Skip to content

Commit 3049550

Browse files
spbsolublespbsoluble
authored
Merge pull request #19 from Keyfactor/pan_feedback
Set Exportable Key Flag
2 parents cbd53a8 + 1fa203c commit 3049550

File tree

8 files changed

+444
-156
lines changed

8 files changed

+444
-156
lines changed

‎README.md

Lines changed: 37 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -117,9 +117,9 @@ This text would be entered in as the value for the __Server Password__, instead
117117
* [Security Considerations](#security-considerations)
118118
+ [Service Account Setup](#service-account-setup)
119119
* [Kubernetes Orchestrator Extension Installation](#kubernetes-orchestrator-extension-installation)
120-
* [Certificate Store Discovery](#certificate-store-discovery)
121120
* [Certificate Store Types](#certificate-store-types)
122121
+ [Configuration Information](#configuration-information)
122+
- [Store Path](#note-about-storepath)
123123
- [Common Values](#common-values)
124124
* [UI Basic Tab](#ui-basic-tab)
125125
* [UI Advanced Tab](#ui-advanced-tab)
@@ -230,7 +230,7 @@ must have the `tls.crt` and `tls.key` fields and may only contain a single key a
230230
## Versioning
231231

232232
The version number of a the Kubernetes Orchestrator Extension can be verified by right clicking on the
233-
`Kube.dll` file in the `<path>/<to>/<orchstrator install>/Extensions/Kubernetes` installation folder,
233+
`Kyefactor.Orchestrators.K8S.dll` file in the `<path>/<to>/<orchstrator install>/Extensions/Kubernetes` installation folder,
234234
selecting Properties, and then clicking on the Details tab.
235235

236236
## Security Considerations
@@ -305,12 +305,6 @@ subjects:
305305
certificates. See the [Certificate Store Discovery](#certificate-store-discovery) section later in this README for more
306306
information.
307307
308-
## Certificate Store Discovery
309-
**NOTE:** To use disovery jobs, you must have the story type created in Keyfactor Command and the `needs_server` checkbox MUST be checked.
310-
Otherwise you will not be able to provide credentials to the discovery job.
311-
312-
The Kubernetes Orchestrator Extension supports certificate discovery jobs. This allows you to populate the certificate stores with existing certificates. To run a discovery job, follow these steps:
313-
314308
## Certificate Store Types
315309
316310
When setting up the certificate store types you wish the Kubernetes Orchestrator Extension to
@@ -324,6 +318,16 @@ the creation of the desired store types.
324318
### Configuration Information
325319
Below is a table of the common values that should be used for all certificate store types.
326320

321+
#### Note about StorePath
322+
A Keyfactor Command certificate store `StorePath` for the K8S orchestrator extension can follow the following formats:
323+
324+
| Pattern | Description |
325+
|-----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------|
326+
| `secretName` | The name of the secret to use. This assumes `KubeNamespace` is defined or `default` and will be the `secret` or `cert` name on k8s. |
327+
| `namespace/secretName` | If `KubeNamespace` or `KubeSecretName` are not set, then the path will be split by `/` and the values will be parsed according to the pattern. |
328+
| `clusterName/namespace/secretName` | Same as above, clusterName is purely informational |
329+
| `clusterName/namespace/secretType/secretName` | Considered a `full` path, this is what discovery will return as `StorePath` |
330+
327331
#### Common Values
328332
##### UI Basic Tab
329333
| Field Name | Required | Description | Value |
@@ -347,11 +351,11 @@ Below is a table of the common values that should be used for all certificate st
347351
| PFX Password Style | | The password style used by the certificate store type. | Default |
348352

