From a2494ee45ecf09dacda6733fa701109a0b674bd2 Mon Sep 17 00:00:00 2001 From: Mohammed Abdi Date: Thu, 25 Apr 2024 18:49:20 -0400 Subject: [PATCH] Add auth option for Tornjak (#259) * Added auth option, specifically keycloak for tornjak production use Signed-off-by: Mohammed Abdi * Added auth values for tornjak Signed-off-by: Mohammed Abdi * Update charts/spire/charts/tornjak-frontend/values.yaml Co-authored-by: Faisal Memon Signed-off-by: Mohammed Abdi * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon Signed-off-by: Mohammed Abdi * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon Signed-off-by: Mohammed Abdi * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon Signed-off-by: Mohammed Abdi * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon Signed-off-by: Mohammed Abdi * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon Signed-off-by: Mohammed Abdi * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon Signed-off-by: Mohammed Abdi * nit Signed-off-by: Mohammed Abdi * nit Signed-off-by: Mohammed Abdi * nit Signed-off-by: Mohammed Abdi * Update examples/tornjak/keycloak/README.md Co-authored-by: Mariusz Sabath Signed-off-by: Mohammed Abdi * nit Signed-off-by: Mohammed Abdi * install keycloak first Signed-off-by: Mohammed Abdi * add logs volume back Signed-off-by: Mohammed Abdi * Fixed NPM init error Signed-off-by: Mariusz Sabath * Fixed the values documentation errors Signed-off-by: Mariusz Sabath * Post-review suggestion fixes Signed-off-by: Mariusz Sabath * Fixed typo Signed-off-by: Mariusz Sabath * Updating Keyclaok examples README Signed-off-by: Mariusz Sabath * Fixed the parameter reference Signed-off-by: Mariusz Sabath * Fix typo Signed-off-by: Mariusz Sabath * use keycloak-config-cli to simplify tornjak realm import Signed-off-by: MohammedAbdi * edit client id Signed-off-by: MohammedAbdi * reverse client id Signed-off-by: MohammedAbdi * fix the doc Signed-off-by: Mariusz Sabath * update tornjak version and backend auth Signed-off-by: MohammedAbdi * update client id Signed-off-by: MohammedAbdi * updates values yaml Signed-off-by: MohammedAbdi * update documentation Signed-off-by: MohammedAbdi * nit Signed-off-by: MohammedAbdi * update doc Signed-off-by: MohammedAbdi * add audience check tornjak Signed-off-by: MohammedAbdi * remove unused file Signed-off-by: MohammedAbdi * update doc Signed-off-by: MohammedAbdi * nit and add auth not enabled warning back Signed-off-by: MohammedAbdi * adjust liveness probe until tornjak handles liveendpoint for auth and direct connection to discovery Signed-off-by: MohammedAbdi * update doc and add keycloak proxy Signed-off-by: MohammedAbdi --------- Signed-off-by: Mohammed Abdi Signed-off-by: Mohammed Abdi Signed-off-by: Mariusz Sabath Signed-off-by: MohammedAbdi Co-authored-by: Mohammed Abdi Co-authored-by: Faisal Memon Co-authored-by: Mariusz Sabath --- charts/spire/charts/spire-server/README.md | 5 +- .../charts/spire-server/templates/NOTES.txt | 8 +- .../templates/server-resource.yaml | 2 +- .../templates/tornjak-config.yaml | 8 ++ charts/spire/charts/spire-server/values.yaml | 10 +- .../spire/charts/tornjak-frontend/Chart.yaml | 2 +- .../spire/charts/tornjak-frontend/README.md | 91 +++++++------ .../tornjak-frontend/templates/NOTES.txt | 10 +- .../templates/deployment.yaml | 8 +- .../spire/charts/tornjak-frontend/values.yaml | 24 ++-- examples/tornjak/README.md | 8 +- examples/tornjak/keycloak/README.md | 114 ++++++++++++++++ examples/tornjak/keycloak/values.yaml | 128 ++++++++++++++++++ examples/tornjak/values-auth.yaml | 12 ++ examples/tornjak/values.yaml | 1 + 15 files changed, 360 insertions(+), 71 deletions(-) create mode 100644 examples/tornjak/keycloak/README.md create mode 100644 examples/tornjak/keycloak/values.yaml create mode 100644 examples/tornjak/values-auth.yaml diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 7fe6ccf..9270736 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -340,7 +340,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | | `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` | -| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.4.2` | +| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.6.0` | | `tornjak.service.type` | Type of service resource | `ClusterIP` | | `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | | `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | @@ -361,6 +361,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | | | `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` | | `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` | +| `tornjak.config.userManagement` | UserManagement