate and put the adcs issuer cert in that field the cert works fine.

I didn't see anything in the code changes that would impact this, so I'm thinking it must be something different in cert-manager.

Antebios commented 2 years ago

@ctrought There is a tiny mistake in your template.yaml file. There needs to be a "---" separator after line # 267. It needs to separate the CRD from the Namespace. Applying it was failing for me until I figured it out.

status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
apiVersion: v1
kind: Namespace
metadata:
  labels:
    control-plane: controller-manager
  name: adcs-issuer-system
---
Antebios commented 2 years ago

@ctrought I was finally able to put time aside to try to get this working. I was excited, but my hopes were dashed.

My test AdcsIssuer (cert-manager.io --> Certificate --> test-adcs) has a message that says: Issuing certificate as Secret does not exist

There was a secret created within the "adcs-issuer-system" namespace named after my test certificate request, "adcs-cert", that contains a valid tls.key

The adcs-issuer-controller-manager pod --> "manager container is throwing this error message: 1 leaderelection.go:329] error initially creating leader election record: leases.coordination.k8s.io is forbidden: User "system:serviceaccount:adcs-issuer-system:default" cannot create resource "leases" in API group "coordination.k8s.io" in the namespace "adcs-issuer-system"

ctrought commented 2 years ago

cannot create resource "leases" in API group "coordination.k8s.io" in the namespace "adcs-issuer-system

Sorry, I had encountered this a while ago and committed changes to a private repo I mainly use but not the public one. The template has been updated which simply adds the create verb for leases to the role.

As for the message about the secret, this is generated by cert-manager when it detects the secret referenced by the Certificate resource to store the issued key/cert does not exist. It would be looking in the same namespace where the Certificate resource exists, which is not necessarily adcs-issuer-system. It is more informational though, as it needs to have adcs-issuer fetch the cert from ADCS and then save to the secret.

Antebios commented 2 years ago

@ctrought Thanks for the response. I updated my template.yaml and then re-created by certificate request with no other changes... and it worked and failed at the same time.

It worked because it was able to communicate with my AD Certificate Server. And it failed because the certificate request was denied because the template being submitted wasn't correct.

status:
  id: '9'
  reason: >-
    Denied by Policy Module  0x80094800, The request was for a certificate
    template that is not supported by the Active Directory Certificate Services
    policy: BasicSSLWebServer. The requested certificate template is not
    supported by this CA. 0x80094800 (-2146875392
    CERTSRV_E_UNSUPPORTED_CERT_TYPE)
  state: rejected

Here is my certificate request (don't worry, this is my internal homelab domain):

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  annotations:
  name: adcs-cert
  namespace: adcs-issuer-system
spec:
  commonName: smartconnect.macross.com
  dnsNames:
  - smartconnect
  - smartconnect.macross.com
  issuerRef:
    group: adcs.certmanager.csf.nokia.com
    kind: AdcsIssuer
    name: test-adcs
  #organization:
  #- MPI
  secretName: adcs-cert

I'm almost there... I can feel it!

xargyx commented 2 years ago

@Antebios in the issuer.go file the template is populated with

adcsCertTemplate = "BasicSSLWebServer"

I took the changes here

https://github.com/SimeonPoot/adcs-issuer/commit/9ba12af785ab5684e732f3e303fa7aae766d34d9

and built my own image with the new repo and added those changes to make the template configurable. If you're looking for the ability to make the template name configurable.

Antebios commented 2 years ago

@xargyx Is your adcs controller docker image on docker hub? Otherwise, I need to create my own? What yaml change(s) do I need to make for my certificate request to set the template to use?

@ctrought Are you going to make the same changes?

xargyx commented 2 years ago

@ctrought thank you for the work you put in! I'm able to get certificates now on the most recent cert manager.

@Antebios I did put it on dockerhub, all you gotta do is add the argument (line 825 on the template.yaml)