panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add auth option for Tornjak (#259)

Browse Source 
* Added auth option, specifically keycloak for tornjak production use

Signed-off-by: Mohammed Abdi <[email protected]>

* Added auth values for tornjak

Signed-off-by: Mohammed Abdi <[email protected]>

* Update charts/spire/charts/tornjak-frontend/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* nit

Signed-off-by: Mohammed Abdi <[email protected]>

* nit

Signed-off-by: Mohammed Abdi <[email protected]>

* nit

Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Mariusz Sabath <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* nit

Signed-off-by: Mohammed Abdi <[email protected]>

* install keycloak first

Signed-off-by: Mohammed Abdi <[email protected]>

* add logs volume back

Signed-off-by: Mohammed Abdi <[email protected]>

* Fixed NPM init error

Signed-off-by: Mariusz Sabath <[email protected]>

* Fixed the values documentation errors

Signed-off-by: Mariusz Sabath <[email protected]>

* Post-review suggestion fixes

Signed-off-by: Mariusz Sabath <[email protected]>

* Fixed typo

Signed-off-by: Mariusz Sabath <[email protected]>

* Updating Keyclaok examples README

Signed-off-by: Mariusz Sabath <[email protected]>

* Fixed the parameter reference

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix typo

Signed-off-by: Mariusz Sabath <[email protected]>

* use keycloak-config-cli to simplify tornjak realm import

Signed-off-by: MohammedAbdi <[email protected]>

* edit client id

Signed-off-by: MohammedAbdi <[email protected]>

* reverse client id

Signed-off-by: MohammedAbdi <[email protected]>

* fix the doc

Signed-off-by: Mariusz Sabath <[email protected]>

* update tornjak version and backend auth

Signed-off-by: MohammedAbdi <[email protected]>

* update client id

Signed-off-by: MohammedAbdi <[email protected]>

* updates values yaml

Signed-off-by: MohammedAbdi <[email protected]>

* update documentation

Signed-off-by: MohammedAbdi <[email protected]>

* nit

Signed-off-by: MohammedAbdi <[email protected]>

* update doc

Signed-off-by: MohammedAbdi <[email protected]>

* add audience check tornjak

Signed-off-by: MohammedAbdi <[email protected]>

* remove unused file

Signed-off-by: MohammedAbdi <[email protected]>

* update doc

Signed-off-by: MohammedAbdi <[email protected]>

* nit and add auth not enabled warning back

Signed-off-by: MohammedAbdi <[email protected]>

* adjust liveness probe until tornjak handles liveendpoint for auth and direct connection to discovery

