akeyless-cert-manager-issuer

README

akeyless-cert-manager-issuer

Repository: github.com/akeyless-community/akeyless-cert-manager-issuer.

External cert-manager issuer for Akeyless PKI (Certificate Issuer / Get PKI Certificate API). Implements AkeylessIssuer and AkeylessClusterIssuer and signs CertificateRequest resources using the Akeyless Go SDK.

Features

• PKCS#10 CSR forwarded to Akeyless /get-pki-certificate with PEM encoding expected by the gateway.
• Authentication to /auth (pick one per issuer): access key, Kubernetes, AWS IAM, Azure AD, GCP, Universal Identity, JWT; legacy credentialsSecretRef for access key only.
• issuer-lib integration: issuer Check + Sign, approval-aware CertificateRequest reconciliation.

Documentation

• Environment checklist & E2E testing — Phase 0 (Akeyless PKI path + DNS alignment), RBAC, controller flags, public vs internal CA tracks, auth examples.
• Akeyless ACME server + cert-manager — use cert-manager’s built-in ACME issuer (not this controller); EAB and example manifests under examples/acme/.

Native API vs ACME

This controller implements the Akeyless REST API (/get-pki-certificate). It does not speak ACME.

If your PKI Cert Issuer has ACME Server enabled on the gateway, configure a standard cert-manager ClusterIssuer with spec.acme pointing at
https://<gateway>/acme/<issuer-display-id>/directory and External Account Binding — see docs/ACME.md.

Requirements

• Kubernetes cluster with cert-manager installed.
• Akeyless gateway reachable from the controller (in-cluster Deployment or local go run with KUBECONFIG).
• This repository’s CRDs applied (deploy/crds/).

Production install

Build and push a versioned image first:

docker build -t ghcr.io/akeyless-community/akeyless-cert-manager-issuer:v0.1.0 --build-arg VERSION=v0.1.0 .
docker push ghcr.io/akeyless-community/akeyless-cert-manager-issuer:v0.1.0

Then set that image in deploy/production/base/deployment.yaml or deploy/production/install.yaml, and install:

kubectl apply -f deploy/production/install.yaml

Production assets included in this repo:

• Dockerfile — multi-stage static build
• deploy/crds/ — strict CRDs generated by controller-gen
• deploy/production/base/ — namespace, RBAC, service account, deployment, metrics service
• deploy/production/install.yaml — single-file install manifest
• deploy/production/samples/issuer-accesskey.example.yaml — sample AkeylessClusterIssuer

Quick start (development)

kubectl apply -f deploy/crds/
kubectl apply -f examples/local-test/00-namespace.yaml
kubectl apply -f examples/local-test/01-rbac.yaml
# Create Secret + AkeylessIssuer from examples (see docs/ENVIRONMENT-RECHECK.md)
cd /path/to/akeyless-cert-manager-issuer
go run -buildvcs=false ./cmd/controller/ --leader-elect=false

The local go run flow is meant for development and debugging. For shared clusters, use the production manifests above: the controller runs as a replicated Kubernetes Deployment with leader election enabled, hardened container security settings, and generated CRDs.

Build

go build -buildvcs=false -o bin/controller ./cmd/controller/

Build container

docker build -t ghcr.io/akeyless-community/akeyless-cert-manager-issuer:v0.1.0 --build-arg VERSION=v0.1.0 .

License

Apache License 2.0. See NOTICE for copyright.

Push this tree to GitHub (akeyless-community)

Git is already initialized with main and an initial commit in this directory.

1. In the Akeyless Community org, click New repository.
2. Name it akeyless-cert-manager-issuer, leave it empty (no README, no .gitignore, no license — this tree already has them).
3. Add the remote and push:

cd /path/to/akeyless-cert-manager-issuer
git remote add origin https://github.com/akeyless-community/akeyless-cert-manager-issuer.git
git push -u origin main

Use SSH if you prefer: git@github.com:akeyless-community/akeyless-cert-manager-issuer.git.

Contributing

Issues and PRs are welcome. For large changes, open an issue first to agree on approach.