Add example for using SPIRE for mTLS with Keycloak (#248)
* Add example for using Spire for mTLS with Keycloak Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Minor improvement to the README.md Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * But I still need to learn GitHub Markdown format Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Make it more obvious that it works without a (correct) password Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Add warning for Kubernetes 1.29+ feature Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Move ghostunnel into an initContainer with restartPolicy=Always Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Apply suggestions from code review Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Move java-spiffe-helper-properties into extraDeploy of the Keycloak chart and pin node version to it has a matching rancher/kubectl image Signed-off-by: Moritz Schmitz von Hülst <[email protected]> --------- Signed-off-by: Moritz Schmitz von Hülst <[email protected]> Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Moritz Schmitz von Hülst
co-authored by
kfox1111
kfox1111
parent
cc8ec897bf
commit
43a72a22ff
@@ -0,0 +1,67 @@
|
|||||||
|
# keycloak-config-cli using spire
|
||||||
|
|
||||||
|
> [!WARNING]
|
||||||
|
> This example uses
|
||||||
|
> the [`SidecarContainers`](https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/#enabling-sidecar-containers)
|
||||||
|
> feature. This is only enabled by default in Kubernetes 1.29+.
|
||||||
|
|
||||||
|
This example shows how to leverage SPIRE in establishing an mTLS connection
|
||||||
|
between [Keycloak](https://www.keycloak.org/) and [keycloak-config-cli](https://github.com/adorsys/keycloak-config-cli),
|
||||||
|
a tool to configure Keycloak.
|
||||||
|
|
||||||
|
## Setup
|
||||||
|
|
||||||
|
1. Create a local cluster for testing
|
||||||
|
|
||||||
|
```shell
|
||||||
|
kind create cluster --image kindest/node:v1.29.0
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Install CRDs
|
||||||
|
|
||||||
|
```shell
|
||||||
|
helm upgrade --install -n spire-server spire-crds ../../charts/spire-crds --create-namespace
|
||||||
|
```
|
||||||
|
|
||||||
|
3. Install `spire-server`
|
||||||
|
|
||||||
|
```shell
|
||||||
|
helm upgrade --install -n spire-server spire ../../charts/spire --create-namespace -f spire-values.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
4. Install `keycloak` (this also configures Keycloak for client certificate authentication)
|
||||||
|
|
||||||
|
```shell
|
||||||
|
helm upgrade --install keycloak oci://registry-1.docker.io/bitnamicharts/keycloak -f keycloak-values.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
5. Install `keycloak-config-cli`
|
||||||
|
|
||||||
|
```shell
|
||||||
|
kubectl apply -f keycloak-config-cli.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
6. Verify the realm config at the bottom of [keycloak-config-cli.yaml](./keycloak-config-cli.yaml) has been created!
|
||||||
|
7. Cleanup
|
||||||
|
|
||||||
|
```shell
|
||||||
|
kind delete cluster
|
||||||
|
```
|
||||||
|
|
||||||
|
## Notes
|
||||||
|
|
||||||
|
### java-spiffe-helper as Keycloak initContainer
|
||||||
|
|
||||||
|
This example uses [java-spiffe-helper](https://github.com/spiffe/java-spiffe/tree/main/java-spiffe-helper) as an
|
||||||
|
initContainer for Keycloak. It fetches the certificates from the `spire-agent` and conveniently provides them to
|
||||||
|
Keycloak in `pkcs12` format.
|
||||||
|
|
||||||
|
> [!IMPORTANT]
|
||||||
|
> Keycloak does not rotate the certificates like SPIRE does. If you want to run the `keycloak-config-cli`
|
||||||
|
> job again, you need to make sure Keycloak is also restarted/provided with non-expired certificates.
|
||||||
|
|
||||||
|
### Common name as username
|
||||||
|
|
||||||
|
This example is configured to read the username from the common name (`CN`) from the client certificate. Keycloak has
|
||||||
|
some options there, this looked like the easiest one. SPIRE joins the values from `dnsNameTemplates` in the
|
||||||
|
common name section of the certificate, so make sure you can somehow extract the username from it.
