Installing Approver Policy Enterprise¶

Approver Policy Enterprise is a Kubernetes component of Venafi Control Plane.

To download the latest version of Approver Policy Enterprise as a Docker image or Helm Chart, see the download links specific to your region on the Approver Policy Enterprise release page.

Prerequisites¶

• You must have access to a Venafi Control Plane (TLS Protect Cloud or TLS Protect Datacenter) instance.
• You must have permission to install Helm charts and CRDs on your Kubernetes cluster.
• You must install cert-manager in your cluster.
• You must have kubectl and Helm 3.8.0 or later on your local computer.

Step 1: Configure access to the Venafi OCI registry¶

For the example below, we assume you created the following Kubernetes Secret:

• namespace: venafi
• name: venafi-image-pull-secret

Step 2: Reconfigure cert-manager¶

By default, cert-manager includes a built-in approver that attempts to mark all certificate requests as approved. To use Approver Policy you must disable this.

If you are using cert-manager v1.15.0 or later, you can disable the cert-manager approver by setting the following command line argument on the cert-manager controller:

--set disableAutoApproval=true

For example:

helm upgrade -i cert-manager oci://registry.venafi.cloud/charts/cert-manager \
  --install \
  --create-namespace \
  --namespace venafi \
  --version v1.16.1 \
  --set crds.enabled=true \
  --set disableAutoApproval=true

If you use a values file, you can also set the disableAutoApproval parameter there. For example:

disableAutoApproval: true

--controllers=*,-certificaterequests-approver

helm upgrade -i cert-manager oci://registry.venafi.cloud/charts/cert-manager \
  --install \
  --create-namespace \
  --namespace venafi \
  --version v1.16.1 \
  --set installCRDs=true \
  --set extraArgs={--controllers='*\,-certificaterequests-approver'}

A message similar to the following appears in the cert-manager log when successful:

I0506 14:44:51.198463       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificaterequests-approver"

kubectl logs -n venafi -l app=cert-manager --tail=-1 | grep "certificaterequests-approver"

Step 3: Deploy Approver Policy Enterprise using Helm¶

This procedure installs Approver Policy Enterprise in the venafi namespace and configures it to use the pull secret you created earlier, in addition to specifying the CA bundles Approver Policy Enterprise must trust.

1. Create a file called: approver-policy-enterprise.values.yaml containing the following content:

   US RegionEU RegionOwn Registry

   A sample approver-policy-enterprise.values.yaml file for users of the Venafi US OCI registry:

   approver-policy-enterprise.values.yaml

   cert-manager-approver-policy:
     image:
       repository: private-registry.venafi.cloud/venafi-approver-policy/approver-policy-enterprise
     imagePullSecrets:
       - name: venafi-image-pull-secret
   
   venafiConnection:
     include: true # set to `false` if Venafi Connection CRDs & RBAC are already installed
   

   A sample approver-policy-enterprise.values.yaml file for users of the Venafi EU OCI registry:

   approver-policy-enterprise.values.yaml

   cert-manager-approver-policy:
     image:
       repository: private-registry.venafi.eu/venafi-approver-policy/approver-policy-enterprise
     imagePullSecrets:
       - name: venafi-image-pull-secret
   
   venafiConnection:
     include: true # set to `false` if Venafi Connection CRDs & RBAC are already installed
   

   A sample approver-policy-enterprise.values.yaml file for users with their own OCI registry:

   approver-policy-enterprise.values.yaml

   cert-manager-approver-policy:
     image:
       repository: myregistry.example.com/venafi-approver-policy/approver-policy-enterprise
     imagePullSecrets:
       - name: venafi-image-pull-secret
   
   venafiConnection:
     include: true # set to `false` if Venafi Connection CRDs & RBAC are already installed
   

   Note

   If you are using Approver Policy Enterprise with external issuers (such as Venafi Enhanced Issuer, see example below), you must include their signer names so that Approver Policy Enterprise has permissions to approve and deny CertificateRequests that reference them.

   # approver-policy-enterprise.values.yaml
   cert-manager-approver-policy:
     app:
       approveSignerNames:
         - "issuers.cert-manager.io/*"
         - "clusterissuers.cert-manager.io/*"
         - "venaficlusterissuers.jetstack.io/*"
         - "venafiissuers.jetstack.io/*"
     ...
   

2. Use Helm to install the software and wait for it to be ready:

   helm upgrade approver-policy-enterprise oci://registry.venafi.cloud/charts/approver-policy-enterprise \
       --install \
       --wait \
       --namespace venafi \
       --values approver-policy-enterprise.values.yaml \
       --version v0.19.0
   

Uninstalling Approver Policy Enterprise using Helm¶

To uninstall Approver Policy Enterprise installed via Helm, run the following command:

helm uninstall approver-policy-enterprise --namespace venafi

Output:

These resources were kept due to the resource policy:
[CustomResourceDefinition] certificaterequestpolicies.policy.cert-manager.io

release "approver-policy-enterprise" uninstalled

As shown in the output, the CustomResourceDefinition for CertificateRequestPolicy is not removed by the Helm uninstall command. This prevents data loss, as removing the CustomResourceDefinition would also remove all CertificateRequestPolicy resources.

