Skip to content

Installing Approver Policy using the Venafi Control Plane Operator

Venafi Control Plane Operator for Red Hat OpenShift is designed to assist customers in installing, maintaining, and upgrading Venafi cluster components.

Follow the steps below to deploy the default version of cert-manager and Approver Policy using the Venafi Control Plane Operator.

Prerequisites

To install Approver Policy using the Venafi Control Plane Operator, you'll need to ensure you have the following:

  • Access to the Venafi OCI registry (or your own mirror)
  • Venafi Control Plane Operator already installed on your system
  • Red Hat OpenShift CLI tool oc installed on your system.

Step 1: Configure access to the Venafi OCI registry

Important

Follow the instructions in Configuring access to the Venafi OCI registry to enable access to the artifacts required for this component (cert-manager Components is the default scope for cert-manager). Use venafi as the namespace.

For the example below, it's assumed that you created the following Kubernetes Secret:

  • namespace: venafi
  • name: venafi-image-pull-secret

Step 2: Create and apply the manifest

Deploying Approver Policy using Venafi Control Plane Operator

Follow the steps below to deploy the default version of cert-manager and Approver Policy.

  1. Create a manifest venafi-components.yaml. You can use one of the samples below as a base:

    venafi-components.yaml
    apiVersion: installer.venafi.com/v1alpha1
kind: VenafiInstall
metadata:
  name: venafi-components
spec:
  globals:
    enableDefaultApprover: false 
    imagePullSecretNames: [venafi-image-pull-secret] 
    namespace: venafi 
    useFIPSImages: false 
    vcpRegion: US 
    region: US 
  certManager:
    install: true
  certManagerApproverPolicy:
    install: true
    values: 
      tolerations: 
      - key: node-role.kubernetes.io/infra
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/private
        operator: Exists
        effect: NoSchedule
    version: v0.16.0
    venafi-components.yaml
    apiVersion: installer.venafi.com/v1alpha1
kind: VenafiInstall
metadata:
  name: venafi-components
spec:
  globals:
    enableDefaultApprover: false
    imagePullSecretNames: [venafi-image-pull-secret]
    namespace: venafi
    useFIPSImages: false
    vcpRegion: EU
    region: EU
  certManager:
    install: true
  certManagerApproverPolicy:
    install: true
    values:
      tolerations:
      - key: node-role.kubernetes.io/infra
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/private
        operator: Exists
        effect: NoSchedule
    version: v0.16.0
    venafi-components.yaml
    apiVersion: installer.venafi.com/v1alpha1
kind: VenafiInstall
metadata:
  name: venafi-components
spec:
  globals: 
    customChartRepository: oci://myregistry.example.com/charts
    customImageRegistry: myregistry.example.com
    enableDefaultApprover: false
    imagePullSecretNames: [venafi-image-pull-secret]
    namespace: venafi
    useFIPSImages: false
  certManager:
    install: true
  certManagerApproverPolicy:
    install: true
    values: 
      tolerations: 
      - key: node-role.kubernetes.io/infra
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/private
        operator: Exists
        effect: NoSchedule
    version: v0.16.0

    Note

    Set the spec.certManager.skip parameter to true and the spec.certManager.install parameter to false if you have already installed and configured cert-manager.

    Tip

    For a complete list of Venafi Control Plane Operator configuration parameters, refer to the Venafi Control Plane Operator API reference

  2. Apply the manifest by running the following command:

    oc apply -f venafi-components.yaml

Step 3: Verify the installation

  1. Verify whether Approver Policy is successfully installed by running the following command:

    oc get venafiinstall,pods

    Sample output:

    NAME                                                   STATUS   LAST SYNC
venafiinstall.installer.venafi.com/venafi-components   Synced   24s

NAME                                               READY   STATUS    RESTARTS   AGE
pod/cert-manager-approver-policy-6959f645d-xm77c   1/1     Running   0          44s
pod/cert-manager-cainjector-749787cb56-2j7hw       1/1     Running   0          81s
pod/cert-manager-f7575cd68-5nb7x                   1/1     Running   0          81s
pod/cert-manager-webhook-86967c8cf4-d5xxj          1/1     Running   0          81s
pod/vcp-operator-6f76c5fb67-z2cm2                  1/1     Running   0          4d20h