|
||||||
@@ -0,0 +1,84 @@
|
|||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: keycloak-config-cli
|
||||||
|
labels:
|
||||||
|
app: keycloak-config-cli
|
||||||
|
spec:
|
||||||
|
backoffLimit: 1
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: keycloak-config-cli
|
||||||
|
app.kubernetes.io/instance: keycloak-config-cli # This needs to match the podSelector for the SpiffeID
|
||||||
|
spec:
|
||||||
|
initContainers:
|
||||||
|
- name: ghostunnel
|
||||||
|
image: ghostunnel/ghostunnel:v1.7.3
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
restartPolicy: Always
|
||||||
|
args:
|
||||||
|
- client
|
||||||
|
- --use-workload-api-addr
|
||||||
|
- unix:///run/spire/agent-sockets/spire-agent.sock # The filename depends on what the spire-agent uses
|
||||||
|
- --listen
|
||||||
|
- localhost:8080 # Listen on local http
|
||||||
|
- --target
|
||||||
|
- keycloak:8443 # Tunnel via https
|
||||||
|
- --status
|
||||||
|
- http://0.0.0.0:6060
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
name: listen
|
||||||
|
protocol: TCP
|
||||||
|
- containerPort: 6060
|
||||||
|
name: readiness
|
||||||
|
protocol: TCP
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /_status
|
||||||
|
port: readiness
|
||||||
|
volumeMounts:
|
||||||
|
- name: spire-sockets
|
||||||
|
mountPath: /run/spire/agent-sockets
|
||||||
|
readOnly: true
|
||||||
|
containers:
|
||||||
|
- name: keycloak-config-cli
|
||||||
|
image: adorsys/keycloak-config-cli:latest
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: KEYCLOAK_URL
|
||||||
|
value: "http://127.0.0.1:8080"
|
||||||
|
- name: KEYCLOAK_USER
|
||||||
|
value: "keycloak-config-cli"
|
||||||
|
- name: KEYCLOAK_PASSWORD
|
||||||
|
value: "doesn't matter, since we are authenticated via the client certificate"
|
||||||
|
- name: KEYCLOAK_CLIENTID
|
||||||
|
value: "keycloak-config-cli" # This is the client created on bootstrapping Keycloak via the keycloak-config-cli sidecar
|
||||||
|
volumeMounts:
|
||||||
|
- name: realm
|
||||||
|
mountPath: /config
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
volumes:
|
||||||
|
- name: realm
|
||||||
|
configMap:
|
||||||
|
name: keycloak-config-cli
|
||||||
|
- name: spire-sockets
|
||||||
|
hostPath:
|
||||||
|
path: /run/spire/agent-sockets # This needs to match the path mounted by the spire-agent
|
||||||
|
type: DirectoryOrCreate
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: keycloak-config-cli
|
||||||
|
labels:
|
||||||
|
app: keycloak-config-cli
|
||||||
|
data:
|
||||||
|
keycloak-config-cli.json: |
|
||||||
|
{
|
||||||
|
"id": "keycloak-config-cli",
|
||||||
|
"realm": "keycloak-config-cli",
|
||||||
|
"enabled": true
|
||||||
|
}
|
||||||
@@ -0,0 +1,134 @@
|
|||||||
|
extraDeploy:
|
||||||
|
- apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: java-spiffe-helper-properties
|
||||||
|
data:
|
||||||
|
java-spiffe-helper.properties: |
|
||||||
|
keyStorePath=/certs/keystore.p12
|
||||||
|
keyStorePass=password
|
||||||
|
keyPass=password
|
||||||
|
trustStorePath=/certs/truststore.p12
|
||||||
|
trustStorePass=password
|
||||||
|
keyStoreType=pkcs12
|
||||||
|
keyAlias=spiffe
|
||||||
|
spiffeSocketPath=unix:/run/spire/agent-sockets/spire-agent.sock
|
||||||
|
service:
|
||||||
|
extraPorts:
|
||||||
|
- name: https
|
||||||
|
port: 8443
|
||||||
|
targetPort: 8443
|
||||||
|
extraEnvVars:
|
||||||
|
- name: KC_HTTPS_CLIENT_AUTH
|
||||||
|
value: "request"
|
||||||
|
- name: KC_HTTPS_KEY_STORE_FILE
|
||||||
|
value: "/certs/keystore.p12"
|
||||||
|
- name: KC_HTTPS_KEY_STORE_PASSWORD
|
||||||
|
value: "password"
|
||||||
|
- name: KC_HTTPS_KEY_STORE_TYPE
|
||||||
|
value: "pkcs12"
|
||||||
|
- name: KC_HTTPS_TRUST_STORE_FILE
|
||||||
|
value: "/certs/truststore.p12"
|
||||||
|
- name: KC_HTTPS_TRUST_STORE_PASSWORD
|
||||||
|
value: "password"
|
||||||
|
