I want to accelerate every Ziti identity’s life cycle (i.e., identity, router, controller) to ensure everything works smoothly. Identity and router enrollments seem to default to 365d. Which controller options should I set to bring the pain forward on potential certificate life cycle issues? I know…

Hi @qrkourier , I’m currently investigating into the helm charts you provided and they already ease the process of installing openziti into k8s a lot ! Thanks for that! I just wondered how all the certs that you manage with cert-manager are then actually integrated into the running pods as soon as …

Hi there @janst ! You and I are thinking about the same stuff regarding running Ziti in prod with K8s. The encompassing question is "How do I run Ziti in production?" and that's going to be a collaboration over time that hopefully produces some helpful hints in the "deployment" area of the docs and t…

[image] janst: Are all certs lifetimes extended automatically and if yes how ? ( except the client certs - these need to be renewed like this ?) I'll let the post immediately above serve to answer the server certificate part of your question, and focus here on the client certificate part of …

[image] janst: Can I automatically backup the internal bbolt DB ? Or is there a way to run it externally besides the cluster ? The controller's Helm chart doesn't yet provide any maintenance jobs, and the CLI hints you're after are ziti agent controller --help and ziti ops db --help. …

[image] janst: How I can update openzitis controller & routers without downtime ? Can I run routers with different versions at the same time with the same controller, so I could do a rollout of new router versions without shutting all of them down and replacing them - so actually taking down t…

Hi @qrkourier , thanks for your thorough answer(s)! I would absolutely like to collaborate on these topics and I will respond to the ones you brought up next week. :slight_smile: Currently I’m working on visualizing how the cert-management works in combination with the cert- & trust-manager to set…

I did some documentation a while back.. hope this helps.. it may be a bit out of date [image] QuickStart Certificate Authority summary Ziti Overlay I am working on some documentation to help understand the three PKIs that are used in the QuickStart example The following …

I found a few more comments that I also wrote up below. [Screenshot 2023-07-06 at 9.21.50 pm] Important Notes: Opening port 8441 allows remote users to connect the Controller REST API. Instructions on how to close this port are included in the Extensions section below, which will disable ZAC. On…

Hi @markamind , thanks for the hint. Unfortunately I still cant’t fully comprehend how the entities in my drawing and the config of the controller relates. I hope that somebody can enlighten me :wink: I think if someone sees this the first time it is hard to follow through by just reading textual i…

When I started learning OpenZiti… I started from a blank page… which is why I started with ports / services… as it made it easier to understand. When you move into certificates and trust… I believe its better to think in control plane data plan certificate signing When you do this… you will be a…

Certificate life cycle

markamind July 6, 2023, 11:20am 8

I did some documentation a while back.. hope this helps.. it may be a bit out of date

Topic		Replies	Views
Certificate Expired General Questions	19	981	October 27, 2023
Things to keep in mind while managing ziti controller Ziti Overlay	8	175	July 1, 2024
General Architecture Questions General Questions	18	417	March 10, 2024
Openziti installation in production like environment Support	45	1996	December 31, 2022
What would openziti arch for this look like Ziti Overlay	89	546	June 17, 2024

Certificate life cycle

Related topics