Getting Started
In this tutorial, we will use the TLS Constraints, Self Signed Certificates and 2 TLS Requirer charms to demonstrate how to use the constraints charm to block CSR’s from being forwarded to the TLS Provider.
1. Install pre-requisites
Install MicroK8s:
sudo snap install microk8s
Enable the hostpath-storage MicroK8s add-on:
microk8s enable hostpath-storage
Install Juju:
sudo snap install juju
2. Bootstrap a Juju controller
Bootstrap a Juju controller:
juju bootstrap microk8s
Create a Juju model:
juju add-model demo
3. Deploy Self Signed Certificates
juju deploy self-signed-certificates
4. Deploy tls-certificates-requirers
juju deploy ch:tls-certificates-requirer tls-requirer1
juju deploy ch:tls-certificates-requirer tls-requirer2
5. Deploy TLS Constraints
juju deploy tls-constraints --channel beta
6. Relate the Upstream Certificate Provider
juju integrate tls-constraints:certificates-upstream self-signed-certificates
7. Configure TLS Constraints
juju config tls-constraints limit-to-one-request=True
Feel free to inspect all of the config options to see what’s available
8. Relate the Downstream Certificate Requirers
juju integrate tls-constraints:certificates-downstream tls-requirer1
juju integrate tls-constraints:certificates-downstream tls-requirer2
You should see the second requirer be filtered out
juju status
Model Controller Cloud/Region Version SLA Timestamp
demo microk8s-localhost microk8s/localhost 3.4.2 unsupported 14:31:22Z
App Version Status Scale Charm Channel Rev Address Exposed Mess
age
self-signed-certificates active 1 self-signed-certificates latest/stable 72 10.152.183.172 no
tls-constraints active 1 tls-constraints latest/beta 47 10.152.183.134 no
tls-requirer1 active 1 tls-certificates-requirer latest/stable 72 10.152.183.159 no Cert
ificate is available
tls-requirer2 active 1 tls-certificates-requirer latest/stable 72 10.152.183.68 no Cert
ificate request is sent
Unit Workload Agent Address Ports Message
self-signed-certificates/0* active idle 10.1.252.83
tls-constraints/0* active idle 10.1.252.127
tls-requirer1/0* active idle 10.1.252.89 Certificate is available
tls-requirer2/0* active idle 10.1.252.98 Certificate request is sent
Integration provider Requirer Interface Type Message
self-signed-certificates:certificates tls-constraints:certificates-upstream tls-certificates regular
tls-constraints:certificates-downstream tls-requirer1:certificates tls-certificates regular
tls-constraints:certificates-downstream tls-requirer2:certificates tls-certificates regular