As I have understood after reviewing the Helm chart YAML files for ziti-controller, the default CA structure is as follows:
[ROOT CA] release-name-controller-selfsigned-ca-issuer (Self-Signed)
├── [ROOT CA] release-name-controller-ctrl-plane-root-issuer
│ ├── [INTERMEDIATE CA] release-name-controller-ctrl-plane-intermediate-issuer
│ │ ├── [CERT] release-name-controller-ctrl-plane-identity (Controller)
│ │ ├── [CERT] release-name-controller-ctrl-plane-client-identity (Client)
│
├── [ROOT CA] release-name-controller-edge-root-issuer
│ ├── [INTERMEDIATE CA] release-name-controller-edge-signer-issuer
│ ├── [CERT] release-name-controller-admin-client-cert (Admin)
│
├── [ROOT CA] release-name-controller-web-root-issuer
│ ├── [INTERMEDIATE CA] release-name-controller-web-intermediate-issuer
│ ├── [CERT] release-name-controller-web-identity-cert (Web)
│ ├── [CERT] release-name-controller-web-client-identity (Web Client)
Expected CA Structure with Enterprise PKI
I want to use Enterprise PKI as the root CA instead of the Helm-generated self-signed CA, with the expected structure as follows:
[ROOT CA] Enterprise PKI Root CA <-- (Managed by Organization's Security Team)
├── [INTERMEDIATE CA] Enterprise PKI Intermediate CA <-- (Issued from Root CA)
│ ├── [INTERMEDIATE CA] release-name-controller-ctrl-plane-root-issuer
│ │ ├── [INTERMEDIATE CA] release-name-controller-ctrl-plane-intermediate-issuer
│ │ │ ├── [CERT] release-name-controller-ctrl-plane-identity (Controller)
│ │ │ ├── [CERT] release-name-controller-ctrl-plane-client-identity (Client)
│ │
│ ├── [INTERMEDIATE CA] release-name-controller-edge-root-issuer
│ │ ├── [INTERMEDIATE CA] release-name-controller-edge-signer-issuer
│ │ ├── [CERT] release-name-controller-admin-client-cert (Admin)
│ │
│ ├── [INTERMEDIATE CA] release-name-controller-web-root-issuer
│ ├── [INTERMEDIATE CA] release-name-controller-web-intermediate-issuer
│ │ ├── [CERT] release-name-controller-web-identity-cert (Web)
│ │ ├── [CERT] release-name-controller-web-client-identity (Web Client)
What I Tried
After reading the following sources:
- OpenZiti Documentation:
- Ziti-Controller Helm Chart Values YAML:
I thought that mentioning ctrlPlane.alternativeIssuer.kind & ctrlPlane.alternativeIssuer.name in Helm values would allow Enterprise PKI to be used instead of the self-signed CA.
However, the CA structure generated by Helm still uses self-signed issuers instead of the external PKI.
What I Found
After checking the Helm templates (templates/) directory in:
https://github.com/openziti/helm-charts/tree/main/charts/ziti-controller/templates
I do not see ctrlPlane.alternativeIssuer.kind & ctrlPlane.alternativeIssuer.name being used anywhere in the Helm templates.
This raises the question:
- Does the Helm chart support using an external CA like Enterprise PKI?
- If yes, what values should be set in
values.yaml? - Or do we need to manually create the CA and inject it via Kubernetes Secrets before Helm installation?
values.yaml Used
This is the values.yaml file we used:
clientApi:
advertisedHost: ziti-controller.example.com
service:
enabled: true
type: ClusterIP
ingress:
enabled: true
ingressClassName: "nginx"
annotations:
kubernetes.io/ingress.allow-http: "false"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
external-dns.alpha.kubernetes.io/hostname: "ziti-controller.example.com"
service.beta.kubernetes.io/aws-load-balancer-internal: "false" # Ensures the LB is public
service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
service.beta.kubernetes.io/aws-load-balancer-security-groups: "sg-0d5ee2792bcbd86a4"
service.beta.kubernetes.io/aws-load-balancer-manage-backend-security-group-rules: "true"
ctrlPlane:
containerPort: "{{ .Values.clientApi.containerPort }}"
advertisedHost: "{{ .Values.clientApi.advertisedHost }}"
advertisedPort: "{{ .Values.clientApi.advertisedPort }}"
service:
enabled: true
type: ClusterIP
alternativeIssuer:
kind: ClusterIssuer
name: enterprise-pki-cluster-issuer
highAvailability:
mode: standalone
replicas: 1
persistence:
enabled: true
storageClass: "ebs-sc"
accessMode: ReadWriteOnce
size: 3Gi
cert-manager:
enabled: false # Installed it manually in ziti-controller namespace
trust-manager:
enabled: false # Installed it manually in ziti-controller namespace
ingress-nginx:
enabled: true
controller:
extraArgs:
enable-ssl-passthrough: "true"
service:
annotations:
service.beta.kubernetes.io/aws-load-balancer-internal: "false"
service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
service.beta.kubernetes.io/aws-load-balancer-security-groups: "sg-0d5ee2792bcbd86a4"
service.beta.kubernetes.io/aws-load-balancer-manage-backend-security-group-rules: "true"
Despite setting ctrlPlane.alternativeIssuer.kind=ClusterIssuer and ctrlPlane.alternativeIssuer.name=enterprise-pki-cluster-issuer, the Helm deployment still created self-signed CAs instead of using the external PKI.
Request for Help
- How can we correctly use Enterprise PKI as the root CA?
- Is there a proper way to override the Helm chart defaults to prevent self-signed CA creation?
- Do we need to manually provision the CA secrets and then reference them in the Helm values?
- Has anyone successfully used an external CA with OpenZiti in Kubernetes?
Any help or guidance would be much appreciated!
