Skip to content

Installing Approver Policy Enterprise

Approver Policy Enterprise is a Kubernetes component of Venafi Control Plane.

To download the latest version of Approver Policy Enterprise as a Docker image or Helm Chart, see the download links specific to your region on the Approver Policy Enterprise release page.

Prerequisites

  • You must have access to a Venafi Control Plane (TLS Protect Cloud or TLS Protect Datacenter) instance.
  • You must have permission to install Helm charts and CRDs on your Kubernetes cluster.
  • You must install cert-manager in your cluster.
  • You must have kubectl and Helm 3.8.0 or later on your local computer.

Important

If you use your own registry, which replicates the Venafi images, replace the address of your own registry in any of the relevant commands given on this page.

Step 1: Configure access to the Venafi OCI registry

Important

Follow the instructions in Configuring access to enterprise components to enable access to the artifacts required for this component (Approver Policy Enterprise Component for cert-manager is the default scope for Approver Policy Enterprise). Use venafi as the namespace.

For the example below, we assume you created the following Kubernetes Secret:

  • namespace: venafi
  • name: venafi-image-pull-secret

Step 2: Reconfigure cert-manager

By default, cert-manager includes a built-in approver that attempts to mark all certificate requests as approved. To use Approver Policy you must disable this.

If you are using cert-manager v1.15.0 or later, you can disable the cert-manager approver by setting the following command line argument on the cert-manager controller:

--set disableAutoApproval=true

For example:

helm upgrade -i cert-manager oci://registry.venafi.cloud/charts/cert-manager \
  --install \
  --create-namespace \
  --namespace venafi \
  --version v1.15.1 \
  --set crds.enabled=true \
  --set disableAutoApproval=true

If you use a values file, you can also set the disableAutoApproval parameter there. For example:

disableAutoApproval: true

Tip

If you are running an earlier version of cert-manager, you can disable the cert-manager approver by setting the following command line argument on the cert-manager controller:

--controllers=*,-certificaterequests-approver

You can also do this by using the following values option:

helm upgrade -i cert-manager oci://registry.venafi.cloud/charts/cert-manager \
  --install \
  --create-namespace \
  --namespace venafi \
  --version v1.15.1 \
  --set installCRDs=true \
  --set extraArgs={--controllers='*\,-certificaterequests-approver'}

Be sure to customize the cert-manager controller extraArgs, which are at the top level of the values file. Do not change the webhook.extraArgs, startupAPICheck.extraArgs or cainjector.extraArgs settings.

If you are reconfiguring an already-installed cert-manager instance, you can check if the original installation the extraArgs value has already been customized by running helm get values cert-manager --namespace venafi command. If pre-configured extraArgs values, merge those with the extra --controllers value. Otherwise, your original extraArgs values will be overwritten.

Info

Note also that, as of cert-manager v1.15.0, the installCRDs value is deprecated in favor of crds.enabled.

The --set crds.enabled=true setting is a convenient way to install the cert-manager CRDs, but it is optional and has some drawbacks. Learn more Helm: Installing Custom Resource Definitions

A message similar to the following appears in the cert-manager log when successful:

I0506 14:44:51.198463       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificaterequests-approver"

Tip

A quick way to search in the logs, assuming cert-manager is deployed to the venafi namespace:

kubectl logs -n venafi -l app=cert-manager | grep "certificaterequests-approver"

Step 3: Deploy Approver Policy Enterprise

Deploying Approver Policy Enterprise using Helm

This procedure installs Approver Policy Enterprise in the venafi namespace and configures it to use the pull secret you created earlier, in addition to specifying the CA bundles Approver Policy Enterprise must trust.

