search

cyberark / conjur-authn-k8s-client

Authentication sidecar for Conjur Kubernetes integration.
https://www.conjur.org
Apache License 2.0
12 stars 14 forks source link

There is an initial cluster prep helm chart #232

Closed izgeri closed 3 years ago

izgeri commented 3 years ago

Overview

This user story requires the definition of a cluster prep helm chart, including:

Desired Implementation

Out of Scope:

Kubernetes Objects to be Created for Helm install/upgrade

When helm install ... is invoked on this Helm chart, there should be two Kubernetes objects created in the authenticator Namespace:

Sample Golden ConfigMap Manifest

When helm install ... is invoked using this Helm chart, Helm should render a manifest for a Golden ConfigMap that looks similar to the following:

apiVersion: v1
kind: ConfigMap
metadata:
  name: authn-k8s-config-map
  labels:
    app.kubernetes.io/name: golden-configmap
    app.kubernetes.io/component: conjur-config
    app.kubernetes.io/instance: <Authenticator Namespace>
    app.kubernetes.io/part-of: authn-k8s-cluster-config
    app.kubernetes.io/managed-by: helm
    helm.sh/chart: <Chart name>-<Chart version>
data:
  # authn-k8s Configuration
  authnK8sAuthenticatorID: my-authenticator-id
  authnK8sClusterRole: conjur-authenticator-clusterrole
  authnK8sNamespace: conjur-ns
  authnK8sServiceAccount: conjur-sa

  # Conjur Configuration
  conjurAccount: myConjurAccount
  conjurApplianceUrl: https://conjur.conjur-ns.svc.cluster.local
  conjurSslCertificate: <Unencoded Conjur SSL certificate>
  conjurSslCertificateBase64: <base64 encoded Conjur SSL certificate>

Sample ClusterRole Manifest

When helm install ... is invoked using this Helm chart, Helm should render a manifest for a ClusterRole that looks similar to the following:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/name: authn-k8s-clusterrole
    app.kubernetes.io/component: authn-k8s-permissions
    app.kubernetes.io/instance: <Authenticator Namespace>
    app.kubernetes.io/part-of: authn-k8s-cluster-config
    app.kubernetes.io/managed-by: helm
    helm.sh/chart: <Chart name>-<Chart version>
  name: authn-k8s
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - serviceaccounts
  verbs:
  - get
  - list
- apiGroups:
  - extensions
  resources:
  - deployments
  - replicasets
  verbs:
  - get
  - list
- apiGroups:
  - apps
  resources:
  - deployments
  - statefulsets
  - replicasets
  verbs:
  - get
  - list
- apiGroups:
  - ""
  resources:
  - pods/exec
  verbs:
  - create
  - get

Sample ServiceAccount Manifest

When helm install ... is invoked using this Helm chart, Helm should render a manifest for a ServiceAccount that looks similar to the following:

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/name: authn-k8s-serviceaccount
    app.kubernetes.io/component: authn-k8s-identity
    app.kubernetes.io/instance: <Authenticator Namespace>
    app.kubernetes.io/part-of: authn-k8s-cluster-config
    app.kubernetes.io/managed-by: helm
    helm.sh/chart: <Chart name>-<Chart version>
  name: authn-k8s

Helm chart Files to be created

This Helm chart requires the creation of the following files in the chart subdirectory:

values.yaml requirements

The values.yaml file created for this Helm chart must contain the fields that are listed in the "Kubernetes Cluster Prep Helm Chart Value" column of the "User Input: Information Gathered for Kubernetes Cluster Preparation" section of this document: https://cyberark365.sharepoint.com/:w:/s/Conjur/EbhBd0DKYt1MstzSj-4sWOkBssiD23FAHA4JgW-2V2YwrA?e=04gdla.

Additional "control knobs"

The values.yaml file should also include a couple of other "control knobs":

Template manifests requirements

The template manifests must enforce that required values have been explicitly defined. Required values are those fields in the values.yaml file that are indicated as "Mandatory" in the "Kubernetes Cluster Prep Helm Chart Value" column of the "User Input: Information Gathered for Kubernetes Cluster Preparation" section of this document: https://cyberark365.sharepoint.com/:w:/s/Conjur/EbhBd0DKYt1MstzSj-4sWOkBssiD23FAHA4JgW-2V2YwrA?e=04gdla.

README.md requirements

The README.md must include:

NOTES.txt requirements

NOTES.txt should announce completion, maybe listing objects that have been deployed

Environments on Which to Test

For this implementation, it should be sufficient to test this Helm chart on:

DoD:

izgeri commented 3 years ago

@diverdane will this include programmatically retrieving the Conjur SSL certificate, as we researched in cyberark/conjur#2038?

diverdane commented 3 years ago

@izgeri - Re. Conjur SSL certificate retrieval, I've added a requirement that the README.md must include step-by-step instructions on how a user can retrieve the Conjur SSL certificate using the Golang code and steps that @doodlesbykumbi developed and documented.

FYI: For future consideration, there may be a way to make this a little more seamless for the Kubernetes admin by integrating the Golang code that does Conjur SSL cert retrieval with the Helm chart by using Helm chart "Post Renderer": https://helm.sh/docs/topics/advanced/#post-rendering The post renderer could be a bash script or it could be wrapped in the Helm Go SDK: https://helm.sh/docs/topics/advanced/#go-sdk