Skip to content

Commit e23367e

Browse files
committed
Updating documentation
1 parent 614d1d9 commit e23367e

File tree

10 files changed

+175
-119
lines changed

10 files changed

+175
-119
lines changed

config/config.yaml

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,10 @@ bootstrap:
33
url: https://api.venafi.cloud
44
auth:
55
privateKeyFile: /etc/firefly/private-key.pem
6-
clientID: d2170df3-c468-11ee-88fe-72744281ddfc
6+
clientID: f531953f-c51c-11ee-aa38-62722f50b33a
77
csr:
88
instanceNaming: Demo
99
server:
10-
rest:
11-
port: 8281
12-
tls:
13-
dnsNames:
14-
- firefly.venafi.example
15-
ipAddress: 127.0.0.1
10+
grpc:
11+
uds:
12+
socketPath: /opt/firefly/grpc.sock

config/general-config.yaml

Lines changed: 85 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -1,86 +1,86 @@
1-
bootstrap:
2-
selfSigned:
3-
csr:
4-
commonName: Demo
5-
privateKey:
6-
algorithm: ECDSA
7-
size: 256
8-
duration: 8760h # one year
9-
trustRootDirectory: /etc/firefly/trust
10-
signer:
11-
inMemory: true
12-
server:
13-
rest:
14-
port: 8281
15-
tls:
16-
dnsNames:
17-
- firefly.venafi.example
18-
ipAddress: 127.0.0.1
19-
authentication:
20-
jwt:
21-
# oidc:
22-
# baseUrl: http://superfuzz.venafi.example:8000
23-
# audience: firefly
24-
jwks:
25-
urls:
26-
- http://jwt-this.example:8000/.well-known/jwks.json
27-
authorization:
28-
configuration: Basic Demo
29-
policies:
30-
- name: Basic Demo
31-
subject:
32-
commonName:
33-
type: OPTIONAL
34-
allowedValues:
35-
- ^.*\.vena\.fi
36-
maxOccurrences: 1
37-
organization:
38-
type: LOCKED
39-
defaultValues:
40-
- Venafi, Inc.
41-
organizationalUnit:
42-
type: IGNORED
43-
locality:
44-
type: OPTIONAL
45-
allowedValues:
46-
- Sofia
47-
- London
48-
defaultValues:
49-
- Sofia
50-
maxOccurrences: 1
51-
stateOrProvince:
52-
type: IGNORED
53-
country:
54-
type: REQUIRED
55-
allowedValues:
56-
- BG
57-
- GB
58-
minOccurrences: 1
59-
maxOccurrences: 1
60-
sans:
61-
dnsNames:
62-
type: REQUIRED
63-
allowedValues:
64-
- ^.*\.vena\.fi
65-
minOccurrences: 1
66-
maxOccurrences: 10
67-
ipAddresses:
68-
type: FORBIDDEN
69-
rfc822Names:
70-
type: IGNORED
71-
uniformResourceIdentifiers:
72-
type: FORBIDDEN
73-
keyUsages:
74-
- digitalSignature
75-
- keyEncipherment
76-
extendedKeyUsages:
77-
- SERVER_AUTH
78-
- CLIENT_AUTH
79-
keyAlgorithm:
80-
allowedValues:
81-
- EC_P256
82-
- EC_P384
83-
- EC_P521
84-
defaultValue: EC_P256
85-
signatureAlgorithm: EC_DSA_WITH_SHA256
1+
bootstrap:
2+
selfSigned:
3+
csr:
4+
commonName: Demo
5+
privateKey:
6+
algorithm: ECDSA
7+
size: 256
8+
duration: 8760h # one year
9+
trustRootDirectory: /etc/firefly/trust
10+
signer:
11+
inMemory: true
12+
server:
13+
rest:
14+
port: 8281
15+
tls:
16+
dnsNames:
17+
- firefly.venafi.example
18+
ipAddress: 127.0.0.1
19+
authentication:
20+
jwt:
21+
# oidc:
22+
# baseUrl: http://superfuzz.venafi.example:8000
23+
# audience: firefly
24+
jwks:
25+
urls:
26+
- http://jwt-this.example:8000/.well-known/jwks.json
27+
authorization:
28+
configuration: Basic Demo
29+
policies:
30+
- name: Basic Demo
31+
subject:
32+
commonName:
33+
type: OPTIONAL
34+
allowedValues:
35+
- ^.*\.vena\.fi
36+
maxOccurrences: 1
37+
organization:
38+
type: LOCKED
39+
defaultValues:
40+
- Venafi, Inc.
41+
organizationalUnit:
42+
type: IGNORED
43+
locality:
44+
type: OPTIONAL
45+
allowedValues:
46+
- Sofia
47+
- London
48+
defaultValues:
49+
- Sofia
50+
maxOccurrences: 1
51+
stateOrProvince:
52+
type: IGNORED
53+
country:
54+
type: REQUIRED
55+
allowedValues:
56+
- BG
57+
- GB
58+
minOccurrences: 1
59+
maxOccurrences: 1
60+
sans:
61+
dnsNames:
62+
type: REQUIRED
63+
allowedValues:
64+
- ^.*\.vena\.fi
65+
minOccurrences: 1
66+
maxOccurrences: 10
67+
ipAddresses:
68+
type: FORBIDDEN
69+
rfc822Names:
70+
type: IGNORED
71+
uniformResourceIdentifiers:
72+
type: FORBIDDEN
73+
keyUsages:
74+
- digitalSignature
75+
- keyEncipherment
76+
extendedKeyUsages:
77+
- SERVER_AUTH
78+
- CLIENT_AUTH
79+
keyAlgorithm:
80+
allowedValues:
81+
- EC_P256
82+
- EC_P384
83+
- EC_P521
84+
defaultValue: EC_P256
85+
signatureAlgorithm: EC_DSA_WITH_SHA256
8686
validityPeriod: P90D

