step-issuer

step-issuer

Chainguard's redistribution of the step-issuer Helm chart, pre-configured with hardened Chainguard Images. It provides an external cert-manager issuer backed by a Smallstep step-ca certificate authority.

Prerequisites

Authentication is required to access this chart and its images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret for the cluster:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace step-issuer

step-issuer is an external cert-manager issuer, so cert-manager must already be installed in the cluster:

helm install cert-manager oci://cgr.dev/ORGANIZATION/charts/cert-manager \
  --namespace cert-manager --create-namespace \
  --set crds.enabled=true

A reachable step-ca instance and a JWK provisioner are also required; follow the upstream Getting Started guide to configure stepIssuer.caUrl, stepIssuer.caBundle, and provisioner values.

Installation

helm install step-issuer oci://cgr.dev/ORGANIZATION/charts/step-issuer \
  --namespace step-issuer --create-namespace \
  --set "imagePullSecrets={cgr-pull-secret}"

About This Chart

This is a redistribution of the upstream step-issuer Helm chart. All upstream configuration options and documentation apply.

For full documentation, see: https://github.com/smallstep/step-issuer