This command does not, by design, delete any CRDs. To do that you must also apply the following command:

```bash
kubectl delete crd certificaterequestpolicies.policy.cert-manager.io
```

Step 4: Enabling the Rego features of Approver Policy Enterprise¶

To enable the Rego features of Approver Policy Enterprise, create another values file called values-rego.yaml containing the Rego configuration, and supply that as an extra --values argument when installing the component. See the examples below:

kubectl create namespace my-namespace

# approver-policy-enterprise.values-rego.yaml
cert-manager-approver-policy:
  app:
    extraArgs:
      - --rego-policy-directory=/var/run/rego
      - --rego-replicate=networking.k8s.io/v1/ingresses
      - --rego-replicate=/v1/services/my-namespace
      - --rego-replicate-cluster=/v1/namespaces
rego:
  rbac:
    namespaced:
      - namespace: ""
        apiGroup: "networking.k8s.io"
        resource: "ingresses"
      - namespace: "my-namespace"
        apiGroup: ""
        resource: "services"
    cluster:
      - apiGroup: ""
        resource: "namespaces"

helm upgrade approver-policy-enterprise oci://registry.venafi.cloud/charts/approver-policy-enterprise \
    --install \
    --wait \
    --namespace venafi \
    --values approver-policy-enterprise.values.yaml \
    --values approver-policy-enterprise.values-rego.yaml \
    --version v0.19.0

Step 5: Configure Custom CA Certificates¶

You may need to configure custom CA bundles for Approver Policy Enterprise in three cases:

• If you are loading policies from TLS Protect Datacenter, custom CA bundles will allow Approver Policy Enterprise to trust your private CA.

• If you are loading policies from Venafi Control Plane and Kubernetes egress traffic has to go through an HTTP proxy or a transparent proxy, you will need to configure a custom CA bundle to let Approver Policy Enterprise connect to your internal HTTP or transparent proxy.

• If your Venafi Connection relies on HashiCorp Vault, you will need to configure a custom CA bundle to trust your private CA.

If you are in one of the above scenarios, you can configure Approver Policy Enterprise to trust the internal CA by putting the internal CA certificates into a ConfigMap, and mounting the ConfigMap into the Approver Policy Enterprise Pod in the /etc/ssl/certs/ directory.

1. Create a ConfigMap in the venafi namespace. For example, a TPP CA certificate ConfigMap will look like this:

   approver-policy-enterprise-ca-certificates.configmap.yaml

   apiVersion: v1
   kind: ConfigMap
   metadata:
       name: ca-cert-tpp
       namespace: venafi
   data:
       ca.crt: |
         -----BEGIN CERTIFICATE-----
         ## INSERT CA CERTIFICATE DATA HERE
         -----END CERTIFICATE-----
   

2. Use kubectl to apply the ConfigMap:

   kubectl apply -f approver-policy-enterprise-ca-certificates.configmap.yaml
   

3. Use the volumeMounts and volumes values to mount the additional CA certificates into the /etc/ssl/certs/ directory.

   approver-policy-enterprise-ca-certificates.values.yaml

   cert-manager-approver-policy:
     volumes:
       - name: ca-cert-tpp-volume
         configMap:
           name: ca-cert-tpp
           optional: false
       - name: rego # (1)!
         configMap:
           name: cert-manager-approver-policy-rego
           optional: true
   
     volumeMounts:
       - name: ca-cert-tpp-volume
         mountPath: "/etc/ssl/certs/ca-cert-tpp-ca.crt"
         subPath: ca.crt # (2)!
         readOnly: true
       - name: rego  # (3)!
         mountPath: /var/run/rego
   

   1. This volume is required by the Rego plugin.
   2. The subPath value here must match the value of the data key to be loaded in the ConfigMap YAML file.
   3. This volumeMount is required by the Rego plugin.

4. Redeploy the Approver Policy Enterprise Helm chart, using the extra values (above):

   helm upgrade approver-policy-enterprise oci://registry.venafi.cloud/charts/approver-policy-enterprise \
       --install \
       --wait \
       --namespace venafi \
       --values approver-policy-enterprise.values.yaml \
       --values approver-policy-enterprise-ca-certificates.values.yaml \
       --version v0.19.0
   

   Important

   The Rego volumes and mounts must be included because they are needed by the Rego plugin, and would otherwise be overwritten by these volumes and volumeMounts values.

   Note

   Mozilla's CA certificates are present in the image by default at /etc/ssl/certs/ca-certificates.crt and these cannot be disabled.

   Note

   If you are using TLS Protect Cloud you don't need to configure custom CA certificates, because the serving certificate of the TLS Protect Cloud REST API is signed by one of Mozilla's trusted CAs.

Upgrade¶

To upgrade from a pre-v0.7.0 installation to v0.7.0 or a later version, some migration steps are required. You can obtain an ad-hoc migration plan by contacting Venafi's support team.

Next steps¶

• Learn how to configure Approver Policy Enterprise using CertificateRequestPolicy resources
• See examples of some common policy configurations
• Learn about the Venafi features of Approver Policy Enterprise
• Learn about the Rego features of Approver Policy Enterprise
• Read about common administration tasks related to Approver Policy Enterprise controller
• Read about the command line flags of the Approver Policy Enterprise controller