Certificate access point renewal

Edit online

Using Concert Workflows, you can track expiration and automatically renew certificates that are associated with public access points. This helps you ensure the availability of your services and avoid outages. Use this workflow to automatically renew certificates associated with a Kubernetes or OpenShift® Container Platform (OCP) cluster.

Before you begin

  • You must have installed Concert and Concert Workflows as a SaaS or on-premises software solution.

Step 1: Import the prebuilt workflow

To import a workflow:
  1. In Concert Workflows, go to the Workflows page.
  2. Click Create workflow > Select from library.
  3. Import the Discover_Public_Access_Points_From_Kubernetes_And_OCP workflow.

Step 2: Create the required authentications

The Discover_Public_Access_Points_From_Kubernetes_And_OCP workflow requires two authentications to establish a valid connection with the external systems referenced in the workflow:

  • You must create an authentication referencing the IBM Concert API Key service to establish a connection with your Concert instance. While using the IBM Concert API Key option, you must provide additional details to create the authentication, including the protocol, host, instance ID, API key type (usually C_API_Key), and the API key secret. Refer to Authenticating from Concert workflows to Concert topic.

  • You must create an authentication to establish a connection with the Kubernetes or OCP cluster.

    Draft comment: erin.pelkey@ibm.com
    This section needs to be updated/corrected. As confirmed with the meeting with Vrunda, there are TWO authentications the user needs to create: One is the IBM Hub - Self and the other would be whichever service is required to connect to the Kubernetes cluster.

You can create the authentications from the Authentications page or from within the workflow editor by opening a workflow and clicking the Auth button. Refer to Using authentications for instructions.

Note: Each authentication requires you to enter a unique name. Record the name of both authentications configured as you will need to enter them in the workflow editor in the next step.

Step 3: Edit the imported workflow

After importing the workflow file to Concert Workflows, you must edit the workflow to apply the authentications configured in the previous step.

  1. In Concert Workflows, navigate to the Workflows page.
  2. Click the name of the workflow, Discover_Public_Access_Points_From_Kubernetes_And_OCP, to open it in the workflow editor.
  3. In the list of user variables, locate the concertAuth variable and edit the Default value by entering the unique name of the IBM Hub - Self or IBM Concert API Key authentication you created in Step 2.
    You can locate concertAuth in the Workflows page.
  4. Locate the serviceAuth variable and edit the Default value by entering the unique name of the authentication you created in Step 2 to connect with your Kubernetes cluster.
    You can locate serviceAuth in the Workflows page.
  5. Next to the namespace variable, edit the Default value by entering one or more namespaces for which the public access point is to be discovered.
    Draft comment: erin.pelkey@ibm.com
    What does this mean exactly? Can you give an example of what we expect to be entered. An example demonstrating multiple namespaces would be helpful.
    Note: The namespace array should not be empty. Specify multiple namespaces as a comma-separated list where each namespace is surrounded by double quotation marks.
  6. Next to the envName variable, enter the name of the target environment as defined in your Concert instance. Data that is ingested by this workflow will be associated with the environment specified here.
  7. Next to the systemType variable, enter either kubernetes or ocp depending on the type of service.
  8. Next to the apiServer variable, enter the endpoint value of the OCP or Kubernetes API server.
    Draft comment: erin.pelkey@ibm.com
    What specifically are they entering here? URL? IP address?
  9. Click Save to save all edits made to the imported workflow.

The imported workflow is updated to include both authentications with your Concert instance and Kubernetes or OCP cluster).

Step 4: Run the workflow or schedule a Concert Workflows job

There are three options for running or scheduling the workflow to run.

Option A: Run the workflow one time from Concert Workflows
  1. Navigate to the Workflows page.
  2. Click the overflow menu (in the Actions column) next to the workflow.
  3. Click Run.
Option B: Schedule a recurring job in Concert Workflows

To configure recurring data ingestion, create a Concert Workflows job to automatically initiate compliance data ingestion at a defined interval. Refer to Creating jobs for instructions.

Attention: Workflow jobs can take longer to complete. You can access the log data from Workflows > History. The job status is displayed under Status. Expand to view details.
Option C: Configure an automation rule in Concert to trigger the workflow automatically
You can create an automation rule to trigger a workflow based on a specific condition in your Concert instance. This requires you to establish a connection between Concert and your Concert Workflows instance. Refer to Automating Concert Workflows using automation rules.
Note: Before configuring an automation rule to trigger a workflow, you must expose the workflow in your Concert Workflows instance so it appears in your Concert instance.

Step 5: View certificates

Run the workflow to retrieve the newly added or renewed certificates. This triggers the renewal endpoint for any certificate, which is eligible for renewal. For renewal, any old certificate is revoked and a new one will be added. All newly imported certificates are available in Concert. You can go to Dimensions > Operations > Certificates to see the certificates.