  1. Create a file called: approver-policy-enterprise.values.yaml containing the following content:

    # approver-policy-enterprise.values.yaml
    cert-manager-approver-policy:
      image:
        repository: private-registry.venafi.cloud/venafi-approver-policy/approver-policy-enterprise
      imagePullSecrets:
        - name: venafi-image-pull-secret
    
    venafiConnection:
      include: true # set to `false` if Venafi Connection CRDs & RBAC are already installed
    
    # approver-policy-enterprise.values.yaml
    cert-manager-approver-policy:
      image:
        repository: private-registry.venafi.eu/venafi-approver-policy/approver-policy-enterprise
      imagePullSecrets:
        - name: venafi-image-pull-secret
    
    venafiConnection:
      include: true # set to `false` if Venafi Connection CRDs & RBAC are already installed
    

    Note

    If you are using Approver Policy Enterprise with external issuers (such as Venafi Enhanced Issuer, see example below), you must include their signer names so that Approver Policy Enterprise has permissions to approve and deny CertificateRequests that reference them.

    # approver-policy-enterprise.values.yaml
    cert-manager-approver-policy:
      app:
        approveSignerNames:
          - "issuers.cert-manager.io/*"
          - "clusterissuers.cert-manager.io/*"
          - "venaficlusterissuers.jetstack.io/*"
          - "venafiissuers.jetstack.io/*"
      ...
    
  2. Use Helm to install the software and wait for it to be ready:

    helm upgrade approver-policy-enterprise oci://registry.venafi.cloud/charts/approver-policy-enterprise \
        --install \
        --wait \
        --namespace venafi \
        --values approver-policy-enterprise.values.yaml \
        --version v0.17.2
    

Uninstalling Approver Policy Enterprise using Helm

To uninstall Approver Policy Enterprise installed via Helm, run the following command:

helm uninstall approver-policy-enterprise --namespace venafi

These resources were kept due to the resource policy:
[CustomResourceDefinition] certificaterequestpolicies.policy.cert-manager.io

release "approver-policy-enterprise" uninstalled

As shown in the output, the CustomResourceDefinition for CertificateRequestPolicy is not removed by the Helm uninstall command. This prevents data loss, as removing the CustomResourceDefinition would also remove all CertificateRequestPolicy resources.

This command does not, by design, delete any CRDs. To do that you must also apply the following command:

```bash
kubectl delete crd certificaterequestpolicies.policy.cert-manager.io
```

Warning

Approver Policy Enterprise versions prior to v0.14.0 do not keep the CustomResourceDefinition on uninstall, and will remove all CertificateRequestPolicy resources from the cluster. Make sure to back up your CertificateRequestPolicy resources before uninstalling Approver Policy Enterprise if you are using a version prior to v0.14.0. Alternatively, upgrade to v0.14.0 before uninstalling.

Deploying Approver Policy Enterprise using the Venafi CLI tool

  1. If not already installed, download and install the relevant version of the Venafi CLI tool for your platform.
  2. Initialize the Venafi Kubernetes Manifest tool.

    venctl components kubernetes manifest tool init
    
  3. Issue the following command to generate a Venafi Kubernetes manifest:

    venctl components kubernetes manifest generate \
      --approver-policy-enterprise > helmfile.yaml
    
  4. Finally, run the following command to apply the Venafi Kubernetes manifest:

    venctl components kubernetes manifest tool sync --file helmfile.yaml
    

    For more information and options on using the Venafi CLI tool to install Approver Policy Enterprise, see the Venafi CLI tool reference page.

Note

There are also FIPS compliant Docker images available at oci://<oci-registry-regional-url>/venafi-approver-policy/approver-policy-enterprise-fips and these have the same version tags as the main Docker images.

Tip

You can also use the venctl components kubernetes apply command to install this component on a Kubernetes cluster quickly and easily for test purposes. Note that this command is not recommended for use in production environments.

See venctl components kubernetes apply for more information on how to use the command with this component.

