Project: Athenz (Provisioning / Key Management)
File: Athenz-bootstrap.md

<a id="markdown-athenz-bootstrap-with-docker" name="athenz-bootstrap-with-docker"></a> <!-- TOC --> - - - - <!-- /TOC --> <a id="markdown-athenz-components" name="athenz-components"></a> <a id="markdown-trust-in-athenz" name="trust-in-athenz"></a> In Athenz, we often have 3 types of CA: Athenz CA issuing certificates for all Athenz components Athenz components include ZMS ZTS Athenz UI User CA issuing certificates for Athenz users Athenz users are users required to access the Athenz API directly Athenz users include Athenz admin Domain admin of other services usually provided by an identity provider Service CA issuing certificates for applications/robots/workloads (service) a service can access Athenz API by acting on behalf the service user's identity using the pre-injected service identity during deployment phase usually provided by an identity framework running on the deployment environment example of identity framework Athenz SPIFFE example of deployment environment Kubernetes OpenStack <a id="markdown-bootstrap-steps" name="bootstrap-steps"></a> If you just want to try out Athenz, please jump to section. For details, please read and then start from step 4 (Set up ZMS). Ask your CA to sign the following certificates Athenz CA ZMS API server certificate ZTS API server certificate User CA Athenz domain admin certificate Service CA Intermediate CA certificate for ZTS certificate signer ZTS client certificate Set up your deployment environment with (you may want to modify it beforehand) ```bash BASE_DIR="$(git rev-parse --show-toplevel)" . "${BASE_DIR}/docker/env.sh" ``` Copy your CAs certificates in `$CA_DIR` ```bash echo ${ATHENZCAPATH} echo ${USERCAPATH} echo ${SERVICECAPATH} ``` Set up ZMS () Set up ZTS () Simple verification of the deployment (`make verify`) Verify your setup () ) <a id="markdown-appendix" name="appendix"></a> <a id="markdown-athenz-demo-playback-castcast" name="athenz-demo-playback-castcast"></a> ](https://asciinema.org/a/330037) <a id="markdown-points-to-note" name="points-to-note"></a> All Athenz principal are normalized to lower case. The suggested MySQL settings only provide the minimal functionality. Please consult your DB administrator to have the optimal configuration. The order of the Authority classes is important. `OAuth > certificate` <a id="markdown-automation-shortcut" name="automation-shortcut"></a> same as `make deploy-dev` ```bash BASE_DIR="$(git rev-parse --show-toplevel)" . "${BASE_DIR}/docker/env.sh" docker run --rm -t \ -v "${BASE_DIR}:/athenz" \ --user "$(id -u):$(id -g)" \ athenz-setup-env \ sh /athenz/docker/setup-scripts/self-signed-certificates.sh docker run --rm -t \ -v "${BASE_DIR}:/athenz" \ --user "$(id -u):$(id -g)" \ athenz-setup-env \ sh /athenz/docker/setup-scripts/zms-auto-config.sh sh "${DOCKER_DIR}/deploy-scripts/zms-deploy.sh" docker run --rm -t \ --network="${DOCKER_NETWORK}" \ -v "${BASE_DIR}:/athenz" \ --user "$(id -u):$(id -g)" \ athenz-setup-env \ sh /athenz/docker/deploy-scripts/zms-debug.sh docker run --rm -t \ --network="${DOCKER_NETWORK}" \ -v "${BASE_DIR}:/athenz" \ --user "$(id -u):$(id -g)" \ athenz-setup-env \ sh /athenz/docker/setup-scripts/zts-auto-config.sh sh "${DOCKER_DIR}/deploy-scripts/zts-deploy.sh" docker run --rm -t \ --network="${DOCKER_NETWORK}" \ -v "${BASE_DIR}:/athenz" \ --user "$(id -u):$(id -g)" \ athenz-setup-env \ sh /athenz/docker/deploy-scripts/zts-debug.sh ``` <a id="markdown-todo" name="todo"></a> [later] fix "Missing key manager password for the key store: " in `com.yahoo.athenz.common.utils.SSLUtils` remove `athenz.zms.client.keymanager_password=dummy` in `zts.properties` [later] support auto ZTS client certificate rotation in ZMS client inside ZTS (`ZMSFileChangeLogStore`)