Requirements and Considerations¶

When developing Issuer solutions for the Machine Identity Management Control Plane, you should always build with the goal of certification in mind.

Minimum Requirements¶

• The solution must be open source and its container images published to publicly available image registries.
• The solution must automate the production of machine identities from the underlying provider to enforce the security of traffic between workloads.
• The solution will expect cert-manager to hand CertificateRequest objects to it and be able to, directly or indirectly, produce a machine identity.

Security Considerations¶

The extent of your security considerations is somewhat governed by the intention of your Issuer.

As the developer of an Issuer solution, you will need to determine if your underlying Certificate Authority (CA) could be required to secure internet traffic or not. Internal traffic could be deemed to be secure when plain-text communication is eliminated, which is easier to ensure. The requirements for securing internet traffic are likely higher, since your responsibility now extends to cover concerns such as identity and attestation (e.g. "is this domain owner really who they say they are?")

To clarify, you would find it much easier to build a self-signed Issuer than an Issuer for something like a Certificate Authority where security concerns such as authentication would need to be addressed.

Building a Better User Experience¶

The user experience should be as painless as possible and the expectation is that your solution should be:

• Easy to install, preferably via Helm
• Able to deploy an MVP into your cluster with little or no configuration requirements
• Provide comprehensive logs and metrics for diagnostic purposes
• Provide complete/appropriate documentation online and via CRDs

Conforming to the these requirements will greatly enhance the user experience, providing additional value to teams and organizations whilst paving the way to certification of your solution.

Success Stories¶

Existing solutions that fit within this pattern: