Deploy Fulcio with PKCS #11

Configure and deploy Fulcio in the SecureSign custom resource to use PKCS #11 HSM-backed signing keys.

Before you begin

  • Fulcio key ceremony is completed and the following Secrets are created:
    • fulcio-root-ca containing the root CA certificate
    • fulcio-pkcs11-config containing the crypto11 JSON configuration
    • hsm-credentials containing the HSM PIN
  • An OIDC provider is configured for Fulcio authentication.

Procedure

  1. Create or edit the SecureSign custom resource with Fulcio PKCS #11 configuration: 
    apiVersion: rhtas.redhat.com/v1
kind: Securesign
metadata:
  name: securesign-sample
  namespace: trusted-artifact-signer
spec:
  fulcio:
    ingress:
      enabled: true
    config:
      oidcIssuers:
        - clientID: "trusted-artifact-signer"
          issuerURL: "KEYCLOAK_URL/realms/trusted-artifact-signer"
          issuer: "KEYCLOAK_URL/realms/trusted-artifact-signer"
          type: "email"
    signer:
      type: pkcs11
      pkcs11:
        configRef:
          name: fulcio-pkcs11-config
          key: crypto11.conf
        keyID: 99
      certificateChain:
        certificateChainRef:
          name: fulcio-root-ca
          key: cert.pem
    auth:
      env:
        - name: SOFTHSM2_CONF
          value: /etc/softhsm/softhsm2.conf
    initContainers:
      - name: hsm-lib-export
        image: HSM_LIBRARY_IMAGE
        command: ["cp", "/usr/lib64/pkcs11/libsofthsm2.so", "/var/run/hsm-lib/"]
        volumeMounts:
          - name: hsm-lib
            mountPath: /var/run/hsm-lib
    volumes:
      - name: softhsm-config
        configMap:
          name: softhsm-config
      - name: hsm-tokens
        persistentVolumeClaim:
          claimName: hsm-tokens-pvc
    volumeMounts:
      - name: softhsm-config
        mountPath: /etc/softhsm
        readOnly: true
  # ... other components configuration ...

    where:

    KEYCLOAK_URL
    The URL of your OIDC provider.
    HSM_LIBRARY_IMAGE
    The container image containing your PKCS #11 library.
  2. Apply the SecureSign custom resource: 
    $ oc apply -f securesign-pkcs11.yaml -n trusted-artifact-signer
  3. Wait for Fulcio deployment to complete: 
    $ oc wait --for=condition=Ready fulcio/fulcio-server \
  -n trusted-artifact-signer --timeout=5m