[FEATURE] Enable Vault charm to issue PKI certificates

[Diko Parvanov]

Enable actions on the vault charm that issue PKI certificates using the PKI secrets engine: https://www.vaultproject.io/api-docs/secret/pki#generate-certificate and https://learn.hashicorp.com/vault/secrets-management/sm-pki-engine

[Frode Nordahl (fnordahl)]

The charm already supports issuing certificates [0], to understand your request I would like more information.

0: https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/latest/app-certificate-management.html

[Diko Parvanov (dparv)]

The request is to run the 'Generate Certificate' https://www.vaultproject.io/api-docs/secret/pki#generate-certificate and receive the certificate, issuing_ca, ca_chain, private_key with the generated or uploaded CA in the charm.

[Diko Parvanov (dparv)]

Goal is to receive this response: https://www.vaultproject.io/api-docs/secret/pki#sample-response-8

[Frode Nordahl (fnordahl)]

How does your use case differ from what is already implemented in the charm and what prohibits you from using the existing functionality?

[Diko Parvanov (dparv)]

The charm currently issues only a CSR, that has to manually be signed by openssl with the CA. The certificates shouldn't be provided via relations, but exported as plain text, same as get-root-ca action.

[Frode Nordahl (fnordahl)]

Thank you for your clarification, so in essence you are requesting a action-based interface to what the charm already has implemented for the charms to use through the certificates relation.

I guess that is a valid request, since this is a feature request for something not on our roadmap I will triage this as wish-list.

[Ksawery Dziekoński (ksdziekonski)]

Potential duplicate of LP#1948837.