scalecube / spinless

0 stars 1 forks source link

Add authorization code to authorize robokit #11

Closed artem-v closed 4 years ago

artem-v commented 4 years ago

https://github.com/scalecube/m2m-vault-poc/blob/master/README.md poc dlya m2m vault auth (edited)

How to enable vault m2m between spinless and robokit:

  1. Get spinless entity_id (this's service provider (SP)), let it be spinless_entity_id.

  2. Get robokit entity_id (this's service client or consumer (SC)), robokit_entity_id.

  3. Before spinless deploy started -- grant access to robokit on all functions. Take as a reference commands from scalecube/m2m-vault-poc/blob/master/grant_access.sh and execute against vault:

    spinless_entity_id \
    robokit_entity_id \
    spinless-operator \
    $({"allowed_actions":["scalecube-spinless:kubernetes_deploy", \
    "scalecube-spinless:cancel", \
    "scalecube-spinless:status", \
    "scalecube-spinless:get_log_api", \
    "scalecube-spinless:create_repo_api", \
    "scalecube-spinless:get_repo_api", \
    "scalecube-spinless:delete_repo_api"]} | base64)

See full list of capabilities on https://github.com/jivygroup/exchange/wiki/M2M-authorization. This command must run not neccessarly from root vault token, but by some administrative role.

  1. Once grant access executed robokit would have ability to ask a token (see content of scalecube/m2m-vault-poc/blob/master/get_access_token.sh) for himself on this url: curl --header "X-Vault-Token: $ENTITY_TOKEN" $VAULT_ADDR/v1/identity/oidc/token/spinless_entity_id.robokit_entity_id.spinless-operator
snripa commented 4 years ago

won't fix