Signed-off-by: MohammedAbdi <[email protected]>

* update doc and add keycloak proxy

Signed-off-by: MohammedAbdi <[email protected]>

---------

Signed-off-by: Mohammed Abdi <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: MohammedAbdi <[email protected]>
Co-authored-by: Mohammed Abdi <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
This commit is contained in:
Mohammed Abdi
2024-04-25 15:49:20 -07:00
committed by GitHub
co-authored by Faisal Memon Mariusz Sabath Mohammed Abdi
parent f679a0dab6
commit a2494ee45e
15 changed files with 360 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+4 -1
View File
@@ -340,7 +340,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | | `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` | | `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` |
| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.4.2` | | `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.6.0` |
| `tornjak.service.type` | Type of service resource | `ClusterIP` | | `tornjak.service.type` | Type of service resource | `ClusterIP` |
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | | `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | | `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
@@ -361,6 +361,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | | | `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` | | `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` | | `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
| `tornjak.config.userManagement` | UserManagement config | |
| `tornjak.config.userManagement.issuer` | UserManagement issuer URL | `""` |
| `tornjak.config.userManagement.audience` | UserManagement audience check | `""` |
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` | | `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | | `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | | `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
charts/spire/charts/spire-server/templates/NOTES.txt
+3 -1
View File
@@ -9,10 +9,12 @@ Installed {{ .Chart.Name }}…
Installed {{ include "spire-tornjak.fullname" . }}… Installed {{ include "spire-tornjak.fullname" . }}…
{{- if eq .Values.tornjak.config.userManagement.issuer "" }}
### WARNING ### ### WARNING ###
Tornjak runs without authentication and is therefore NOT suitable to run in production environments. Tornjak is configured to run without authentication and is therefore NOT suitable to run in production environments.
Only use in test environments! Only use in test environments!
{{- end }}
Access Tornjak: Access Tornjak:
kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.servicename" . }} {{ .Values.tornjak.service.ports.http }}:10000 kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.servicename" . }} {{ .Values.tornjak.service.ports.http }}:10000
charts/spire/charts/spire-server/templates/server-resource.yaml
+1 -1
View File
@@ -319,7 +319,7 @@ spec:
startupProbe: startupProbe:
httpGet: httpGet:
scheme: HTTP scheme: HTTP
path: /api/tornjak/serverinfo path: /
port: 10000 port: 10000
{{- toYaml .Values.tornjak.startupProbe | nindent 12 }} {{- toYaml .Values.tornjak.startupProbe | nindent 12 }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/tornjak-config.yaml
+8
View File
@@ -42,5 +42,13 @@ data:
} }
} }
{{- end }} {{- end }}
{{- if ne .Values.tornjak.config.userManagement.issuer "" }}
UserManagement "KeycloakAuth" {
plugin_data {
issuer = "{{ .Values.tornjak.config.userManagement.issuer }}"
audience = "{{ .Values.tornjak.config.userManagement.audience }}"
}
}
{{- end }}
} }
{{- end }} {{- end }}
charts/spire/charts/spire-server/values.yaml
+7 -1
View File
@@ -805,7 +805,7 @@ tornjak:
repository: spiffe/tornjak-backend repository: spiffe/tornjak-backend
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "" tag: ""
defaultTag: "v1.4.2" defaultTag: "v1.6.0"
service: service:
## @param tornjak.service.type Type of service resource ## @param tornjak.service.type Type of service resource
@@ -868,6 +868,12 @@ tornjak:
driver: "sqlite3" driver: "sqlite3"
## @param tornjak.config.dataStore.file File path for sqlite3 file ## @param tornjak.config.dataStore.file File path for sqlite3 file
file: "/run/spire/data/tornjak.sqlite3" file: "/run/spire/data/tornjak.sqlite3"
## @extra tornjak.config.userManagement [object] UserManagement config
userManagement:
## @param tornjak.config.userManagement.issuer UserManagement issuer URL
issuer: ""
## @param tornjak.config.userManagement.audience UserManagement audience check
audience: ""