Step 4: Enabling the Rego features of Approver Policy Enterprise

To enable the Rego features of Approver Policy Enterprise, create another values file called values-rego.yaml containing the Rego configuration, and supply that as an extra --values argument when installing the component. See the examples below:

kubectl create namespace my-namespace
# approver-policy-enterprise.values-rego.yaml
cert-manager-approver-policy:
  app:
    extraArgs:
      - --rego-policy-directory=/var/run/rego
      - --rego-replicate=networking.k8s.io/v1/ingresses
      - --rego-replicate=/v1/services/my-namespace
      - --rego-replicate-cluster=/v1/namespaces
rego:
  rbac:
    namespaced:
      - namespace: ""
        apiGroup: "networking.k8s.io"
        resource: "ingresses"
      - namespace: "my-namespace"
        apiGroup: ""
        resource: "services"
    cluster:
      - apiGroup: ""
        resource: "namespaces"
helm upgrade approver-policy-enterprise oci://registry.venafi.cloud/charts/approver-policy-enterprise \
    --install \
    --wait \
    --namespace venafi \
    --values approver-policy-enterprise.values.yaml \
    --values approver-policy-enterprise.values-rego.yaml \
    --version v0.17.2

Step 5: Configure Custom CA Certificates

Approver Policy Enterprise need to connect to TLS endpoints, where the serving certificate is signed by an internal certificate authority (CA). For example, it may need to connect to the REST API of TLS Protect Datacenter.

In both cases you need to configure Approver Policy Enterprise to trust the internal CA by putting the internal CA certificates into a ConfigMap, and mounting the ConfigMap into the Approver Policy Enterprise Pod in the /etc/ssl/certs/ directory.

  1. Create a ConfigMap in the venafi namespace. For example, a TPP CA certificate ConfigMap will look like this:

    # approver-policy-enterprise-ca-certificates.configmap.yaml
    apiVersion: v1
    kind: ConfigMap
    metadata:
        name: ca-cert-tpp
        namespace: venafi
    data:
        ca.crt: |
          -----BEGIN CERTIFICATE-----
          ## INSERT CA CERTIFICATE DATA HERE
          -----END CERTIFICATE-----
    
    kubectl apply -f approver-policy-enterprise-ca-certificates.configmap.yaml
    
  2. Use the volumeMounts and volumes values to mount the additional CA certificates into the /etc/ssl/certs/ directory.

    # approver-policy-enterprise-ca-certificates.values.yaml
    cert-manager-approver-policy:
      volumes:
        - name: ca-cert-tpp-volume
          configMap:
            name: ca-cert-tpp
            optional: false
        - name: rego # ❗ This volume is required by the Rego plugin.
          configMap:
            name: cert-manager-approver-policy-rego
            optional: true
    
      volumeMounts:
        - name: ca-cert-tpp-volume
          mountPath: "/etc/ssl/certs/ca-cert-tpp-ca.crt"
          subPath: ca.crt
          readOnly: true
        - name: rego # ❗ This volumeMount is required by the Rego plugin.
          mountPath: /var/run/rego
    
  3. Redeploy the Approver Policy Enterprise Helm chart, using the extra values (above):

    helm upgrade approver-policy-enterprise oci://registry.venafi.cloud/charts/approver-policy-enterprise \
        --install \
        --wait \
        --namespace venafi \
        --values approver-policy-enterprise.values.yaml \
        --values approver-policy-enterprise-ca-certificates.values.yaml \
        --version v0.17.2
    

    Important

    The Rego volumes and mounts must be included because they are needed by the Rego plugin, and would otherwise be overwritten by these volumes and volumeMounts values.

    Note

    Mozilla's CA certificates are present in the image by default at /etc/ssl/certs/ca-certificates.crt and these cannot be disabled.

    Note

    If you are using TLS Protect Cloud you don't need to configure custom CA certificates, because the serving certificate of the TLS Protect Cloud REST API is signed by one of Mozilla's trusted CAs.

Upgrade

To upgrade from a pre-v0.7.0 installation to v0.7.0 or a later version, some migration steps are required. You can obtain an ad-hoc migration plan by contacting Venafi's support team.

Next steps