Private CA
One org ROOT and tagged subordinates for Host, Cluster, front-proxy, service-account, etcd, and managed-services. Private keys stay KMS-wrapped and Raft-replicated. Operate from Cloud /private-ca next to KMS and Secrets.
Workload and tenant PKI, cert-manager Issuers, and managed-pack TLS share the same fabric CA — without putting long-lived roots in Kamaji or plaintext PEMs in git.
Architecture
Org ROOT → subordinates → consumers
Ensure root and cluster CAs, export material to Talos/Kamaji/AMS, then Issue leaves or MintTLS for managed packs.
Org ROOT
One self-signed trust root for the site. Private key stays KMS-wrapped in the daemon — never exported.
Subordinates
Host, Cluster (kubernetes), front-proxy, SA, etcd, and managed-services roles tagged per cluster.
KMS wrap
Each CA private key is envelope-encrypted by a fabric CMK and Raft-replicated with AMS and KMS.
Cloud + ctl
Operate from /private-ca or aanjaleyad ctl private-ca — Ensure, Issue, Revoke, Rotate, bindings.
- 1
Ensure org ROOT
StartPlatform (or Cloud Ensure org root) mints aanjaleya-org-root if missing. Subordinates never see the ROOT private key.
- 2
Ensure Host + Cluster subordinates
Per workload or tenant: Host CA (Talos machine.ca) and Cluster CA (Kubernetes API / Kamaji BYO). Mode A tenants also get front-proxy and service-account.
- 3
Export material to consumers
Workload paths write workdir pca/ plus AMS workload-host-ca / workload-cluster-ca. Tenants pre-seed Kamaji secrets and a cert-manager Issuer from the Host CA Secret — fail closed, no silent self-signed.
- 4
Issue leaves two ways
Daemon IssueCertificate (CSR) tracks inventory + revoke/CRL. Managed packs use MintTLS offline against the shared managed-services subordinate — those leaves are not in the PCA cert table.
Product ARNs
Minted via libraries only — aanjaleya:acm-pca:::ca:… and aanjaleya:acm-pca:::certificate:…. Sister pillars: Managed Secrets & KMS.
# CA ARN aanjaleya:acm-pca:::ca:ca-org-root01 aanjaleya:acm-pca:::ca:ca-tn-k8s01 # Issued certificate ARN aanjaleya:acm-pca:::certificate:cert-a1b2c3d4
Always-on core
Third security pillar
Private CA ships as platform core with KMS, Managed Secrets, cert-manager, Flux, CapA, Cilium, ABS, Kamaji, Zot, and Cloud — not an optional pack toggle.
The API is ACM PCA–shaped for operator familiarity. Control plane is the fabric daemon over gRPC — baseline private CA, not a public multi-region ACM product.