- name: KC_HTTPS_TRUST_STORE_TYPE
|
||||||
|
value: "pkcs12"
|
||||||
|
initContainers:
|
||||||
|
- name: java-spiffe-helper
|
||||||
|
image: ghcr.io/spiffe/java-spiffe-helper:0.8.5
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
restartPolicy: Always
|
||||||
|
readinessProbe:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- ls
|
||||||
|
- /certs/truststore.p12
|
||||||
|
volumeMounts:
|
||||||
|
- name: java-spiffe-helper-properties
|
||||||
|
mountPath: /app/java-spiffe-helper.properties
|
||||||
|
subPath: java-spiffe-helper.properties
|
||||||
|
- name: spire-sockets
|
||||||
|
mountPath: /run/spire/agent-sockets
|
||||||
|
readOnly: true
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
extraVolumeMounts:
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
extraVolumes:
|
||||||
|
- name: java-spiffe-helper-properties
|
||||||
|
configMap:
|
||||||
|
name: java-spiffe-helper-properties
|
||||||
|
- name: spire-sockets
|
||||||
|
hostPath:
|
||||||
|
path: /run/spire/agent-sockets
|
||||||
|
type: DirectoryOrCreate
|
||||||
|
- name: certs
|
||||||
|
emptyDir: {}
|
||||||
|
auth:
|
||||||
|
adminPassword: "password"
|
||||||
|
keycloakConfigCli:
|
||||||
|
enabled: true
|
||||||
|
configuration:
|
||||||
|
master.json: |
|
||||||
|
{
|
||||||
|
"id": "master",
|
||||||
|
"realm": "master",
|
||||||
|
"enabled": true,
|
||||||
|
"users": [
|
||||||
|
{
|
||||||
|
"username": "keycloak-config-cli",
|
||||||
|
"enabled": true,
|
||||||
|
"realmRoles": [
|
||||||
|
"admin"
|
||||||
|
],
|
||||||
|
"credentials": [
|
||||||
|
{
|
||||||
|
"type": "password",
|
||||||
|
"value": "it-really-doesn't-matter-what-you-put-here"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"authenticationFlows": [
|
||||||
|
{
|
||||||
|
"alias": "direct grant x509",
|
||||||
|
"providerId": "basic-flow",
|
||||||
|
"topLevel": true,
|
||||||
|
"builtIn": false,
|
||||||
|
"authenticationExecutions": [
|
||||||
|
{
|
||||||
|
"authenticatorConfig": "username",
|
||||||
|
"authenticator": "direct-grant-auth-x509-username",
|
||||||
|
"requirement": "REQUIRED",
|
||||||
|
"priority": 0
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"authenticatorConfig": [
|
||||||
|
{
|
||||||
|
"alias": "username",
|
||||||
|
"config": {
|
||||||
|
"x509-cert-auth.regular-expression": "CN=(keycloak-config-cli)",
|
||||||
|
"x509-cert-auth.mapper-selection": "Username or Email",
|
||||||
|
"x509-cert-auth.mapping-source-selection": "Match SubjectDN using regular expression"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"clients": [
|
||||||
|
{
|
||||||
|
"clientId": "keycloak-config-cli",
|
||||||
|
"name": "keycloak-config-cli",
|
||||||
|
"enabled": true,
|
||||||
|
"standardFlowEnabled": false,
|
||||||
|
"directAccessGrantsEnabled": true,
|
||||||
|
"publicClient": true,
|
||||||
|
"authenticationFlowBindingOverrides": {
|
||||||
|
"direct_grant": "direct grant x509"
|
||||||
|
},
|
||||||
|
"fullScopeAllowed": true,
|
||||||
|
"nodeReRegistrationTimeout": 0
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
spire-server:
|
||||||
|
controllerManager:
|
||||||
|
identities:
|
||||||
|
clusterSPIFFEIDs:
|
||||||
|
default:
|
||||||
|
enabled: false
|
||||||
|
keycloak:
|
||||||
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchLabels:
|
||||||
|
kubernetes.io/metadata.name: default
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: keycloak
|
||||||
|
dnsNameTemplates:
|
||||||
|
- keycloak
|
||||||
|
keycloak-config-cli:
|
||||||
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchLabels:
|
||||||
|
kubernetes.io/metadata.name: default
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: keycloak-config-cli
|
||||||
|
dnsNameTemplates:
|
||||||
|
- keycloak-config-cli # This is the common name used for the certificate. In this case, the username
|
||||||
Reference in New Issue
Block a user