config | | +| `tornjak.config.userManagement.issuer` | UserManagement issuer URL | `""` | +| `tornjak.config.userManagement.audience` | UserManagement audience check | `""` | | `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` | | `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | | `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt index 1b3053b..f4d368f 100644 --- a/charts/spire/charts/spire-server/templates/NOTES.txt +++ b/charts/spire/charts/spire-server/templates/NOTES.txt @@ -9,10 +9,12 @@ Installed {{ .Chart.Name }}… Installed {{ include "spire-tornjak.fullname" . }}… -### WARNING ### +{{- if eq .Values.tornjak.config.userManagement.issuer "" }} + ### WARNING ### -Tornjak runs without authentication and is therefore NOT suitable to run in production environments. -Only use in test environments! + Tornjak is configured to run without authentication and is therefore NOT suitable to run in production environments. + Only use in test environments! +{{- end }} Access Tornjak: kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.servicename" . }} {{ .Values.tornjak.service.ports.http }}:10000 diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index 4793db9..a661a3b 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -319,7 +319,7 @@ spec: startupProbe: httpGet: scheme: HTTP - path: /api/tornjak/serverinfo + path: / port: 10000 {{- toYaml .Values.tornjak.startupProbe | nindent 12 }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/tornjak-config.yaml b/charts/spire/charts/spire-server/templates/tornjak-config.yaml index f187e47..ec7b2e6 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-config.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-config.yaml @@ -42,5 +42,13 @@ data: } } {{- end }} + {{- if ne .Values.tornjak.config.userManagement.issuer "" }} + UserManagement "KeycloakAuth" { + plugin_data { + issuer = "{{ .Values.tornjak.config.userManagement.issuer }}" + audience = "{{ .Values.tornjak.config.userManagement.audience }}" + } + } + {{- end }} } {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 3417651..4369b9c 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -805,7 +805,7 @@ tornjak: repository: spiffe/tornjak-backend pullPolicy: IfNotPresent tag: "" - defaultTag: "v1.4.2" + defaultTag: "v1.6.0" service: ## @param tornjak.service.type Type of service resource @@ -868,7 +868,13 @@ tornjak: driver: "sqlite3" ## @param tornjak.config.dataStore.file File path for sqlite3 file file: "/run/spire/data/tornjak.sqlite3" - + ## @extra tornjak.config.userManagement [object] UserManagement config + userManagement: + ## @param tornjak.config.userManagement.issuer UserManagement issuer URL + issuer: "" + ## @param tornjak.config.userManagement.audience UserManagement audience check + audience: "" + # Tornjak supports 3 connection types: `http`, `tls`, and `mtls`. # The connections are determined based on provided configuration # When `tlsSecret` is created in this chart namespace, the TLS connection is started diff --git a/charts/spire/charts/tornjak-frontend/Chart.yaml b/charts/spire/charts/tornjak-frontend/Chart.yaml index d8f94c8..2d67db3 100644 --- a/charts/spire/charts/tornjak-frontend/Chart.yaml +++ b/charts/spire/charts/tornjak-frontend/Chart.yaml @@ -3,7 +3,7 @@ name: tornjak-frontend description: A Helm chart to deploy Tornjak frontend type: application version: 0.1.0 -appVersion: "v1.4.2" +appVersion: "v1.6.0" home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: - https://github.com/spiffe/tornjak diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 31d5db1..0216f45 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -55,47 +55,50 @@ port forwarding. See the chart NOTES output for more details. ### Chart parameters -| Name | Description | Value | -| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `imagePullSecrets` | Pull secrets for images | `[]` | -| `nameOverride` | Name override | `""` | -| `namespaceOverride` | Namespace override | `""` | -| `fullnameOverride` | Fullname override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `labels` | Labels for tornjak frontend pods | `{}` | -| `podSecurityContext` | Pod security context | `{}` | -| `securityContext` | Security context | `{}` | -| `service.type` | Service type | `ClusterIP` | -| `service.port` | Service port | `3000` | -| `service.annotations` | Annotations for service resource | `{}` | -| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | -| `affinity` | Affinity rules | `{}` | -| `tolerations` | List of tolerations | `[]` | -| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | -| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. | `""` | -| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | -| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | -| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | -| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | -| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | -| `workingDir` | Set to override the default path containing the Tornjak frontend within the image | `""` | -| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | -| `ingress.className` | Ingress class name for Tornjak frontend service | `""` | -| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | -| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | -| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` | -| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | -| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | -| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | -| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | -| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a0383e176104e7840387deb9fda1782660e903654f39acf62931e2c9a60b7fe1` | +| Name | Description | Value | +| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `imagePullSecrets` | Pull secrets for images | `[]` | +| `nameOverride` | Name override | `""` | +| `namespaceOverride` | Namespace override | `""` | +| `fullnameOverride` | Fullname override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `labels` | Labels for tornjak frontend pods | `{}` | +| `podSecurityContext` | Pod security context | `{}` | +| `securityContext` | Security context | `{}` | +| `service.type` | Service type | `ClusterIP` | +| `service.port` | Service port | `3000` | +| `service.annotations` | Annotations for service resource | `{}` | +| `nodeSelector` | (Optional) Select specific nodes to run on. Tornjak currently supports amd64 and arm64 architectures | `{}` | +| `affinity` | Affinity rules | `{}` | +| `tolerations` | List of tolerations | `[]` | +| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | +| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If not provided, auto-detection is attempted. | `""` | +| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | +| `auth.enabled` | Enables auth for Tornjak | `false` | +| `auth.serverURL` | URL of the Auth service. Tornjak Frontend will redirect to this URL to authenticate the user | `""` | +| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | +| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | +| `workingDir` | Set to override the default path containing the Tornjak frontend within the image | `""` | +| `logsDir` | Directory path for NPM logs | `/home/node/` | +| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | +| `ingress.className` | Ingress class name for Tornjak frontend service | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a0383e176104e7840387deb9fda1782660e903654f39acf62931e2c9a60b7fe1` | diff --git a/charts/spire/charts/tornjak-frontend/templates/NOTES.txt b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt index 85a568e..ad5c90f 100644 --- a/charts/spire/charts/tornjak-frontend/templates/NOTES.txt +++ b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt @@ -10,11 +10,15 @@ Tornjak UI (Frontend) pull policy: {{ .Values.image.pullPolicy }} Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }} SPIRE health check enabled: "{{ .Values.spireHealthCheck.enabled }}" + User Managemenet enabled: "{{ .Values.auth.enabled }}" + User Managemenet API: "{{ .Values.auth.serverURL }}" -### WARNING ### +{{- if not .Values.auth.enabled }} + ### WARNING ### -Tornjak runs without authentication and is therefore NOT suitable to run in production environments. -Only use in test environments! + Tornjak is configured to run without authentication and is therefore NOT suitable to run in production environments. + Only use in test environments! +{{- end }} Access Tornjak: diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml index 84e152b..97d187a 100644 --- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml @@ -35,10 +35,14 @@ spec: env: - name: REACT_APP_API_SERVER_URI value: {{ include "tornjak-frontend.apiURL" . }} - {{- if eq (.Values.spireHealthCheck.enabled | toString) "true" }} + {{- if .Values.spireHealthCheck.enabled }} - name: REACT_APP_SPIRE_HEALTH_CHECK_ENABLE