# Tornjak supports 3 connection types: `http`, `tls`, and `mtls`. # Tornjak supports 3 connection types: `http`, `tls`, and `mtls`.
# The connections are determined based on provided configuration # The connections are determined based on provided configuration
charts/spire/charts/tornjak-frontend/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: tornjak-frontend
description: A Helm chart to deploy Tornjak frontend description: A Helm chart to deploy Tornjak frontend
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "v1.4.2" appVersion: "v1.6.0"
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
- https://github.com/spiffe/tornjak - https://github.com/spiffe/tornjak
charts/spire/charts/tornjak-frontend/README.md
+9 -6
View File
@@ -56,7 +56,7 @@ port forwarding. See the chart NOTES output for more details.
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` | | `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
@@ -74,12 +74,14 @@ port forwarding. See the chart NOTES output for more details.
| `service.type` | Service type | `ClusterIP` | | `service.type` | Service type | `ClusterIP` |
| `service.port` | Service port | `3000` | | `service.port` | Service port | `3000` |
| `service.annotations` | Annotations for service resource | `{}` | | `service.annotations` | Annotations for service resource | `{}` |
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | | `nodeSelector` | (Optional) Select specific nodes to run on. Tornjak currently supports amd64 and arm64 architectures | `{}` |
| `affinity` | Affinity rules | `{}` | | `affinity` | Affinity rules | `{}` |
| `tolerations` | List of tolerations | `[]` | | `tolerations` | List of tolerations | `[]` |
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | | `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. | `""` | | `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If not provided, auto-detection is attempted. | `""` |
| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | | `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` |
| `auth.enabled` | Enables auth for Tornjak | `false` |
| `auth.serverURL` | URL of the Auth service. Tornjak Frontend will redirect to this URL to authenticate the user | `""` |
| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | | `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` |
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | | `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | | `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
@@ -87,14 +89,15 @@ port forwarding. See the chart NOTES output for more details.
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | | `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | | `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
| `workingDir` | Set to override the default path containing the Tornjak frontend within the image | `""` | | `workingDir` | Set to override the default path containing the Tornjak frontend within the image | `""` |
| `logsDir` | Directory path for NPM logs | `/home/node/` |
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | | `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` | | `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | | `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` | | `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` |
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | | `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
charts/spire/charts/tornjak-frontend/templates/NOTES.txt
+5 -1
View File
@@ -10,11 +10,15 @@ Tornjak UI (Frontend)
pull policy: {{ .Values.image.pullPolicy }} pull policy: {{ .Values.image.pullPolicy }}
Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }} Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }}
SPIRE health check enabled: "{{ .Values.spireHealthCheck.enabled }}" SPIRE health check enabled: "{{ .Values.spireHealthCheck.enabled }}"
User Managemenet enabled: "{{ .Values.auth.enabled }}"
User Managemenet API: "{{ .Values.auth.serverURL }}"
{{- if not .Values.auth.enabled }}
### WARNING ### ### WARNING ###
Tornjak runs without authentication and is therefore NOT suitable to run in production environments. Tornjak is configured to run without authentication and is therefore NOT suitable to run in production environments.
Only use in test environments! Only use in test environments!
{{- end }}
Access Tornjak: Access Tornjak:
charts/spire/charts/tornjak-frontend/templates/deployment.yaml
+6 -2
View File
@@ -35,10 +35,14 @@ spec:
env: env:
- name: REACT_APP_API_SERVER_URI - name: REACT_APP_API_SERVER_URI
value: {{ include "tornjak-frontend.apiURL" . }} value: {{ include "tornjak-frontend.apiURL" . }}
{{- if eq (.Values.spireHealthCheck.enabled | toString) "true" }} {{- if .Values.spireHealthCheck.enabled }}
- name: REACT_APP_SPIRE_HEALTH_CHECK_ENABLE - name: REACT_APP_SPIRE_HEALTH_CHECK_ENABLE
