Add auth option for Tornjak (#259)
* Added auth option, specifically keycloak for tornjak production use Signed-off-by: Mohammed Abdi <[email protected]> * Added auth values for tornjak Signed-off-by: Mohammed Abdi <[email protected]> * Update charts/spire/charts/tornjak-frontend/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Mariusz Sabath <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * install keycloak first Signed-off-by: Mohammed Abdi <[email protected]> * add logs volume back Signed-off-by: Mohammed Abdi <[email protected]> * Fixed NPM init error Signed-off-by: Mariusz Sabath <[email protected]> * Fixed the values documentation errors Signed-off-by: Mariusz Sabath <[email protected]> * Post-review suggestion fixes Signed-off-by: Mariusz Sabath <[email protected]> * Fixed typo Signed-off-by: Mariusz Sabath <[email protected]> * Updating Keyclaok examples README Signed-off-by: Mariusz Sabath <[email protected]> * Fixed the parameter reference Signed-off-by: Mariusz Sabath <[email protected]> * Fix typo Signed-off-by: Mariusz Sabath <[email protected]> * use keycloak-config-cli to simplify tornjak realm import Signed-off-by: MohammedAbdi <[email protected]> * edit client id Signed-off-by: MohammedAbdi <[email protected]> * reverse client id Signed-off-by: MohammedAbdi <[email protected]> * fix the doc Signed-off-by: Mariusz Sabath <[email protected]> * update tornjak version and backend auth Signed-off-by: MohammedAbdi <[email protected]> * update client id Signed-off-by: MohammedAbdi <[email protected]> * updates values yaml Signed-off-by: MohammedAbdi <[email protected]> * update documentation Signed-off-by: MohammedAbdi <[email protected]> * nit Signed-off-by: MohammedAbdi <[email protected]> * update doc Signed-off-by: MohammedAbdi <[email protected]> * add audience check tornjak Signed-off-by: MohammedAbdi <[email protected]> * remove unused file Signed-off-by: MohammedAbdi <[email protected]> * update doc Signed-off-by: MohammedAbdi <[email protected]> * nit and add auth not enabled warning back Signed-off-by: MohammedAbdi <[email protected]> * adjust liveness probe until tornjak handles liveendpoint for auth and direct connection to discovery Signed-off-by: MohammedAbdi <[email protected]> * update doc and add keycloak proxy Signed-off-by: MohammedAbdi <[email protected]> --------- Signed-off-by: Mohammed Abdi <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> Signed-off-by: MohammedAbdi <[email protected]> Co-authored-by: Mohammed Abdi <[email protected]> Co-authored-by: Faisal Memon <[email protected]> Co-authored-by: Mariusz Sabath <[email protected]>
This commit is contained in:
Mohammed Abdi
co-authored by
Faisal Memon
Mariusz Sabath
Mohammed Abdi
Faisal Memon
Mariusz Sabath
Mohammed Abdi
parent
f679a0dab6
commit
a2494ee45e
@@ -340,7 +340,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||||
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` |
|
| `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` |
|
||||||
| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.4.2` |
|
| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.6.0` |
|
||||||
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
||||||
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
||||||
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
||||||
@@ -361,6 +361,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
|
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
|
||||||
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
|
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
|
||||||
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
|
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
|
||||||
|
| `tornjak.config.userManagement` | UserManagement config | |
|
||||||
|
| `tornjak.config.userManagement.issuer` | UserManagement issuer URL | `""` |
|
||||||
|
| `tornjak.config.userManagement.audience` | UserManagement audience check | `""` |
|
||||||
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
|
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
|
||||||
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
||||||
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||||
|
|||||||
@@ -9,10 +9,12 @@ Installed {{ .Chart.Name }}…
|
|||||||
|
|
||||||
Installed {{ include "spire-tornjak.fullname" . }}…
|
Installed {{ include "spire-tornjak.fullname" . }}…
|
||||||
|
|
||||||
### WARNING ###
|
{{- if eq .Values.tornjak.config.userManagement.issuer "" }}
|
||||||
|
### WARNING ###
|
||||||
|
|
||||||
Tornjak runs without authentication and is therefore NOT suitable to run in production environments.
|
Tornjak is configured to run without authentication and is therefore NOT suitable to run in production environments.
|
||||||
Only use in test environments!
|
Only use in test environments!