value: "{{ .Values.spireHealthCheck.enabled }}" {{- end }} + {{- if .Values.auth.enabled }} + - name: REACT_APP_AUTH_SERVER_URI + value: "{{ .Values.auth.serverURL }}" + {{- end }} {{- if .Values.startupProbe.enabled }} startupProbe: httpGet: @@ -57,7 +61,7 @@ spec: - name: env mountPath: {{ include "tornjak-frontend.workingDir" . }}/build/tmp - name: logs - mountPath: /opt/app-root/src/.npm/ + mountPath: {{ .Values.logsDir }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index bba2b51..44ae3ec 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -63,10 +63,8 @@ service: port: 3000 annotations: {} -## @extra nodeSelector Select specific nodes to run on (currently only amd64 is supported by Tornjak) -nodeSelector: - ## @skip nodeSelector.kubernetes.io/arch - kubernetes.io/arch: amd64 +## @param nodeSelector (Optional) Select specific nodes to run on. Tornjak currently supports amd64 and arm64 architectures +nodeSelector: {} ## @param affinity [object] Affinity rules affinity: {} @@ -86,7 +84,7 @@ topologySpreadConstraints: [] # cpu: 100m # memory: 512Mi -## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. +## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If not provided, auto-detection is attempted. apiServerURL: "" # SPIRE Healthchecker indicator @@ -94,6 +92,13 @@ spireHealthCheck: ## @param spireHealthCheck.enabled Enables the SPIRE Healthchecker indicator enabled: true +# User Management +auth: + ## @param auth.enabled Enables auth for Tornjak + enabled: false + ## @param auth.serverURL URL of the Auth service. Tornjak Frontend will redirect to this URL to authenticate the user + serverURL: "" + ## Configure extra options for Tornjak frontend container's startup probe ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes ## @param startupProbe.enabled Enable startupProbe on Tornjak frontend container @@ -114,9 +119,12 @@ startupProbe: ## @param workingDir Set to override the default path containing the Tornjak frontend within the image workingDir: "" +## @param logsDir Directory path for NPM logs +logsDir: "/home/node/" + ## @param ingress.enabled Flag to enable ingress for Tornjak frontend service ## @param ingress.className Ingress class name for Tornjak frontend service -## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. +## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. ## @param ingress.annotations [object] Annotations for Tornjak frontend service ingress: enabled: false @@ -130,14 +138,14 @@ ingress: ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. tlsSecret: "" - ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + ## @param ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var. hosts: [] # - host: tornjak-frontend.example.org # paths: # - path: / # pathType: Prefix - ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. + ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: chart-example-tls # hosts: diff --git a/examples/tornjak/README.md b/examples/tornjak/README.md index 51bdc4d..cf876ca 100644 --- a/examples/tornjak/README.md +++ b/examples/tornjak/README.md @@ -1,8 +1,5 @@ # Recommended setup to deploy Tornjak -> [!Warning] -> The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production. - To install Spire with the least privileges possible we deploy spire across 2 namespaces. ```shell @@ -13,7 +10,7 @@ kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restri # deploy SPIRE with Tornjak enabled helm upgrade --install --namespace spire-server spire charts/spire \ ---values examples/production/values.yaml \ +--values tests/integration/psat/values.yaml \ --values examples/tornjak/values.yaml \ --render-subchart-notes @@ -48,11 +45,10 @@ Update examples/production/example-your-values.yaml with your information, most ```shell helm upgrade --install --namespace spire-server spire charts/spire \ ---values examples/production/values.yaml \ +--values tests/integration/psat/values.yaml \ --values examples/tornjak/values.yaml \ --values examples/tornjak/values-ingress.yaml \ --set global.spire.ingressControllerType=ingress-nginx \ ---values examples/production/example-your-values.yaml \ --render-subchart-notes --debug ``` diff --git a/examples/tornjak/keycloak/README.md b/examples/tornjak/keycloak/README.md new file mode 100644 index 0000000..46cc2c6 --- /dev/null +++ b/examples/tornjak/keycloak/README.md @@ -0,0 +1,114 @@ +# Deploy Tornjak with Authentication Enabled + +This example demonstrates Tornjak's capability to control access to the Frontend Application using +User