search

smallstep / helm-charts

Helm packages for Kubernetes
Apache License 2.0
49 stars 72 forks source link

[step-certificates]: AzureKMS support? #91

Closed Cpcrook closed 2 years ago

Cpcrook commented 2 years ago

Curious if it would be possible to support Azure KeyVault-stored keys. I produced a helm values.yam' locally, utilizing step ca init --helm noted here with the --kms=azurekms flag set, which appears to produce a reasonably valid values.yaml containing the public root & intermediate certs, and confirmed keys were created in kv. I then deployed this to my local cluster.

On container startup, the step-certificates container errors out with the following:

error reading azurekms:name=INTERMEDIATE-DEV-HELM;vault=kv-*******?version=86489f7b8fa9489b8f3d397350be9656

I imagine this has something to do with how step-certificates is getting bootstrapped and/or the lack of authentication w/ Azure within that container.

I'm going to poke around more at the implementation on the step-certificates side of things and see if I can figure things out, but any advice would be appreciated. I'd be happy to contribute docs / implementation for this if it is currently unsupported.

maraino commented 2 years ago

Closing, this was implemented with https://github.com/smallstep/helm-charts/pull/92 nd it is available in the last chart version of step-certificates.