Skip to main content

Deploy Trust Domain Servers

You'll use the Trust Domain Servers Helm chart to deploy Trust Domain Servers in your Kubernetes cluster.

The example below uses keyless authentication, where the server proves its identity to the Defakto Control Plane with its Kubernetes ServiceAccount rather than a deployment key. Register the TrustDomainServerAttestation policy for this deployment before deploying:

spirlctl config set trust-domain-deployment --id tdd-nnlo6k3t3o trust-domain-server-attestation.yaml

Here is an example of the Helm chart values file. You should adjust it to your needs.

# SPIRL Trust Domain Server Settings

trustDomainDeployment:
  # Trust domain and ID come from "spirlctl trust-domain register" command.
  # You can always find them again using "spirlctl trust-domain list"
  trustDomainName: "spirl.example.com"
  trustDomainID: "td-diok4t8ahq"

  # The trust domain deployment ID is generated when creating the deployment
  # in the previous step.
  id: "tdd-nnlo6k3t3o"

  # The "name" corresponds to the value passed to "deployment create" during deployment
  # creation in the previous step.
  name: "us-west-2"

controlPlane:
  auth:
    # Authenticate with the server's Kubernetes ServiceAccount. No key required.
    k8sToken:
      enabled: true

# Firefly integration settings
integrations:
  venafi:
    firefly:
      config:
        # Set values from your Venafi account
        clientID: 69d68ca3-9498-11ee-b560-6abasd6fd152
        policyName: SPIRL-venafi-demo
        image: registry.venafi.cloud/public/venafi-images/firefly:v1.4.2
        # This is your Venafi Root CA, which needs to be provided separately
        # because it is not distributed by Firefly.
        trustAnchorPem: |
          -----BEGIN CERTIFICATE-----
            your root CA certificate here
          -----END CERTIFICATE-----
        # Set your Venafi service account private key.
        svcAccKeyPem: |
          -----BEGIN PRIVATE KEY-----
            your private key from the Venafi Firefly service account
          -----END PRIVATE KEY-----

Download the latest Trust Domain Server Helm Chart​

You can download the latest version of the Helm chart by running the following command.

helm pull oci://ghcr.io/spirl/charts/spirl-server -d .

Deploy Trust Domain Servers​

You can deploy Trust Domain Servers using the following command. Note that:

  1. The --namespace value must contain the trustDomainDeployment.id defined in values.yaml
  2. The helm RELEASE argument (first positional argument) must equal the trustDomainDeployment.id defined in values.yaml
helm upgrade --install --namespace $YOUR_TD_DEPLOYMENT_ID-example \
--create-namespace \
--values ./values.yaml \
$YOUR_TD_DEPLOYMENT_ID ./spirl-server-undefined.tgz

The command should produce output similar to the following:

Release "tdd-nnlo6k3t3o" does not exist. Installing it now.
NAME: tdd-nnlo6k3t3o
LAST DEPLOYED: Tue Dec 19 08:28:26 2023
NAMESPACE: tdd-nnlo6k3t3o-example
STATUS: deployed
REVISION: 1
TEST SUITE: None