Managing security certificates

Vault is used to store configuration data, and it can contain the secrets for Commerce+ security. Vault is ideal for this implementation path because it can also act as a Certification Authority (CA) to issue SSL certificates.

To deploy HCL Commerce+, set up Vault using the hcl-commerce-vault-helmchart Helm Chart. In this configuration.

For more information about Vault, see Vault.

Procedure

  1. Set up Kubernetes Environment: To setup the environment, create a namespace for Vault kubectl create ns vault and their namespace for dev and q as well.
  2. Configure and update the values.yaml file.
    • Copy the default values.yaml file for customizing cp values.yaml my-values.yaml.
    • Open my-values.yaml file to adjust configuration values for the specific environment.
    • Configure vault image settings:
      • Set the imageRepo and other relevant docker image settings for vault (for example, vaultImageName, vaultImageTag, etc.).
    • Update tenant name and any environment-specific key-value pairs under vaultData commerceNameSpaces:
      • commerce-dev
      • commerce-qa
  3. If required, you can generate a self-signed CA certificate manually. To create and persist the CA certificate manually:
    • Generate the private key: "openssl genrsa -out private.key 2048"
    • Generate the self-signed CA certificate "openssl req -x509 -new -nodes -key private.key -days 730 -out ca.pem -config req.conf"
    • Create a secret in Kubernetes "kubectl create secret tls my-vault-ca --cert=ca.pem --key=private.key -n vault"
    • Update values.yaml file to point to this secret externalCA:
      enabled: true
existingSecretName: 'my-vault-ca'
autoCreate: false
  4. Deploy vault. Install the Helm chart using the following custom configuration: 
    helm install vault ./hcl-commerce-vault -f my-values.yaml -n vault
  5. Verify the deployment.
    • Check if the vault pods are running. 
      kubectl get pods -n vault
      The result appears as shown below: 
      vault-xxxx 2/2 Running 0 20d
    • Check that the vault token secret exists in the commerce namespace 
      kubectl get secret vault-token-secret -n commerce
      Test the helm deployment. 
      helm test vault -n vault
  6. Update the vault configuration:
    • Modify the vault configuration or update values.yaml file, then upgrade the deployment. 
      " helm upgrade vault ./hcl-commerce-vault -f my-values.yaml -n vault"
  7. Upgrade the deployment.

The vault is successfully deployed and configured to store Commerce+ configuration data and issue certificates for Commerce+.