Management via [Keycloak](https://www.keycloak.org/). + +Tested on: +- Keycloak Application Version - 24.0.3 +- Keycloak Chart Version - 21.0.3 + +For more information regarding Tornjak User Management, please refer to the following documentation: + +* [Tornjak User Management](https://github.com/spiffe/tornjak/blob/main/docs/keycloak-configuration.md) +* [Keycloak Configuration for Tornjak](https://github.com/spiffe/tornjak/blob/main/docs/keycloak-configuration.md) +* [Detailed Blogs on Tornjak User Management](https://github.com/spiffe/tornjak/blob/main/docs/blogs.md) + +**NOTE:** This example works only with the Vanilla version of Kubernetes; it does not yet support Openshift. + +As part of the exercise, an instance of Keycloak is deployed to illustrate how to manage users' access to Tornjak. +Once enabled, the Tornjak UI will redirect all authentication calls to the Keycloak instance to obtain the +correct credentials. Authorization is based on these credentials and occurs at the Tornjak application level. + +## Deploy Keycloak Instance (Authentication Service) + +We will deploy the instance of Keycloak in the same namespace as the SPIRE Server + +```shell +# Create a namespace to deploy Keycloak and SPIRE-server +kubectl create namespace spire-server +``` + +```shell +# Deploy Keycloak as an authentication service +helm upgrade --install -n spire-server keycloak --values examples/tornjak/keycloak/values.yaml oci://registry-1.docker.io/bitnamicharts/keycloak --render-subchart-notes +``` + +* It's important to start the service before configuring Tornjak with auth. + +```shell +# Start an auth Service [Keycloak] (Terminal 3) +kubectl -n spire-server port-forward service/keycloak 8080:80 +``` +## Deploy SPIRE with Tornjak User Management Enabled + +Please follow the instructions for deploying Tornjak as specified in Tornjak Example [here](../README.md) +with addition of the User Management values `--values examples/tornjak/values-auth.yaml`. + +For example: + +```shell +# Install SPIRE CRDs +helm upgrade --install --create-namespace -n spire-mgmt spire-crds charts/spire-crds +``` + +```shell +# Standard SPIRE and Tornjak deployment with Authentication enabled +helm upgrade --install \ +--set global.spire.namespaces.system.create=true \ +--values tests/integration/psat/values.yaml \ +--values examples/tornjak/values.yaml \ +--values examples/tornjak/values-auth.yaml \ +--render-subchart-notes spire charts/spire +``` + +To test the deployment, you can run the SPIRE test: + +```shell +# Test the Tornjak deployment +helm test spire +``` + +## Access Tornjak + +To access Tornjak use port-forwarding or check the ingress option below. + +Run following commands from your shell, if you run with different values your namespace might differ. Consult the install notes printed when running above `helm upgrade` command in that case. + +Since `port-forward` is a blocking command, execute them in three different consoles (one for backend, one for frontend and one for auth that you already started in the previous step): + +```shell +# Start a backend Service (Terminal 1) +kubectl -n spire-server port-forward service/spire-tornjak-backend 10000:10000 +``` + +```shell +# Start a frontend Service (Terminal 2) +kubectl -n spire-server port-forward service/spire-tornjak-frontend 3000:3000 +``` + +* You can now access Tornjak at [localhost:3000](http://localhost:3000). + +* This will redirect to the auth service for authentication to [localhost:8080](http://localhost:8080) + +See [values.yaml](./values.yaml) for more details on the chart configurations to customize authentication config. + +## Deploy SPIRE with Tornjak User Management Enabled using Ingress + +When deployment uses Ingress, the access to Tornjak application and Keycloak will be different from above. +Please follow the deployment and configuration instructions as described [here](../README.md) +and make sure to add the `--values examples/tornjak/values-auth.yaml` parameter that is referencing Tornjak Authentication values. + +And update your `examples/production/example-your-values.yaml` most importantly, `trustDomain`, accordingly. + +E.g: + +```shell +helm upgrade --install \ +--set global.spire.namespaces.create=true \ +--set global.spire.ingressControllerType=ingress-nginx \ +--values tests/integration/psat/values.yaml \ +--values examples/tornjak/values.yaml \ +--values examples/tornjak/values-auth.yaml \ +--values examples/tornjak/values-ingress.yaml \ +--render-subchart-notes spire