value: "{{ .Values.spireHealthCheck.enabled }}" value: "{{ .Values.spireHealthCheck.enabled }}"
{{- end }} {{- end }}
{{- if .Values.auth.enabled }}
- name: REACT_APP_AUTH_SERVER_URI
value: "{{ .Values.auth.serverURL }}"
{{- end }}
{{- if .Values.startupProbe.enabled }} {{- if .Values.startupProbe.enabled }}
startupProbe: startupProbe:
httpGet: httpGet:
@@ -57,7 +61,7 @@ spec:
- name: env - name: env
mountPath: {{ include "tornjak-frontend.workingDir" . }}/build/tmp mountPath: {{ include "tornjak-frontend.workingDir" . }}/build/tmp
- name: logs - name: logs
mountPath: /opt/app-root/src/.npm/ mountPath: {{ .Values.logsDir }}
{{- with .Values.nodeSelector }} {{- with .Values.nodeSelector }}
nodeSelector: nodeSelector:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
charts/spire/charts/tornjak-frontend/values.yaml
+16 -8
View File
@@ -63,10 +63,8 @@ service:
port: 3000 port: 3000
annotations: {} annotations: {}
## @extra nodeSelector Select specific nodes to run on (currently only amd64 is supported by Tornjak) ## @param nodeSelector (Optional) Select specific nodes to run on. Tornjak currently supports amd64 and arm64 architectures
nodeSelector: nodeSelector: {}
## @skip nodeSelector.kubernetes.io/arch
kubernetes.io/arch: amd64
## @param affinity [object] Affinity rules ## @param affinity [object] Affinity rules
affinity: {} affinity: {}
@@ -86,7 +84,7 @@ topologySpreadConstraints: []
# cpu: 100m # cpu: 100m
# memory: 512Mi # memory: 512Mi
## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. ## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If not provided, auto-detection is attempted.
apiServerURL: "" apiServerURL: ""
# SPIRE Healthchecker indicator # SPIRE Healthchecker indicator
@@ -94,6 +92,13 @@ spireHealthCheck:
## @param spireHealthCheck.enabled Enables the SPIRE Healthchecker indicator ## @param spireHealthCheck.enabled Enables the SPIRE Healthchecker indicator
enabled: true enabled: true
# User Management
auth:
## @param auth.enabled Enables auth for Tornjak
enabled: false
## @param auth.serverURL URL of the Auth service. Tornjak Frontend will redirect to this URL to authenticate the user
serverURL: ""
## Configure extra options for Tornjak frontend container's startup probe ## Configure extra options for Tornjak frontend container's startup probe
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
## @param startupProbe.enabled Enable startupProbe on Tornjak frontend container ## @param startupProbe.enabled Enable startupProbe on Tornjak frontend container
@@ -114,9 +119,12 @@ startupProbe:
## @param workingDir Set to override the default path containing the Tornjak frontend within the image ## @param workingDir Set to override the default path containing the Tornjak frontend within the image
workingDir: "" workingDir: ""
## @param logsDir Directory path for NPM logs
logsDir: "/home/node/"
## @param ingress.enabled Flag to enable ingress for Tornjak frontend service ## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
## @param ingress.className Ingress class name for Tornjak frontend service ## @param ingress.className Ingress class name for Tornjak frontend service
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
## @param ingress.annotations [object] Annotations for Tornjak frontend service ## @param ingress.annotations [object] Annotations for Tornjak frontend service
ingress: ingress:
enabled: false enabled: false
@@ -130,14 +138,14 @@ ingress:
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
tlsSecret: "" tlsSecret: ""
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. ## @param ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
hosts: [] hosts: []
# - host: tornjak-frontend.example.org # - host: tornjak-frontend.example.org
# paths: # paths:
# - path: / # - path: /
# pathType: Prefix # pathType: Prefix
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
tls: [] tls: []
# - secretName: chart-example-tls # - secretName: chart-example-tls
# hosts: # hosts:
examples/tornjak/README.md
+2 -6
View File
@@ -1,8 +1,5 @@
# Recommended setup to deploy Tornjak # Recommended setup to deploy Tornjak
> [!Warning]
> The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
To install Spire with the least privileges possible we deploy spire across 2 namespaces. To install Spire with the least privileges possible we deploy spire across 2 namespaces.
```shell ```shell
@@ -13,7 +10,7 @@ kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restri
# deploy SPIRE with Tornjak enabled # deploy SPIRE with Tornjak enabled
helm upgrade --install --namespace spire-server spire charts/spire \ helm upgrade --install --namespace spire-server spire charts/spire \