config/private-key.pem

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
-----BEGIN PRIVATE KEY-----
2-
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgPpjorEmk7gkhEFwI
3-
NONJPX+80LO47pUCNJ1Q5R6ELOmhRANCAAT9DcVHN4G96CBfw1SmJvd1R6wKezsm
4-
EJ8vCz8KOT6/40QCvs3wQsI5k/nylERWLOr6VN5DZnBhsrBMtKjoFAoa
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgcIG8PWL/TJNsXDQh
3+
JdkNl3ZRu4EBAc87HoYdOXuVJtGhRANCAARhSwH6nAhxmkyr6inAHdtUwS4X8EPN
4+
03Ge9G72kK5CrrrgHO9I8wvzqoQowrHUxWk3ibzgMuoqSRxDzmgA54eV
55
-----END PRIVATE KEY-----

demo.ipynb

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,14 @@
11
{
22
"cells": [
3+
{
4+
"cell_type": "markdown",
5+
"metadata": {},
6+
"source": [
7+
"## Step 1 - Configure the Venafi control plane to for a new Firefly instance. \n",
8+
"\n",
9+
"This task would usually be done using the UI, however it can be fully automated using the API. As a convenience, and to get you started using Firefly in the shortest possible time, we will use a utility called \"elevate\" to do this. This will run in a Docker container and we'll use Docker Compose to orchestrate it. However before we can do this you need will need your API key as described in the project documentation. "
10+
]
11+
},
312
{
413
"cell_type": "markdown",
514
"metadata": {},
@@ -19,29 +28,27 @@
1928
"* Policies: basic-demo\n",
2029
"* Configurations: basic-demo\n",
2130
"\n",
22-
"For the purposes of this demonstrations some simple policies have been created. \n",
23-
"\n",
24-
"f\n"
31+
"For the purposes of this demonstrations some simple policies have been created. "
2532
]
2633
},
2734
{
2835
"cell_type": "markdown",
2936
"metadata": {},
3037
"source": [
31-
"Lets start by adding our Venafi cloud API key to the environment. The following command creates a new `.env` file that contains an API key that will be used by the Docker compose file to generate a working Firefly configuration. "
38+
"Lets start by adding our Venafi cloud API key to the environment. The following command creates a new `.env` file that contains an API key that will be used by the Docker compose file to generate a working Firefly configuration. Replace the placeholder text with your own API key. "
3239
]
3340
},
3441
{
3542
"cell_type": "code",
36-
"execution_count": 2,
43+
"execution_count": 3,
3744
"metadata": {
3845
"vscode": {
3946
"languageId": "shellscript"
4047
}
4148
},
4249
"outputs": [],
4350
"source": [
44-
"echo \"TLSPC_API_KEY=xxxx-xxxxx-xxxx-xxxxx\" > .env"
51+
"echo \"TLSPC_API_KEY=97f26f6e-9935-4aff-a505-d286f3747981\" > .env"
4552
]
4653
},
4754
{