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
Access Tornjak:
|
Access Tornjak:
|
||||||
kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.servicename" . }} {{ .Values.tornjak.service.ports.http }}:10000
|
kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.servicename" . }} {{ .Values.tornjak.service.ports.http }}:10000
|
||||||
|
|||||||
@@ -319,7 +319,7 @@ spec:
|
|||||||
startupProbe:
|
startupProbe:
|
||||||
httpGet:
|
httpGet:
|
||||||
scheme: HTTP
|
scheme: HTTP
|
||||||
path: /api/tornjak/serverinfo
|
path: /
|
||||||
port: 10000
|
port: 10000
|
||||||
{{- toYaml .Values.tornjak.startupProbe | nindent 12 }}
|
{{- toYaml .Values.tornjak.startupProbe | nindent 12 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -42,5 +42,13 @@ data:
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if ne .Values.tornjak.config.userManagement.issuer "" }}
|
||||||
|
UserManagement "KeycloakAuth" {
|
||||||
|
plugin_data {
|
||||||
|
issuer = "{{ .Values.tornjak.config.userManagement.issuer }}"
|
||||||
|
audience = "{{ .Values.tornjak.config.userManagement.audience }}"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
{{- end }}
|
||||||
}
|
}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -805,7 +805,7 @@ tornjak:
|
|||||||
repository: spiffe/tornjak-backend
|
repository: spiffe/tornjak-backend
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
tag: ""
|
tag: ""
|
||||||
defaultTag: "v1.4.2"
|
defaultTag: "v1.6.0"
|
||||||
|
|
||||||
service:
|
service:
|
||||||
## @param tornjak.service.type Type of service resource
|
## @param tornjak.service.type Type of service resource
|
||||||
@@ -868,6 +868,12 @@ tornjak:
|
|||||||
driver: "sqlite3"
|
driver: "sqlite3"
|
||||||
## @param tornjak.config.dataStore.file File path for sqlite3 file
|
## @param tornjak.config.dataStore.file File path for sqlite3 file
|
||||||
file: "/run/spire/data/tornjak.sqlite3"
|
file: "/run/spire/data/tornjak.sqlite3"
|
||||||
|
## @extra tornjak.config.userManagement [object] UserManagement config
|
||||||
|
userManagement:
|
||||||
|
## @param tornjak.config.userManagement.issuer UserManagement issuer URL
|
||||||
|
issuer: ""
|
||||||
|
## @param tornjak.config.userManagement.audience UserManagement audience check
|
||||||
|
audience: ""
|
||||||
|
|
||||||
# Tornjak supports 3 connection types: `http`, `tls`, and `mtls`.
|
# Tornjak supports 3 connection types: `http`, `tls`, and `mtls`.
|
||||||
# The connections are determined based on provided configuration
|
# The connections are determined based on provided configuration
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: tornjak-frontend
|
|||||||
description: A Helm chart to deploy Tornjak frontend
|
description: A Helm chart to deploy Tornjak frontend
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "v1.4.2"
|
appVersion: "v1.6.0"
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
- https://github.com/spiffe/tornjak
|
- https://github.com/spiffe/tornjak
|
||||||
|
|||||||
@@ -56,7 +56,7 @@ port forwarding. See the chart NOTES output for more details.
|
|||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` |
|
| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
@@ -74,12 +74,14 @@ port forwarding. See the chart NOTES output for more details.
|
|||||||
| `service.type` | Service type | `ClusterIP` |
|
| `service.type` | Service type | `ClusterIP` |
|
||||||
| `service.port` | Service port | `3000` |
|
| `service.port` | Service port | `3000` |
|
||||||
| `service.annotations` | Annotations for service resource | `{}` |
|
| `service.annotations` | Annotations for service resource | `{}` |
|
||||||
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | |
|
| `nodeSelector` | (Optional) Select specific nodes to run on. Tornjak currently supports amd64 and arm64 architectures | `{}` |
|
||||||
| `affinity` | Affinity rules | `{}` |
|
| `affinity` | Affinity rules | `{}` |
|
||||||
| `tolerations` | List of tolerations | `[]` |
|
| `tolerations` | List of tolerations | `[]` |
|
||||||
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
|
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
|
||||||
| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. | `""` |
|
| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If not provided, auto-detection is attempted. | `""` |
|
||||||
| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` |
|
| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` |
|
||||||
|
| `auth.enabled` | Enables auth for Tornjak | `false` |
|
||||||
|
| `auth.serverURL` | URL of the Auth service. Tornjak Frontend will redirect to this URL to authenticate the user | `""` |
|
||||||
| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` |
|
| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` |
|
||||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
||||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||||
@@ -87,14 +89,15 @@ port forwarding. See the chart NOTES output for more details.