--values examples/production/values.yaml \ --values tests/integration/psat/values.yaml \
--values examples/tornjak/values.yaml \ --values examples/tornjak/values.yaml \
--render-subchart-notes --render-subchart-notes
@@ -48,11 +45,10 @@ Update examples/production/example-your-values.yaml with your information, most
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire \ helm upgrade --install --namespace spire-server spire charts/spire \
--values examples/production/values.yaml \ --values tests/integration/psat/values.yaml \
--values examples/tornjak/values.yaml \ --values examples/tornjak/values.yaml \
--values examples/tornjak/values-ingress.yaml \ --values examples/tornjak/values-ingress.yaml \
--set global.spire.ingressControllerType=ingress-nginx \ --set global.spire.ingressControllerType=ingress-nginx \
--values examples/production/example-your-values.yaml \
--render-subchart-notes --debug --render-subchart-notes --debug
``` ```
examples/tornjak/keycloak/README.md
+114
View File
@@ -0,0 +1,114 @@
# Deploy Tornjak with Authentication Enabled
This example demonstrates Tornjak's capability to control access to the Frontend Application using
User Management via [Keycloak](https://www.keycloak.org/).
Tested on:
- Keycloak Application Version - 24.0.3
- Keycloak Chart Version - 21.0.3
For more information regarding Tornjak User Management, please refer to the following documentation:
* [Tornjak User Management](https://github.com/spiffe/tornjak/blob/main/docs/keycloak-configuration.md)
* [Keycloak Configuration for Tornjak](https://github.com/spiffe/tornjak/blob/main/docs/keycloak-configuration.md)
* [Detailed Blogs on Tornjak User Management](https://github.com/spiffe/tornjak/blob/main/docs/blogs.md)
**NOTE:** This example works only with the Vanilla version of Kubernetes; it does not yet support Openshift.
As part of the exercise, an instance of Keycloak is deployed to illustrate how to manage users' access to Tornjak.
Once enabled, the Tornjak UI will redirect all authentication calls to the Keycloak instance to obtain the
correct credentials. Authorization is based on these credentials and occurs at the Tornjak application level.
## Deploy Keycloak Instance (Authentication Service)
We will deploy the instance of Keycloak in the same namespace as the SPIRE Server
```shell
# Create a namespace to deploy Keycloak and SPIRE-server
kubectl create namespace spire-server
```
```shell
# Deploy Keycloak as an authentication service
helm upgrade --install -n spire-server keycloak --values examples/tornjak/keycloak/values.yaml oci://registry-1.docker.io/bitnamicharts/keycloak --render-subchart-notes
```
* It's important to start the service before configuring Tornjak with auth.
```shell
# Start an auth Service [Keycloak] (Terminal 3)
kubectl -n spire-server port-forward service/keycloak 8080:80
```
## Deploy SPIRE with Tornjak User Management Enabled
Please follow the instructions for deploying Tornjak as specified in Tornjak Example [here](../README.md)
with addition of the User Management values `--values examples/tornjak/values-auth.yaml`.
For example:
```shell
# Install SPIRE CRDs
helm upgrade --install --create-namespace -n spire-mgmt spire-crds charts/spire-crds
```
```shell
# Standard SPIRE and Tornjak deployment with Authentication enabled
helm upgrade --install \
--set global.spire.namespaces.system.create=true \
--values tests/integration/psat/values.yaml \
--values examples/tornjak/values.yaml \
--values examples/tornjak/values-auth.yaml \
--render-subchart-notes spire charts/spire
```
To test the deployment, you can run the SPIRE test:
```shell
# Test the Tornjak deployment
helm test spire
```
## Access Tornjak
To access Tornjak use port-forwarding or check the ingress option below.
Run following commands from your shell, if you run with different values your namespace might differ. Consult the install notes printed when running above `helm upgrade` command in that case.
Since `port-forward` is a blocking command, execute them in three different consoles (one for backend, one for frontend and one for auth that you already started in the previous step):
```shell
# Start a backend Service (Terminal 1)
kubectl -n spire-server port-forward service/spire-tornjak-backend 10000:10000
```
```shell
# Start a frontend Service (Terminal 2)
kubectl -n spire-server port-forward service/spire-tornjak-frontend 3000:3000
```
* You can now access Tornjak at [localhost:3000](http://localhost:3000).
* This will redirect to the auth service for authentication to [localhost:8080](http://localhost:8080)
See [values.yaml](./values.yaml) for more details on the chart configurations to customize authentication config.
