Support distribution of PKCS12/JKS truststores about trust-manager HOT 5 CLOSED

You might find cert-utils useful - you can annotate a secret containing a certificate & it will add keystore & truststore keys to the secret.

from trust-manager.

You might find cert-utils useful - you can annotate a secret containing a certificate & it will add keystore & truststore keys to the secret.

Well, cert-utils could be useful for other use-cases, but not for this IMO. I don't see the point in converting N Secrets with the same content. And I do not want to install additional software into my clusters. Especially not software that require RBAC to read secrets cluster-wide. And cert-manager already has native support for JKS and PKCS12 keystores: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateKeystores. And I think this support should/could be implemented here also.

from trust-manager.

is it not implemented here? If you create a Bundle targeting the truststore in your CA, it gets distributed.

from trust-manager.

Hey @sgran,
It does work to distribute anything you feed it, but this is not first-class support as you still need to whip out keytool to create the java trust store.
I assume first-class support means you can feed it a PEM as input and it would generate the JKS and PKCS12 trust store, similarly to how cert-manager can now generate JKS and pkCS12 keystores in the certificate secret.

from trust-manager.

@SpectralHiss I implemented a webhook that is capable to transform pem files into a truststore and add it to the same configmap. https://github.com/bakito/java-truststore-injection-webhook

from trust-manager.