Pre-requisites

This page provides details on actions that must be done before the Cofide Connect Control Plane can be installed.

Pre-requisites

• Setup a Kubernetes cluster where you will host Connect (this can be bare-metal, VM or a cloud provider such as EKS or GKE).
• Obtain access to the Cofide container image repositories (for Connect and SPIRE component images). Contact the Cofide team to arrange this.
• Decide on how services will be exposed outside the cluster with TLS termination at the pod (e.g. if running on EKS you can use the AWS Load Balancer controller).
• Decide on how DNS will route to services exposed outside the cluster (e.g. if running on EKS you can use external-dns with Route53).
• Configure an OAuth 2.0 / OIDC identity provider to authenticate users to Connect (most operators already run one). See Identity provider requirements.

Choose a domain to host the Control Plane

The control plane has 5 services that need to be exposed outside the cluster:

• OIDC discovery endpoint for the control plane’s trust domain
• Connect API’s web-PKI service
• Connect API’s SPIFFE mTLS service
• Connect API’s SPIFFE XDS service
• web-based UI dashboard

These can be exposed on any domain and hostname you desire. In the rest of this guide we will use he following example hostnames:

• oidc-discovery: OIDC discovery
• connect.example.cofide.dev: Connect web-PKI service
• connect-agent.example.cofide.dev: Connect SPIFFE mTLS service
• xds.example.cofide.dev: Connect SPIFFE XDS service
• app.example.cofide.dev: dashboard

Replace these with your chosen values. The API, mTLS and XDS server hostnames (and their TLS server names, if they need to differ) are configured explicitly via the connect.apiAddress, connect.mtlsServerName and connect.xdsServerName Helm values; see Deploy API.

Choose a Trust Domain

The control plane’s trust domain can be anything you wish; common choices would be the domain on which the control plane is exposed but any trust domain name compatible with the SPIFFE standard can be used. In the rest of this guide we will use connect-trust-domain as a placeholder.