Getting Started

In this tutorial, we will deploy Notary on Kubernetes and use it to provide a TLS certificate to a charm requesting one.

Pre-requisites

A Ubuntu 22.04 machine with the following requirements:

• A x86_64 CPU
• 8GB of RAM
• 20GB of free disk space

1. Install MicroK8s

sudo snap install microk8s --channel=1.29-strict/stable

Enable the storage and dns add-ons:

sudo microk8s enable hostpath-storage
sudo microk8s enable dns

2. Bootstrap a Juju controller

From your terminal, install Juju:

sudo snap install juju --channel=3.4/stable

Bootstrap a Juju controller:

juju bootstrap microk8s

3. Deploy Notary

Create a Juju model named demo:

juju add-model demo

Deploy the Notary K8s operator:

juju deploy notary-k8s --channel latest/edge

Notary will become active and ready to use in a couple seconds.

$ juju status
Model  Controller          Cloud/Region        Version  SLA          Timestamp
demo   microk8s-localhost  microk8s/localhost  3.4.5    unsupported  17:07:25+03:00

App         Version  Status  Scale  Charm       Channel      Rev  Address         Exposed  Message
notary-k8s           active      1  notary-k8s  latest/edge    4  10.152.183.188  no 

Unit           Workload  Agent  Address      Ports  Message
notary-k8s/0*  active    idle   10.1.90.190

4. Get the Login Information

Get the login information directly from juju secrets:

$ juju secrets
ID                    Name  Owner       Rotation  Revision  Last updated
cqvlq37mp25c77vaabgg  -     notary-k8s  never            5  1 minute ago

$ juju show-secret --reveal cqvlq37mp25c77vaabgg
cqvlq37mp25c77vaabgg:
  revision: 5
  owner: notary-k8s
  label: Notary Login Details
  created: 2024-08-16T14:07:09Z
  updated: 2024-08-16T14:07:13Z
  content:
    password: H)7aLJq*%n?B
    token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJjaGFybS1hZG1pbi1FTENJIiwicGVybWlzc2lvbnMiOjEsImV4cCI6MTcyMzgyMDgzMn0.gZu2jy1VL9LkZq41zuCpXoP63866K49e3mHZmOR4xRc
    username: charm-admin-ELCI

Navigate to the application endpoint reported in juju status (https://10.152.183.188:2111 in this example) and use the username and password located in the secret to login. You should see the homepage.

5. Integrate Notary with a TLS requiring Charm

Deploy TLS Certificates Requirer and integrate it with Notary.

juju deploy tls-certificates-requirer tls-1s --channel=latest/edge
juju integrate notary-k8s:certificates  tls-1s:certificates

Once the relation settles, you will see the CSR appear in Notary.

$ juju status
Model  Controller          Cloud/Region        Version  SLA          Timestamp
demo   microk8s-localhost  microk8s/localhost  3.4.5    unsupported  11:14:12+03:00

App         Version  Status  Scale  Charm                      Channel      Rev  Address         Exposed  Message
notary-k8s           active      1  notary-k8s                 latest/edge   15  10.152.183.86   no 
tls-1s               active      1  tls-certificates-requirer  latest/edge   99  10.152.183.228  no       0/1 certificate requests are fulfilled

Unit           Workload  Agent  Address      Ports  Message
notary-k8s/0*  active    idle   10.1.90.149       
tls-1s/0*      active    idle   10.1.90.130         0/1 certificate requests are fulfilled

Integration provider     Requirer             Interface         Type     Message
notary-k8s:certificates  tls-1s:certificates  tls-certificates  regular

Download the CSR and name it example.com.csr.

6. Sign the certificate

Create a Private Key and a Signing CA Certificate

openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt

Sign the CSR that you’ve downloaded using openssl. Open a terminal and run the following command:

openssl x509 -req -in example.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out example.com.crt -days 365

You should now have a signed certificate called example.com.crt in your folder.

Create a certificate chain by listing your certificate and its issuer:

$ cat example.com.crt
-----BEGIN CERTIFICATE-----
MII...
-----END CERTIFICATE-----
$ cat ca.crt
-----BEGIN CERTIFICATE-----
MII...
-----END CERTIFICATE-----

7. Upload the certificate

Upload the certificate chain to Notary.

Your certificate will automatically be forwarded to the charm that submitted the CSR.

$ juju status
Model  Controller          Cloud/Region        Version  SLA          Timestamp
demo   microk8s-localhost  microk8s/localhost  3.4.5    unsupported  12:24:49+03:00

App         Version  Status  Scale  Charm                      Channel      Rev  Address         Exposed  Message
notary-k8s           active      1  notary-k8s                                0  10.152.183.102  no 
tls-1s               active      1  tls-certificates-requirer  latest/edge   99  10.152.183.159  no       1/1 certificate requests are fulfilled

Unit           Workload  Agent  Address      Ports  Message
notary-k8s/0*  active    idle   10.1.90.129       
tls-1s/0*      active    idle   10.1.90.155         1/1 certificate requests are fulfilled

Congratulations, you have used Notary to provision certificates in the Juju ecosystem!

8. Destroy the environment

You can now destroy your environment:

juju destroy-model demo