349353
##### Custom Fields Tab
350-
| Name | Display Name | Type | Required | Default Value | Description |
351-
|----------------|----------------------|--------|----------|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
352-
| KubeNamespace | Kube Namespace | String | | `default` | The Kubernetes namespace the store will reside. |
353-
| KubeSecretName | Kube Secret Name | String | | none | This field overrides `storepath` value. The Kubernetes secret or certificate resource name. |
354-
| KubeSecretType | Kube Secret Type | String | &check; | none | Must be one of the following `secret`, `secret_tls` or `cert`. See [kube-secret-types](#kube-secret-types). |
354+
| Name | Display Name | Type | Required | Default Value | Description |
355+
|----------------|----------------------|--------|----------|---------------|-------------------------------------------------------------------------------------------------------------|
356+
| KubeNamespace | Kube Namespace | String | | `default` | The Kubernetes namespace the store will reside. This will override the value parsed from `storepath`. |
357+
| KubeSecretName | Kube Secret Name | String | | none | This field overrides `storepath` value. The Kubernetes secret or certificate resource name. |
358+
| KubeSecretType | Kube Secret Type | String | &check; | none | Must be one of the following `secret`, `secret_tls` or `cert`. See [kube-secret-types](#kube-secret-types). |
355359

356360
##### Kube Secret Types
357361
- `secret` - A generic secret of type `Opaque`. Must contain a key of one of the following values: [ `cert`, `certficate`, `certs`,`certificates` ] to be inventoried.
@@ -392,12 +396,12 @@ kfutil store-types create --name K8SSecret
392396
![k8ssecret_basic.png](docs%2Fscreenshots%2Fstore_types%2Fk8ssecret_basic.png)
393397

394398
##### UI Advanced Tab
395-
| Field Name | Required | Value |
396-
|------------|----------|-----------|
397-
| Store Path Type | | Freeform |
399+
| Field Name | Required | Value |
400+
|-----------------------|----------|-----------|
401+
| Store Path Type | | Freeform |
398402
| Supports Custom Alias | | Forbidden |
399-
| Private Key Handling | | Optional |
400-
| PFX Password Style | | Default |
403+
| Private Key Handling | | Optional |
404+
| PFX Password Style | | Default |
401405

402406
![k8ssecret_advanced.png](docs%2Fscreenshots%2Fstore_types%2Fk8ssecret_advanced.png)
403407

@@ -442,12 +446,12 @@ kfutil store-types create --name K8STLSSecr
442446
![k8sstlssecr_basic.png](docs%2Fscreenshots%2Fstore_types%2Fk8sstlssecr_basic.png)
443447

444448
##### UI Advanced Tab
445-
| Field Name | Required | Value |
446-
|------------|----------|-----------|
447-
| Store Path Type | | Freeform |
449+
| Field Name | Required | Value |
450+
|-----------------------|----------|-----------|
451+
| Store Path Type | | Freeform |
448452
| Supports Custom Alias | | Forbidden |
449-
| Private Key Handling | | Optional |
450-
| PFX Password Style | | Default |
453+
| Private Key Handling | | Optional |
454+
| PFX Password Style | | Default |
451455

452456
![k8sstlssecr_advanced.png](docs%2Fscreenshots%2Fstore_types%2Fk8sstlssecr_advanced.png)
453457

@@ -490,12 +494,12 @@ kfutil store-types create --name K8SCert
490494
![k8scert_basic.png](docs%2Fscreenshots%2Fstore_types%2Fk8scert_basic.png)
491495

492496
##### UI Advanced Tab
493-
| Field Name | Required | Value |
494-
|------------|----------|-----------|
495-
| Store Path Type | | Freeform |
496-
| Supports Custom Alias | | Forbidden |
497-
| Private Key Handling | | Forbidden |
498-
| PFX Password Style | | Default |
497+
| Field Name | Required | Value |
498+
|-----------------------|----------|------------|
499+
| Store Path Type | | Freeform |
500+
| Supports Custom Alias | | Forbidden |
501+
| Private Key Handling | | Forbidden |
502+
| PFX Password Style | | Default |
499503

500504
![k8scert_advanced.png](docs%2Fscreenshots%2Fstore_types%2Fk8scert_advanced.png)
501505

@@ -517,6 +521,10 @@ Please refer to the Keyfactor Command Reference Guide for information on creatin
517521
certificate stores and scheduling Discovery jobs in Keyfactor Command.
518522

519523
## Certificate Discovery
524+
**NOTE:** To use disovery jobs, you must have the story type created in Keyfactor Command and the `needs_server` checkbox MUST be checked.
525+
Otherwise you will not be able to provide credentials to the discovery job.
526+
527+
The Kubernetes Orchestrator Extension supports certificate discovery jobs. This allows you to populate the certificate stores with existing certificates. To run a discovery job, follow these steps:
520528
1. Click on the "Locations > Certificate Stores" menu item.
521529
2. Click the "Discover" tab.
522530
3. Click the "Schedule" button.

