TrustStore

A TrustStore is a Kubernetes resource that can be used to request the trust anchor information (such as the TLS certificate authorities) from a SecretClass.

This can be used to access a protected service from other services that do not require their own certificates (or from clients running outside of Kubernetes).

A TrustStore looks like this:

---
apiVersion: secrets.stackable.tech/v1alpha1
kind: TrustStore
metadata:
  name: truststore-pem (1)
spec:
  secretClassName: tls (2)
  format: tls-pem (3)

1	Also used to name the created ConfigMap
2	The name of the SecretClass
3	The requested format

This will create a ConfigMap named truststore-pem containing a ca.crt with the trust root certificates. It can then either be mounted into a Pod or retrieved and used from outside of Kubernetes.

Make sure to have a procedure for updating the retrieved certificates. The Secret Operator will automatically rotate the autoTls certificate authority as needed, but all trust roots will require some form of update occasionally.