## Deploy SPIRE with Tornjak User Management Enabled using Ingress
When deployment uses Ingress, the access to Tornjak application and Keycloak will be different from above.
Please follow the deployment and configuration instructions as described [here](../README.md)
and make sure to add the `--values examples/tornjak/values-auth.yaml` parameter that is referencing Tornjak Authentication values.
And update your `examples/production/example-your-values.yaml` most importantly, `trustDomain`, accordingly.
E.g:
```shell
helm upgrade --install \
--set global.spire.namespaces.create=true \
--set global.spire.ingressControllerType=ingress-nginx \
--values tests/integration/psat/values.yaml \
--values examples/tornjak/values.yaml \
--values examples/tornjak/values-auth.yaml \
--values examples/tornjak/values-ingress.yaml \
--render-subchart-notes spire charts/spire
```
examples/tornjak/keycloak/values.yaml
+128
View File
@@ -0,0 +1,128 @@
auth:
## @param keycloak.auth.realm Realm name in which to create users## @param auth.adminUser Keycloak administrator user
##
adminUser: admin
## @param auth.adminPassword Keycloak administrator password for the new user
##
adminPassword: admin
proxy: edge # for https proxy reverse mode
keycloakConfigCli:
enabled: true
configuration: # tornjak realm configuration
tornjak.json: |
{
"realm": "tornjak",
"enabled": true,
"roles" : {
"realm" : [ {
"name" : "tornjak-viewer-realm-role"
}, {
"name" : "tornjak-admin-realm-role"
} ],
"client" : {
"tornjak" : [ {
"name" : "viewer",
"composite" : true,
"composites" : {
"realm" : [ "tornjak-viewer-realm-role" ]
},
"clientRole" : true
}, {
"name" : "admin",
"composite" : true,
"composites" : {
"realm" : [ "tornjak-admin-realm-role" ]
},
"clientRole" : true
} ]
}
},
"groups" : [ {
"name" : "admin",
"path" : "/admin",
"realmRoles" : [ "tornjak-admin-realm-role" ]
}, {
"name" : "viewer",
"path" : "/viewer",
"realmRoles" : [ "tornjak-viewer-realm-role" ]
} ],
"users" : [ {
"username" : "admin",
"enabled" : true,
"firstName" : "Admin",
"lastName" : "User",
"credentials" : [ {
"type" : "password",
"userLabel" : "My password",
"secretData" : "{\"value\":\"Y1Kcmx/XxLWtnRLyMy/zn6wWbfu2fSKdaefrXM50cva3P+kA2BqBDvTZDswGP6JZ+IWrJaitm8RKV0L9LiwaFQ==\",\"salt\":\"Mh5g1EgTo26xhzoj67bovA==\",\"additionalParameters\":{}}",
"credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}"
} ],
"groups" : [ "/admin" ]
}, {
"username" : "viewer",
"enabled" : true,
"firstName" : "Viewer",
"lastName" : "User",
"credentials" : [ {
"type" : "password",
"userLabel" : "My password",
"secretData" : "{\"value\":\"1ow3LfLDvpBRLfRbr2LtFRqje8NsKouHMw95Wwpsg5NP2Pga4ZBL7+T62bCDV6dOvy3U9xEEU4CRkhSWFaeDLg==\",\"salt\":\"qML2gBVSG7xYRZcaffW68A==\",\"additionalParameters\":{}}",
"credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}"
} ],
"groups" : [ "/viewer" ]
} ],
"clients" : [ {
"clientId" : "tornjak",
"name" : "Tornjak",
"enabled" : true,
"alwaysDisplayInConsole" : true,
"clientAuthenticatorType" : "client-secret",
"redirectUris" : [ "http://localhost:3000/*" ],
"webOrigins" : [ "*" ],
"standardFlowEnabled" : true,
"implicitFlowEnabled" : false,
"directAccessGrantsEnabled" : false,
"serviceAccountsEnabled" : false,
"publicClient" : true,
"frontchannelLogout" : true,
"protocol" : "openid-connect",
"attributes" : {
"post.logout.redirect.uris" : "http://localhost:3000/*"
},
"fullScopeAllowed" : true,
"defaultClientScopes": [
"role_list",
"profile",
"email",
"roles",
"web-origins",
"acr",
"tornjak-backend",
]
}],
"clientScopes": [{
"name": "tornjak-backend",
"description": "tornjak backend audience check",
"protocol": "openid-connect",
"attributes": {
"include.in.token.scope": "false",
"display.on.consent.screen": "false",
"gui.order": "",
"consent.screen.text": ""
},
"protocolMappers": [{
"name": "tornjak-backend",
"protocol": "openid-connect",
"protocolMapper": "oidc-audience-mapper",
"consentRequired": false,
"config": {
"introspection.token.claim": "true",
"included.custom.audience": "tornjak-backend",
"userinfo.token.claim": "false",
"id.token.claim": "false",
"lightweight.claim": "false",
"access.token.claim": "true"
}
}]
}]
}
examples/tornjak/values-auth.yaml
+12
View File
@@ -0,0 +1,12 @@
spire-server:
tornjak:
config:
## @extra tornjak.config.userManagement [object] UserManagement config
userManagement:
issuer: "http://keycloak:80/realms/tornjak"
audience: "tornjak-backend"
tornjak-frontend:
auth:
enabled: true
serverURL: http://localhost:8080/ # enable auth by providing url
examples/tornjak/values.yaml
+1
View File
@@ -4,6 +4,7 @@ spire-server:
tornjak-frontend: tornjak-frontend:
enabled: true enabled: true
apiServerURL: "http://localhost:10000"
service: service:
type: ClusterIP type: ClusterIP
port: 3000 port: 3000