+
+
+
+
+
+
+ + + Support + + · + + Installation + + · + + License + + · + + Related Integrations + +
-The F5 WAF Orchestrator is an extension to the Keyfactor Universal Orchestrator. It Integrates with Multi-Cloud App Connect, which is F5 Distributed Cloud's service for connecting apps across clouds and within on premise installationss using load balancers. The purpose of the F5 WAF orchestrator is to manage the TLS and CA Root certificates. The TLS certificates may be bound to load balancers. The orchestrator facilitates the inventory, addition, renewal, and removal of these certificates as well as the discovery of namespaces (certificate stores) within the F5 Multi-Cloud App Connect instance. +## Overview -#### Integration status: Production - Ready for use in production environments. +The F5 WAF Orchestrator extension remotely manages TLS and CA Root certificates uploaded to F5 Distributed Multi-Cloud App Connect, which is the F5 platform that manages WAF services. Certificates bound to Http Load Balancers within Multi-Cloud App Connect can be renewed/replaced, but they cannot be removed. Certificate store types f5WafTls and f5WafCa are used to manage stores containing TLS and CA Root certificates, respectively. -## About the Keyfactor Universal Orchestrator Extension +The F5 WAF Universal Orchestrator extension implements 2 Certificate Store Types. Depending on your use case, you may elect to use one, or both of these Certificate Store Types. Descriptions of each are provided below. -This repository contains a Universal Orchestrator Extension which is a plugin to the Keyfactor Universal Orchestrator. Within the Keyfactor Platform, Orchestrators are used to manage “certificate stores” — collections of certificates and roots of trust that are found within and used by various applications. +
+To use the F5 WAF Universal Orchestrator extension, you **must** create the Certificate Store Types required for your usecase. This only needs to happen _once_ per Keyfactor Command instance.
+The F5 WAF Universal Orchestrator extension implements 2 Certificate Store Types. Depending on your use case, you may elect to use one, or both of these Certificate Store Types.
+F5 WAF TLS (f5WafTls)
-### Example PAM Provider Setup
-To use a PAM Provider to resolve a field, in this example the __Server Password__ will be resolved by the `Hashicorp-Vault` provider, first install the PAM Provider extension from the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) on the Universal Orchestrator.
+* **Create f5WafTls using kfutil**:
-Next, complete configuration of the PAM Provider on the UO by editing the `manifest.json` of the __PAM Provider__ (e.g. located at extensions/Hashicorp-Vault/manifest.json). The "initialization" parameters need to be entered here:
+ ```shell
+ # F5 WAF TLS
+ kfutil store-types create f5WafTls
+ ```
-~~~ json
- "Keyfactor:PAMProviders:Hashicorp-Vault:InitializationInfo": {
- "Host": "http://127.0.0.1:8200",
- "Path": "v1/secret/data",
- "Token": "xxxxxx"
- }
-~~~
+* **Create f5WafTls manually in the Command UI**:
+ Create f5WafTls manually in the Command UI
-After these values are entered, the Orchestrator needs to be restarted to pick up the configuration. Now the PAM Provider can be used on other Orchestrator Extensions.
+ Create a store type called `f5WafTls` with the attributes in the tables below:
-### Use the PAM Provider
-With the PAM Provider configured as an extenion on the UO, a `json` object can be passed instead of an actual value to resolve the field with a PAM Provider. Consult the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) for the specific format of the `json` object.
+ #### Basic Tab
+ | Attribute | Value | Description |
+ | --------- | ----- | ----- |
+ | Name | F5 WAF TLS | Display name for the store type (may be customized) |
+ | Short Name | f5WafTls | Short display name for the store type |
+ | Capability | f5WafTls | Store type name orchestrator will register with. Check the box to allow entry of value |
+ | Supports Add | ✅ Checked | Check the box. Indicates that the Store Type supports Management Add |
+ | Supports Remove | ✅ Checked | Check the box. Indicates that the Store Type supports Management Remove |
+ | Supports Discovery | ✅ Checked | Check the box. Indicates that the Store Type supports Discovery |
+ | Supports Reenrollment | 🔲 Unchecked | Indicates that the Store Type supports Reenrollment |
+ | Supports Create | 🔲 Unchecked | Indicates that the Store Type supports store creation |
+ | Needs Server | ✅ Checked | Determines if a target server name is required when creating store |
+ | Blueprint Allowed | ✅ Checked | Determines if store type may be included in an Orchestrator blueprint |
+ | Uses PowerShell | 🔲 Unchecked | Determines if underlying implementation is PowerShell |
+ | Requires Store Password | 🔲 Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. |
+ | Supports Entry Password | 🔲 Unchecked | Determines if an individual entry within a store can have a password. |
-To have the __Server Password__ field resolved by the `Hashicorp-Vault` provider, the corresponding `json` object from the `Hashicorp-Vault` extension needs to be copied and filed in with the correct information:
+ The Basic tab should look like this:
-~~~ json
-{"Secret":"my-kv-secret","Key":"myServerPassword"}
-~~~
+ 
-This text would be entered in as the value for the __Server Password__, instead of entering in the actual password. The Orchestrator will attempt to use the PAM Provider to retrieve the __Server Password__. If PAM should not be used, just directly enter in the value for the field.
-