|
|||||||
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
||||||
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
||||||
| `workingDir` | Set to override the default path containing the Tornjak frontend within the image | `""` |
|
| `workingDir` | Set to override the default path containing the Tornjak frontend within the image | `""` |
|
||||||
|
| `logsDir` | Directory path for NPM logs | `/home/node/` |
|
||||||
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
|
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
|
||||||
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
|
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
|
||||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
|
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
|
||||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` |
|
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` |
|
||||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
|||||||
@@ -10,11 +10,15 @@ Tornjak UI (Frontend)
|
|||||||
pull policy: {{ .Values.image.pullPolicy }}
|
pull policy: {{ .Values.image.pullPolicy }}
|
||||||
Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }}
|
Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }}
|
||||||
SPIRE health check enabled: "{{ .Values.spireHealthCheck.enabled }}"
|
SPIRE health check enabled: "{{ .Values.spireHealthCheck.enabled }}"
|
||||||
|
User Managemenet enabled: "{{ .Values.auth.enabled }}"
|
||||||
|
User Managemenet API: "{{ .Values.auth.serverURL }}"
|
||||||
|
|
||||||
### WARNING ###
|
{{- if not .Values.auth.enabled }}
|
||||||
|
### WARNING ###
|
||||||
|
|
||||||
Tornjak runs without authentication and is therefore NOT suitable to run in production environments.
|
Tornjak is configured to run without authentication and is therefore NOT suitable to run in production environments.
|
||||||
Only use in test environments!
|
Only use in test environments!
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
Access Tornjak:
|
Access Tornjak:
|
||||||
|
|
||||||
|
|||||||
@@ -35,10 +35,14 @@ spec:
|
|||||||
env:
|
env:
|
||||||
- name: REACT_APP_API_SERVER_URI
|
- name: REACT_APP_API_SERVER_URI
|
||||||
value: {{ include "tornjak-frontend.apiURL" . }}
|
value: {{ include "tornjak-frontend.apiURL" . }}
|
||||||
{{- if eq (.Values.spireHealthCheck.enabled | toString) "true" }}
|
{{- if .Values.spireHealthCheck.enabled }}
|
||||||
- name: REACT_APP_SPIRE_HEALTH_CHECK_ENABLE
|
- name: REACT_APP_SPIRE_HEALTH_CHECK_ENABLE
|
||||||
value: "{{ .Values.spireHealthCheck.enabled }}"
|
value: "{{ .Values.spireHealthCheck.enabled }}"
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
- name: REACT_APP_AUTH_SERVER_URI
|
||||||
|
value: "{{ .Values.auth.serverURL }}"
|
||||||
|
{{- end }}
|
||||||
{{- if .Values.startupProbe.enabled }}
|
{{- if .Values.startupProbe.enabled }}
|
||||||
startupProbe:
|
startupProbe:
|
||||||
httpGet:
|
httpGet:
|
||||||
@@ -57,7 +61,7 @@ spec:
|
|||||||
- name: env
|
- name: env
|
||||||
mountPath: {{ include "tornjak-frontend.workingDir" . }}/build/tmp
|
mountPath: {{ include "tornjak-frontend.workingDir" . }}/build/tmp
|
||||||
- name: logs
|
- name: logs
|
||||||
mountPath: /opt/app-root/src/.npm/
|
mountPath: {{ .Values.logsDir }}
|
||||||
{{- with .Values.nodeSelector }}
|
{{- with .Values.nodeSelector }}
|
||||||
nodeSelector:
|
nodeSelector:
|
||||||
{{- toYaml . | nindent 8 }}
|
{{- toYaml . | nindent 8 }}
|
||||||
|
|||||||
@@ -63,10 +63,8 @@ service:
|
|||||||
port: 3000
|
port: 3000
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
## @extra nodeSelector Select specific nodes to run on (currently only amd64 is supported by Tornjak)
|
## @param nodeSelector (Optional) Select specific nodes to run on. Tornjak currently supports amd64 and arm64 architectures
|
||||||
nodeSelector:
|
nodeSelector: {}
|
||||||
## @skip nodeSelector.kubernetes.io/arch
|
|
||||||
kubernetes.io/arch: amd64
|
|
||||||
|
|
||||||
## @param affinity [object] Affinity rules
|
## @param affinity [object] Affinity rules
|
||||||
affinity: {}
|
affinity: {}
|
||||||
@@ -86,7 +84,7 @@ topologySpreadConstraints: []
|
|||||||
# cpu: 100m
|
# cpu: 100m
|
||||||
# memory: 512Mi
|
# memory: 512Mi
|
||||||
|
|
||||||
## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted.
|
## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If not provided, auto-detection is attempted.
