CENM Signing Service Helm chart

This Helm chart is to configure, deploy, and run the CENM Signing Service on Kubernetes.

As the initial step this chart runs automatically PKI tool which creates and stores certificates necessary for correct Corda Network operation. By default, the certificates have sample X.500 subject names (for example, the Identity Manager Service certificate has the subject name “CN=Test Identity Manager Service Certificate, OU=HQ, O=HoldCo LLC, L=New York, C=US”). The subject name can be set by configuration options starting with pki.certificates. prefix.

Passwords to the security certificates keys and keystores cannot be configurable.

For more information about PKI Tool and Certificate Hierarchy refer to:

• Certificate Hierarchy Guide
• PKI Tool

Example usage

In the example below, the default values are used:

helm install cenm-signer signer --set prefix=cenm --set acceptLicense=Y

In the example below, the default values are overwritten:

helm install cenm-signer signer --set idmanPublicIP=X.X.X.X --set prefix=cenm --set acceptLicense=Y --set volumeSizeSignerLogs=5Gi

Parameters starting with prefix “pki.certificates.” allow to override the default subject/issuer X500 names of the Corda certificates. The example command to bootstrap Signing Service with the X500 name “CN=Company A TLS Signer Certificate […]” of the subject and the issuer of the certificate for signing the CRL:

helm install signer signer --set idmanPublicIP=13.71.57.219 --set pki.certificates.tlscrlsigner.subject="CN=Company A TLS Signer Certificate\, OU=HQ\, O=HoldCo LLC\, L=London\, C=UK" --set pki.certificates.tlscrlsigner.crl.issuer="CN=Company A TLS Signer Certificate\, OU=Corda\, O=R3 HoldCo LLC\, L=New York\, C=US"

The name needs to be a valid X500 name and commas need to be escaped by a backslash character “\”.

Configuration variables