Skip to content

Docs for smallstep/certificates#2133 #424

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 10, 2025
Merged

Docs for smallstep/certificates#2133 #424

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f2dbbad
Docs for smallstep/certificates#2133
tashian Jul 9, 2025
46722fb
Clarify language around project ID token
tashian Jul 9, 2025
63725e9
Merge branch 'main' into carl/gcp-orgs
tashian Jul 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion step-ca/provisioners.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
updated_at: July 07, 2025
updated_at: July 09, 2025
title: Configuring `step-ca` Provisioners
html_title: Configuring open source step-ca Provisioners
description: Learn how to configure step-ca Provisioners
Expand Down Expand Up @@ -1575,6 +1575,7 @@ In the `ca.json`, a GCP provisioner looks like:
"name": "Google Cloud",
"serviceAccounts": ["1234567890"],
"projectIDs": ["project-id"],
"organizationID": "organization-id",
"disableCustomSANs": false,
"disableTrustOnFirstUse": false,
"instanceAge": "1h",
Expand All @@ -1601,6 +1602,8 @@ In the `ca.json`, a GCP provisioner looks like:
- **projectIDs**<Reference id="star9" marker="*" />: the list of project identifiers that are allowed to
use this provisioner. If non is specified all project will be valid.

- **organizationID**: an optional GCP organization ID. If provided, the provisioner will verify that the project ID in the token belongs to the GCP organization, using the `projects.getAncestry` call in the Cloud Resource Manager API.

- **disableCustomSANs**<Reference id="star9" marker="*" />: by default custom SANs are valid, but if this
option is set to true only the SANs available in the instance identity
document will be valid, these are the DNS
Expand Down