Authenticate to Next-Gen Trust Security with private key JWT¶

In this tutorial, you'll configure Connection for Next-Gen Trust Security (Connection resource) to authenticate to Next-Gen Trust Security (NGTS) using a Built-in Account and a private key JSON Web Token (JWT).

Once these steps are complete, Connection resource will be able to authenticate to NGTS on behalf of your cluster components, such as Discovery Agent, Distributed Issuer, and Enterprise Issuer.

Step 1: Configure the private key¶

Store your Built-in Account private key in a Kubernetes Secret and grant Connection resource permission to read it.

1. Create a Kubernetes Secret containing your private key:

   ngts-credentials-secret.yaml

   apiVersion: v1
   kind: Secret
   metadata:
     name: ngts-credentials
     namespace: venafi
   stringData:
     privateKey: |
       -----BEGIN EC PRIVATE KEY-----
       <your private key content>
       -----END EC PRIVATE KEY-----
   

   Apply the manifest:

   kubectl apply -f ngts-credentials-secret.yaml
   

2. Create a Role that grants Connection resource read access to the ngts-credentials Secret:

   ngts-credentials-role.yaml

   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
     name: get-ngts-credentials
     namespace: venafi
   rules:
   - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["get"]
     resourceNames: ["ngts-credentials"]
   

   Apply the manifest:

   kubectl apply -f ngts-credentials-role.yaml
   

3. Create a RoleBinding that binds the Role to the Connection resource controller:

   ngts-credentials-rolebinding.yaml

   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     name: ngts-credentials-rolebinding
     namespace: venafi
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: Role
     name: get-ngts-credentials
   subjects:
   - kind: ServiceAccount
     name: venafi-connection
     namespace: venafi
   

   Apply the manifest:

   kubectl apply -f ngts-credentials-rolebinding.yaml
   

Step 2: Create the connection resource¶

Create a Connection resource that authenticates to NGTS using the private key stored in Step 1.

1. Create the Connection resource:

   ngts-connection.yaml

   apiVersion: jetstack.io/v1alpha1
   kind: VenafiConnection
   metadata:
     name: ngts-connection
     namespace: venafi
   spec:
     ngts:
       tsgID: "<your-tsgID>" # (1)!
       jwt: # (2)!
       - secret: # (3)!
           name: ngts-credentials
           fields:
           - privateKey
       - privateKeyJWT: # (4)!
           clientID: "<your-client-id>"
   

   1. Replace with your Tenant Service Group ID.
   2. Defines a two-step authentication chain.
   3. Reads the private key from the Kubernetes Secret.
   4. Signs a JWT and exchanges it for an OAuth bearer token.

   Apply the manifest:

   kubectl apply -f ngts-connection.yaml
   

Related links¶

• Authenticate with Workload Identity Federation
• Troubleshooting Built-in Account authentication
• Connection resource API reference
• About cross-namespace access for Connection resource