charts/spire +``` diff --git a/examples/tornjak/keycloak/values.yaml b/examples/tornjak/keycloak/values.yaml new file mode 100644 index 0000000..ccbba06 --- /dev/null +++ b/examples/tornjak/keycloak/values.yaml @@ -0,0 +1,128 @@ +auth: + ## @param keycloak.auth.realm Realm name in which to create users## @param auth.adminUser Keycloak administrator user + ## + adminUser: admin + ## @param auth.adminPassword Keycloak administrator password for the new user + ## + adminPassword: admin +proxy: edge # for https proxy reverse mode +keycloakConfigCli: + enabled: true + configuration: # tornjak realm configuration + tornjak.json: | + { + "realm": "tornjak", + "enabled": true, + "roles" : { + "realm" : [ { + "name" : "tornjak-viewer-realm-role" + }, { + "name" : "tornjak-admin-realm-role" + } ], + "client" : { + "tornjak" : [ { + "name" : "viewer", + "composite" : true, + "composites" : { + "realm" : [ "tornjak-viewer-realm-role" ] + }, + "clientRole" : true + }, { + "name" : "admin", + "composite" : true, + "composites" : { + "realm" : [ "tornjak-admin-realm-role" ] + }, + "clientRole" : true + } ] + } + }, + "groups" : [ { + "name" : "admin", + "path" : "/admin", + "realmRoles" : [ "tornjak-admin-realm-role" ] + }, { + "name" : "viewer", + "path" : "/viewer", + "realmRoles" : [ "tornjak-viewer-realm-role" ] + } ], + "users" : [ { + "username" : "admin", + "enabled" : true, + "firstName" : "Admin", + "lastName" : "User", + "credentials" : [ { + "type" : "password", + "userLabel" : "My password", + "secretData" : "{\"value\":\"Y1Kcmx/XxLWtnRLyMy/zn6wWbfu2fSKdaefrXM50cva3P+kA2BqBDvTZDswGP6JZ+IWrJaitm8RKV0L9LiwaFQ==\",\"salt\":\"Mh5g1EgTo26xhzoj67bovA==\",\"additionalParameters\":{}}", + "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}" + } ], + "groups" : [ "/admin" ] + }, { + "username" : "viewer", + "enabled" : true, + "firstName" : "Viewer", + "lastName" : "User", + "credentials" : [ { + "type" : "password", + "userLabel" : "My password", + "secretData" : "{\"value\":\"1ow3LfLDvpBRLfRbr2LtFRqje8NsKouHMw95Wwpsg5NP2Pga4ZBL7+T62bCDV6dOvy3U9xEEU4CRkhSWFaeDLg==\",\"salt\":\"qML2gBVSG7xYRZcaffW68A==\",\"additionalParameters\":{}}", + "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}" + } ], + "groups" : [ "/viewer" ] + } ], + "clients" : [ { + "clientId" : "tornjak", + "name" : "Tornjak", + "enabled" : true, + "alwaysDisplayInConsole" : true, + "clientAuthenticatorType" : "client-secret", + "redirectUris" : [ "http://localhost:3000/*" ], + "webOrigins" : [ "*" ], + "standardFlowEnabled" : true, + "implicitFlowEnabled" : false, + "directAccessGrantsEnabled" : false, + "serviceAccountsEnabled" : false, + "publicClient" : true, + "frontchannelLogout" : true, + "protocol" : "openid-connect", + "attributes" : { + "post.logout.redirect.uris" : "http://localhost:3000/*" + }, + "fullScopeAllowed" : true, + "defaultClientScopes": [ + "role_list", + "profile", + "email", + "roles", + "web-origins", + "acr", + "tornjak-backend", + ] + }], + "clientScopes": [{ + "name": "tornjak-backend", + "description": "tornjak backend audience check", + "protocol": "openid-connect", + "attributes": { + "include.in.token.scope": "false", + "display.on.consent.screen": "false", + "gui.order": "", + "consent.screen.text": "" + }, + "protocolMappers": [{ + "name": "tornjak-backend", + "protocol": "openid-connect", + "protocolMapper": "oidc-audience-mapper", + "consentRequired": false, + "config": { + "introspection.token.claim": "true", + "included.custom.audience": "tornjak-backend", + "userinfo.token.claim": "false", + "id.token.claim": "false", + "lightweight.claim": "false", + "access.token.claim": "true" + } + }] + }] + } \ No newline at end of file diff --git a/examples/tornjak/values-auth.yaml b/examples/tornjak/values-auth.yaml new file mode 100644 index 0000000..4f7e2d9 --- /dev/null +++ b/examples/tornjak/values-auth.yaml @@ -0,0 +1,12 @@ +spire-server: + tornjak: + config: + ## @extra tornjak.config.userManagement [object] UserManagement config + userManagement: + issuer: "http://keycloak:80/realms/tornjak" + audience: "tornjak-backend" + +tornjak-frontend: + auth: + enabled: true + serverURL: http://localhost:8080/ # enable auth by providing url diff --git a/examples/tornjak/values.yaml b/examples/tornjak/values.yaml index 6ba0015..688c2b0 100644 --- a/examples/tornjak/values.yaml +++ b/examples/tornjak/values.yaml @@ -4,6 +4,7 @@ spire-server: tornjak-frontend: enabled: true + apiServerURL: "http://localhost:10000" service: type: ClusterIP port: 3000