Policy for adding CA certificates to BRIX containers

In some cases, it is necessary to trust user-generated CA certificates. Kyverno allows you to automatically add a volume containing user CA certificates to containers with a specific label.

The installation consists of two stages:

  1. Prepare a Secret with a root CA certificate.
  2. Fill in the configuration file.

Step 1. Prepare a Secret with a root CA certificate

Create a Secret with the root CA certificate in namespace where the BRIX application is installed. If there are multiple instances of BRIX installed in the Kubernetes cluster, add the Secret only to the namespace of the necessary instances of BRIX.

Create a Secret named brix365-onpremise-ca in the namespace where BRIX is installed by running the following command:

kubectl create secret generic brix365-onpremise-ca --from-file=brix365-onpremise-ca.pem=/etc/ssl/certs/rootCA.pem [-n namespace]

Where --from-file specifies the path to your root CA certificate in .pem format.

Step 2. Fill in the configuration file

Fill in the configuration file values-policies.yaml for setting up Kyverno:

  1. Configure the policy to add user CA certificates to all containers. The policy is enabled by default, the injectCerts.enabled parameter is set to true.
  2. In the injectCerts.secretCA parameter, specify the name of the Secret created in Step 1. In the example in this article, it is brix365-onpremise-ca. The policy adds a volume containing the CA certificate to all containers with the label tier=brix365.
  3. If there are multiple instances of the BRIX On-Premises application installed in the Kubernetes cluster, but the user CA certificate needs to be added only to some instances of the BRIX applications, fill in the injectCerts.injectNamespace parameter.

In the injectCerts.injectNamespace parameter, specify the namespaces of BRIX instances to which the policy of adding certificates will be applied and a volume containing the CA certificate will be added. Ensure that in Step 1, the Secret with the root CA certificate was added to the namespaces listed in injectCerts.injectNamespace.

# kyverno-policies settings
# the policy adds the volume containing the CA certificate to all the containers labeled tier=brix365
injectCerts:
  enabled: true
# name of the secret with the CA root certificate for https with a self-signed certificate
  secretCA: brix365-onpremise-ca
# list of namespaces where the policy will be applied
# injectNamespace:
#      - brix365-dev
#      - brix365-prod
...

  1. After configuring the security policy, install the kyverno-policies chart as described in step 3 of stage 2 in Install Kyverno.

 

начало внимание

Installing the Kyverno add-on component does not automatically connect the volume containing the CA certificate to the already running pods of the BRIX application. After installing Kyverno, restart the BRIX application services.

конец внимание

install-kyverno.html docker-image-verification-policy.html