docker-compose.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ services:
2626
volumes:
2727
- ./config/config.yaml:/etc/firefly/config.yaml
2828
- ./config:/etc/firefly:ro
29-
29+
- ./socket:/opt/firefly:rw
3030
cap_add:
3131
- IPC_LOCK
3232
environment:

docs/images/copy-api-key.png

82.3 KB
Loading

docs/images/generate-api-key.png

72.9 KB
Loading

docs/images/preferences.png

42.9 KB
Loading

docs/index.md

Lines changed: 69 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,8 @@ This playground can be run in one of two ways as follows:
3535
3636
* A working GitHub account
3737
* Venafi Cloud account for {{ component_name }} - you can signup for a free 30 day trial [here](https://venafi.com/try-venafi/firefly/)
38-
* An API key for your Venafi Cloud account. This can be obtained as follows:
39-
1. Log in to TLS Protect Cloud.
40-
2. In the menu bar, click your **avatar** in the top-right corner, and then click **Preferences**.
41-
3. On the **API Keys** tab, click the link to generate and copy your API key.
38+
* An API key for your Venafi Cloud account. Use the instructions below to get your API key.
39+
4240

4341

4442

@@ -50,17 +48,31 @@ This playground can be run in one of two ways as follows:
5048
5149
* Access to a fairly recent Docker runtime environment
5250
* Venafi Cloud account for Firefly - you can signup for a free 30 day trial [here](https://venafi.com/try-venafi/firefly/)
53-
* An API key for your Venafi Cloud account. This can be obtained as follows:
54-
1. Log in to TLS Protect Cloud.
55-
2. In the menu bar, click your **avatar** in the top-right corner, and then click **Preferences**.
56-
3. On the **API Keys** tab, click the link to generate and copy your API key.
51+
* An API key for your Venafi Cloud account. Use the instructions below to get your API key.
5752
* The following utilities are not required to run the Firefly playground but are used as a convenience to quickly demonstrate the Firefly API.
5853
* Locally installed (cURL)[https://curl.se] command line utility
5954
* Locally installed (JQ)[https://jqlang.github.io/jq/] command line utility
6055
* Locally installed (OpenSSL)[https://www.openssl.org] command line utility
6156
* Locally installed (JWT)[https://github.com/mike-engel/jwt-cli] command line utility
6257

6358
59+
??? tip "Getting an API Key"
60+
61+
If you don't have an API key you can follow this steps:
62+
63+
1. Login to https://ui.venafi.cloud. If you don't already have an account you can sign-up for a 30 day trail.
64+
2. In the menu bar, click your **avatar** in the top-right corner, and then click **Preferences**. <figure markdown>
65+
![Image title](images/preferences.png){ width="300" }
66+
</figure>
67+
3. Click the "Generate New Key" link, then specify the "API Key Validity Period". Recommend 30 days. <figure markdown>
68+
![Image title](images/generate-api-key.png){ width="300" }
69+
</figure>
70+
4. Click the "Generate" button at the bottom of the page. You will then see options to view or copy the new key. Keep a note of the API key somewhere secure for later<figure markdown>
71+
![Image title](images/copy-api-key.png){ width="300" }
72+
</figure>
73+
74+
75+
6476
6577
## Audience
6678

@@ -71,7 +83,7 @@ The intended audience for this playground is:
7183
* Developers, SRE's and platform engineering teams wanting to learn more about the services that Info Sec teams should be providing
7284
* Internal Venafi staff wanting to demonstrate Firefly to partners and customers.
7385

