--- title: Charmhub | Deploy Notary using Charmhub - The Open Operator Collection description: Deploy the latest version of Notary on any cloud. url: https://charmhub.io/notary/docs/getting-started --- # Notary [Yazan Salti](https://charmhub.io/publisher/yazansalti "View all packages from Yazan Salti") * [Yazan Salti](https://charmhub.io/publisher/yazansalti "View all packages from Yazan Salti") Platform: 24.04 edge 1 ``` juju deploy notary --channel edge ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) --- #### Relevant links * [Homepage](https://charmhub.io/notary) --- #### Contacts * [Submit a bug](https://github.com/canonical/notary-k8s-operator/issues) --- Share your thoughts on this charm with the community on discourse. [Join the discussion](https://discourse.charmhub.io/) # Getting Started In this tutorial, we will deploy Notary on Kubernetes and use it to provide a TLS certificate to a charm requesting one. ## [Pre-requisites](https://charmhub.io/notary/docs/getting-started#p-33259-pre-requisites) A Ubuntu 22.04 machine with the following requirements: * A `x86_64` CPU * 8GB of RAM * 20GB of free disk space ## [1. Install MicroK8s](https://charmhub.io/notary/docs/getting-started#p-33259-h-1-install-microk8s) ``` sudo snap install microk8s --channel=1.29-strict/stable ``` Enable the storage and dns add-ons: ``` sudo microk8s enable hostpath-storage sudo microk8s enable dns ``` ## [2. Bootstrap a Juju controller](https://charmhub.io/notary/docs/getting-started#p-33259-h-2-bootstrap-a-juju-controller) From your terminal, install Juju: ``` sudo snap install juju --channel=3.4/stable ``` Bootstrap a Juju controller: ``` juju bootstrap microk8s ``` ## [3. Deploy Notary](https://charmhub.io/notary/docs/getting-started#p-33259-h-3-deploy-notary) Create a Juju model named `demo`: ``` juju add-model demo ``` Deploy the Notary K8s operator: ``` juju deploy notary-k8s --channel latest/edge ``` Notary will become active and ready to use in a couple seconds. ``` $ juju status Model Controller Cloud/Region Version SLA Timestamp demo microk8s-localhost microk8s/localhost 3.4.5 unsupported 17:07:25+03:00 App Version Status Scale Charm Channel Rev Address Exposed Message notary-k8s active 1 notary-k8s latest/edge 4 10.152.183.188 no Unit Workload Agent Address Ports Message notary-k8s/0* active idle 10.1.90.190 ``` ## [4. Get the Login Information](https://charmhub.io/notary/docs/getting-started#p-33259-h-4-get-the-login-information) Get the login information directly from juju secrets: ``` $ juju secrets ID Name Owner Rotation Revision Last updated cqvlq37mp25c77vaabgg - notary-k8s never 5 1 minute ago ``` ``` $ juju show-secret --reveal cqvlq37mp25c77vaabgg cqvlq37mp25c77vaabgg: revision: 5 owner: notary-k8s label: Notary Login Details created: 2024-08-16T14:07:09Z updated: 2024-08-16T14:07:13Z content: password: H)7aLJq*%n?B token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJjaGFybS1hZG1pbi1FTENJIiwicGVybWlzc2lvbnMiOjEsImV4cCI6MTcyMzgyMDgzMn0.gZu2jy1VL9LkZq41zuCpXoP63866K49e3mHZmOR4xRc username: charm-admin-ELCI ``` Navigate to the application endpoint reported in juju status (`https://10.152.183.188:2111` in this example) and use the username and password located in the secret to login. You should see the homepage. ## [5. Integrate Notary with a TLS requiring Charm](https://charmhub.io/notary/docs/getting-started#p-33259-h-5-integrate-notary-with-a-tls-requiring-charm) Deploy [TLS Certificates Requirer](https://charmhub.io/tls-certificates-requirer) and integrate it with Notary. ``` juju deploy tls-certificates-requirer tls-1s --channel=latest/edge juju integrate notary-k8s:certificates tls-1s:certificates ``` Once the relation settles, you will see the CSR appear in Notary. ``` $ juju status Model Controller Cloud/Region Version SLA Timestamp demo microk8s-localhost microk8s/localhost 3.4.5 unsupported 11:14:12+03:00 App Version Status Scale Charm Channel Rev Address Exposed Message notary-k8s active 1 notary-k8s latest/edge 15 10.152.183.86 no tls-1s active 1 tls-certificates-requirer latest/edge 99 10.152.183.228 no 0/1 certificate requests are fulfilled Unit Workload Agent Address Ports Message notary-k8s/0* active idle 10.1.90.149 tls-1s/0* active idle 10.1.90.130 0/1 certificate requests are fulfilled Integration provider Requirer Interface Type Message notary-k8s:certificates tls-1s:certificates tls-certificates regular ``` Download the CSR and name it `example.com.csr`. ## [6. Sign the certificate](https://charmhub.io/notary/docs/getting-started#p-33259-h-6-sign-the-certificate) Create a Private Key and a Signing CA Certificate ``` openssl genrsa -out ca.key 2048 openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt ``` Sign the CSR that you’ve downloaded using `openssl`. Open a terminal and run the following command: ``` openssl x509 -req -in example.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out example.com.crt -days 365 ``` You should now have a signed certificate called `example.com.crt` in your folder. Create a certificate chain by listing your certificate and its issuer: ``` $ cat example.com.crt -----BEGIN CERTIFICATE----- MII... -----END CERTIFICATE----- $ cat ca.crt -----BEGIN CERTIFICATE----- MII... -----END CERTIFICATE----- ``` ## [7. Upload the certificate](https://charmhub.io/notary/docs/getting-started#p-33259-h-7-upload-the-certificate) Upload the certificate chain to Notary. Your certificate will automatically be forwarded to the charm that submitted the CSR. ``` $ juju status Model Controller Cloud/Region Version SLA Timestamp demo microk8s-localhost microk8s/localhost 3.4.5 unsupported 12:24:49+03:00 App Version Status Scale Charm Channel Rev Address Exposed Message notary-k8s active 1 notary-k8s 0 10.152.183.102 no tls-1s active 1 tls-certificates-requirer latest/edge 99 10.152.183.159 no 1/1 certificate requests are fulfilled Unit Workload Agent Address Ports Message notary-k8s/0* active idle 10.1.90.129 tls-1s/0* active idle 10.1.90.155 1/1 certificate requests are fulfilled ``` Congratulations, you have used Notary to provision certificates in the Juju ecosystem! ## [8. Destroy the environment](https://charmhub.io/notary/docs/getting-started#p-33259-h-8-destroy-the-environment) You can now destroy your environment: ``` juju destroy-model demo ``` ---