‎kubernetes-orchestrator-extension/Clients/KubeClient.cs

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,37 @@ public class KubeCertificateManagerClient
3030
{
3131

3232
internal protected ILogger Logger;
33+
private string ConfigJson { get; set; }
34+
private K8SConfiguration ConfigObj { get; set; }
3335
public KubeCertificateManagerClient(string kubeconfig)
3436
{
3537
Logger = LogHandler.GetClassLogger(MethodBase.GetCurrentMethod().DeclaringType);
3638
Client = GetKubeClient(kubeconfig);
37-
39+
ConfigJson = kubeconfig;
40+
try
41+
{
42+
ConfigObj = ParseKubeConfig(kubeconfig);
43+
} catch (Exception ex)
44+
{
45+
ConfigObj = new K8SConfiguration() { };
46+
}
3847
}
3948

4049
private IKubernetes Client { get; set; }
4150

51+
public string GetClusterName()
52+
{
53+
Logger.LogTrace("Entered GetClusterName()");
54+
try
55+
{
56+
return ConfigObj.Clusters.FirstOrDefault()?.Name;
57+
} catch (Exception ex)
58+
{
59+
return GetHost();
60+
}
61+
62+
}
63+
4264
public string GetHost()
4365
{
4466
Logger.LogTrace("Entered GetHost()");
@@ -640,6 +662,7 @@ public List<string> DiscoverCertificates()
640662
Logger.LogTrace("csr.Items.Count: " + csr.Items.Count);
641663

642664
Logger.LogTrace("Entering foreach loop to add certificate locations to list.");
665+
var clusterName = GetClusterName();
643666
foreach (var cr in csr)
644667
{
645668
Logger.LogTrace("cr.Metadata.Name: " + cr.Metadata.Name);
@@ -669,12 +692,7 @@ public List<string> DiscoverCertificates()
669692
Logger.LogTrace("certName: " + certName);
670693

671694
Logger.LogDebug($"Adding certificate {certName} discovered location to list.");
672-
locations.Add($"certificate/{certName}");
673-
// else
674-
// {
675-
// // locations.Add(utfCsr);
676-
// continue;
677-
// }
695+
locations.Add($"{clusterName}/certificate/{certName}");
678696
}
679697

680698
Logger.LogDebug("Completed discovering certificates from k8s certificate resources.");
@@ -746,6 +764,9 @@ public List<string> DiscoverSecrets(string[] allowedKeys, string secType, string
746764
Logger.LogTrace("Finished calling CoreV1.ReadNamespacedSecret()");
747765
// Logger.LogTrace("secretData: " + secretData);
748766
Logger.LogTrace("Entering switch statement to check secret type.");
767+
768+
var clusterName = GetClusterName() ?? GetHost();
769+
749770
switch (secret.Type)
750771
{
751772
case "kubernetes.io/tls":
@@ -763,8 +784,8 @@ public List<string> DiscoverSecrets(string[] allowedKeys, string secType, string
763784

764785
Logger.LogDebug("Attempting to convert TLS certificate to X509Certificate2 object");
765786
_ = new X509Certificate2(secretData.Data["tls.crt"]); // Check if cert is valid
766-
767-
var cLocation = $"{nsObj.Metadata.Name}/secrets/{secret.Metadata.Name}";
787+
788+
var cLocation = $"{clusterName}/{nsObj.Metadata.Name}/secrets/{secret.Metadata.Name}";
768789
Logger.LogDebug($"Adding certificate location {cLocation} to list of discovered certificates");
769790
locations.Add(cLocation);
770791
secretsList.Add(certData);
@@ -803,7 +824,7 @@ public List<string> DiscoverSecrets(string[] allowedKeys, string secType, string
803824
secretsList.Append(cer);
804825
index++;
805826
}
806-
locations.Add($"{nsObj.Metadata.Name}/secrets/{secret.Metadata.Name}");
827+
locations.Add($"{clusterName}/{nsObj.Metadata.Name}/secrets/{secret.Metadata.Name}");
807828
}
808829
catch (Exception e)
809830
{

0 commit comments

Comments
 (0)