Authenticate to Next-Gen Trust Security with Workload Identity Federation¶

In this tutorial, you'll configure Connection for Next-Gen Trust Security (Connection resource) to authenticate using Workload Identity Federation (WIF). With WIF, Kubernetes acts as an OIDC provider and issues ServiceAccount tokens that Next-Gen Trust Security (NGTS) validates.

Once these steps are complete, Connection resource will be able to authenticate to NGTS on behalf of your cluster components, such as Discovery Agent, Distributed Issuer, and Enterprise Issuer.

Step 1: Configure the service account¶

Create a Kubernetes ServiceAccount and grant the Connection resource controller permission to request tokens for it.

1. Create a Kubernetes ServiceAccount that the Connection resource will use for authentication:

   workload-identity-sa.yaml

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: workload-identity-sa # (1)!
     namespace: venafi
   

   1. This value is included in the Subject field of the Built-in Account in NGTS, in the format system:serviceaccount:venafi:workload-identity-sa.

   Apply the manifest:

   kubectl apply -f workload-identity-sa.yaml
   

2. Create a Role that grants the Connection resource permission to create tokens for the ServiceAccount:

   workload-identity-role.yaml

   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
     name: create-tokens-for-workload-identity-sa
     namespace: venafi
   rules:
   - apiGroups: [""]
     resources: ["serviceaccounts/token"]
     verbs: ["create"]
     resourceNames: ["workload-identity-sa"]
   

   Apply the manifest:

   kubectl apply -f workload-identity-role.yaml
   

3. Create a RoleBinding that binds the Role to the Connection resource controller:

   workload-identity-rolebinding.yaml

   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     name: workload-identity-sa-token-rolebinding
     namespace: venafi
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: Role
     name: create-tokens-for-workload-identity-sa
   subjects:
   - kind: ServiceAccount
     name: venafi-connection
     namespace: venafi
   

   Apply the manifest:

   kubectl apply -f workload-identity-rolebinding.yaml
   

Step 2: Create the connection resource¶

Create a Connection resource that authenticates to NGTS using the ServiceAccount configured in Step 1.

1. Create the Connection resource:

   ngts-connection.yaml

   apiVersion: jetstack.io/v1alpha1
   kind: VenafiConnection
   metadata:
     name: ngts-connection
     namespace: venafi
   spec:
     ngts:
       tsgID: "<your-tsgID>" # (1)!
       jwt:
       - serviceAccountToken: # (2)!
           name: workload-identity-sa # (3)!
           audiences: ["<audience-configured-on-built-in-account>"] # (4)!
   

   1. Replace with your Tenant Service Group ID.
   2. Requests a ServiceAccount token from the Kubernetes TokenRequest API and sends it to NGTS.
   3. Must match the ServiceAccount created above and the Subject configured in your Built-in Account.
   4. Must match the Audience configured in your Built-in Account.

   Apply the manifest:

   kubectl apply -f ngts-connection.yaml
   

Related links¶

• Authenticate with a private key
• About cross-namespace access for Connection resource
• Connection resource API reference
• Troubleshooting Built-in Account authentication