Remove use of createcerts in Fulcio #1834
Conversation
loosebazooka
left a comment
loosebazooka
left a comment
There was a problem hiding this comment.
Some questions, mostly as I don't understand the system fully yet.
cmurphy
force-pushed
the
fulcio-createcerts
branch
11 times, most recently
from
c77d305 to
a7294b5
Compare
cmurphy
force-pushed
the
fulcio-createcerts
branch
from
a7294b5 to
987734e
Compare
| namespace: fulcio-system | ||
| type: Opaque | ||
| data: | ||
| cert: <cert-placeholder> |
There was a problem hiding this comment.
Is this a duplicate of fulcio-cert.cert? Could we remove this secret if so, or are we keeping these separate to avoid further changes?
There was a problem hiding this comment.
Yes it's a duplicate. The reason, I think, is so that in theory you could give the TUF service account (or some other user) fine-grained access to just this resource and not expose the private key. In practice we don't have access controls like that in our testing but I think it's still nice to keep it separate.
There was a problem hiding this comment.
Yea, I also noticed that it was just the TUF-related scripts using it. SGTM to leave it.
cmurphy
dismissed stale reviews from haydentherapper and loosebazooka
via
5294a7e
cmurphy
force-pushed
the
fulcio-createcerts
branch
from
987734e to
5294a7e
Compare
Simplify the Fulcio configuration by removing the createcerts job and pre-generating the keys for Fulcio from the setup script. This is a prerequisite to updating ctlog to accept the pre-generated Fulcio roots as an input value rather than using createctconfig to fetch the roots from Fulcio's rootCert HTTP endpoint. Signed-off-by: Colleen Murphy <[email protected]>
cmurphy
force-pushed
the
fulcio-createcerts
branch
from
5294a7e to
f660aed
Compare
3 participants
Simplify the Fulcio configuration by removing the createcerts job and pre-generating the keys for Fulcio from the setup script.
This is a prerequisite to updating ctlog to accept the pre-generated Fulcio roots as an input value rather than using createctconfig to fetch the roots from Fulcio's rootCert HTTP endpoint.
Relates to #1833
Relates to sigstore/rekor-tiles#73
Summary
Release Note
Documentation