74-
## Get Started
86+
## Getting Started
7587

7688
The quick-start demo runs entirely in Docker and consists of three container images that a pulled from the public Docker repositories.
7789

@@ -106,24 +118,35 @@ To simplify the this demonstration, the project includes an interactive Jupyter
106118

107119
Before you can run Firefly, you must edit the `.env` file to include a valid Venafi cloud API key (referenced in the prerequisites) at the placeholder. This is the only thing you need to change.
108120

109-
```text title=".env file"
110-
TLSPC_API_KEY=xxxxx-xxxxxx-xxxxxx-xxxxxx
121+
The first task in the demo creates a `.env` file that is used to store a variable for the API key.
122+
123+
e.g.
124+
125+
```text title="create a .env file"
126+
echo "TLSPC_API_KEY=xxxxx-xxxxxx-xxxxxx-xxxxxx" > .env
111127
```
112128

129+
At this point you can either follow the instructions here and cut/past the commands into the terminal in the codesdpace, or just step through and run each of the cells in the `demo.ipynb` interactive notebook file.
130+
131+
### Step 1 - Configure the control plane
113132

133+
Every Firefly instance requires a valid service account, configuration and policy in the Venafi Control Plane (TLS Protect Cloud). For production, this task would often be completed by your InfoSec team. However, it might be undertaken by the platform engineering teams. Either way, you need to login to https://ui.venafi.cloud to create various config items.
114134

115-
You can now run a docker command to configure the Venafi Cloud control plane as follows:
135+
To simplify this process and reduce the time it takes to get started, we will use the prebuilt `3goats/elevate` container that fully automates the creation of the service account, configuration and policy. It will also create a private key file `private-key.pem` and local firefly `config.yaml` in the `config` directory.
116136

117-
``` bash
137+
To do this use the following `docker compose` command. This will run only the `3goats/elevate` container.
138+
139+
???+ warning "Important"
140+
141+
Do not run the `docker` commands in the interactive `demo.ipynb` environment. Instead type or cut and past the commands into the terminal.
142+
143+
``` bash title="Configure the Control Plane"
118144
docker compose --profile control-plane up
119145
```
120146

121147
You should see the following output. You should also the following new files in the `./config` directory.
122148

123-
* **config.yaml** - This is a generated Firefly configuration that will be used to pass the Firefly instance some basic values that are required as part of the bootstrap process,
124-
* **private-key.pem** This is the private part of a generated key pair that will be used by firefly to authenticate to the Venafi Cloud control plane.
125-
126-
```bash
149+
```bash title="Example output"
127150
[+] Running 2/0
128151
✔ Network firefly-quickstart_default Created 0.0s
129152
✔ Container firefly-quickstart-elevate-1 Created 0.0s
@@ -148,3 +171,32 @@ elevate-1 |
148171
elevate-1 exited with code 0
149172
```
150173

174+
The following files will also be updated to include valid content.
175+
176+
* **config.yaml** - This is a generated Firefly configuration that will be used to pass the Firefly instance some basic values that are required as part of the bootstrap process,
177+
* **private-key.pem** This is the private part of a generated key pair that will be used by firefly to authenticate to the Venafi Cloud control plane.
178+
179+
### Step 2 - Start Firefly and the local JWT service
180+
181+
Now that we've configured the Control Plane, we can now start the Firefly container `public.ecr.aws/venafi-images/firefly` and the `tr1ck3r/jwt-this`.
182+
183+
To do this use the following `docker compose` command. The `--profile demo` flag tells Docker to run only the `public.ecr.aws/venafi-images/firefly` and the `tr1ck3r/jwt-this` containers.
184+
185+
``` bash title="Start Firefly & the JWT service"
186+
docker compose --profile demo up
187+
```
188+
189+
You should see the following output.
190+
191+
```bash title="Example output"
192+
todo
193+
.........
194+
.........
195+
.........
196+
```
197+
198+
!!! note
199+
200+
The above command runs docker in interactive mode which means that the process does not exit.
201+
202+
Binary file not shown.

0 commit comments

Comments
 (0)