|
||||||
apiServerURL: ""
|
apiServerURL: ""
|
||||||
|
|
||||||
# SPIRE Healthchecker indicator
|
# SPIRE Healthchecker indicator
|
||||||
@@ -94,6 +92,13 @@ spireHealthCheck:
|
|||||||
## @param spireHealthCheck.enabled Enables the SPIRE Healthchecker indicator
|
## @param spireHealthCheck.enabled Enables the SPIRE Healthchecker indicator
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
||||||
|
# User Management
|
||||||
|
auth:
|
||||||
|
## @param auth.enabled Enables auth for Tornjak
|
||||||
|
enabled: false
|
||||||
|
## @param auth.serverURL URL of the Auth service. Tornjak Frontend will redirect to this URL to authenticate the user
|
||||||
|
serverURL: ""
|
||||||
|
|
||||||
## Configure extra options for Tornjak frontend container's startup probe
|
## Configure extra options for Tornjak frontend container's startup probe
|
||||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
|
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
|
||||||
## @param startupProbe.enabled Enable startupProbe on Tornjak frontend container
|
## @param startupProbe.enabled Enable startupProbe on Tornjak frontend container
|
||||||
@@ -114,9 +119,12 @@ startupProbe:
|
|||||||
## @param workingDir Set to override the default path containing the Tornjak frontend within the image
|
## @param workingDir Set to override the default path containing the Tornjak frontend within the image
|
||||||
workingDir: ""
|
workingDir: ""
|
||||||
|
|
||||||
|
## @param logsDir Directory path for NPM logs
|
||||||
|
logsDir: "/home/node/"
|
||||||
|
|
||||||
## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
|
## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
|
||||||
## @param ingress.className Ingress class name for Tornjak frontend service
|
## @param ingress.className Ingress class name for Tornjak frontend service
|
||||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||||
## @param ingress.annotations [object] Annotations for Tornjak frontend service
|
## @param ingress.annotations [object] Annotations for Tornjak frontend service
|
||||||
ingress:
|
ingress:
|
||||||
enabled: false
|
enabled: false
|
||||||
@@ -130,14 +138,14 @@ ingress:
|
|||||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
tlsSecret: ""
|
tlsSecret: ""
|
||||||
|
|
||||||
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
## @param ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
||||||
hosts: []
|
hosts: []
|
||||||
# - host: tornjak-frontend.example.org
|
# - host: tornjak-frontend.example.org
|
||||||
# paths:
|
# paths:
|
||||||
# - path: /
|
# - path: /
|
||||||
# pathType: Prefix
|
# pathType: Prefix
|
||||||
|
|
||||||
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
||||||
tls: []
|
tls: []
|
||||||
# - secretName: chart-example-tls
|
# - secretName: chart-example-tls
|
||||||
# hosts:
|
# hosts:
|
||||||
|
|||||||
@@ -1,8 +1,5 @@
|
|||||||
# Recommended setup to deploy Tornjak
|
# Recommended setup to deploy Tornjak
|
||||||
|
|
||||||
> [!Warning]
|
|
||||||
> The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
|
|
||||||
|
|
||||||
To install Spire with the least privileges possible we deploy spire across 2 namespaces.
|
To install Spire with the least privileges possible we deploy spire across 2 namespaces.
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
@@ -13,7 +10,7 @@ kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restri
|
|||||||
|
|
||||||
# deploy SPIRE with Tornjak enabled
|
# deploy SPIRE with Tornjak enabled
|
||||||
helm upgrade --install --namespace spire-server spire charts/spire \
|
helm upgrade --install --namespace spire-server spire charts/spire \
|
||||||
--values examples/production/values.yaml \
|
--values tests/integration/psat/values.yaml \
|
||||||
--values examples/tornjak/values.yaml \
|
--values examples/tornjak/values.yaml \
|
||||||
--render-subchart-notes
|
--render-subchart-notes
|
||||||
|
|
||||||
@@ -48,11 +45,10 @@ Update examples/production/example-your-values.yaml with your information, most
|
|||||||
|
|
||||||
```shell
|
```shell
|
||||||
helm upgrade --install --namespace spire-server spire charts/spire \
|
helm upgrade --install --namespace spire-server spire charts/spire \
|
||||||
--values examples/production/values.yaml \
|
--values tests/integration/psat/values.yaml \
|
||||||
--values examples/tornjak/values.yaml \
|
--values examples/tornjak/values.yaml \
|
||||||
--values examples/tornjak/values-ingress.yaml \
|
--values examples/tornjak/values-ingress.yaml \
|
||||||
--set global.spire.ingressControllerType=ingress-nginx \
|
--set global.spire.ingressControllerType=ingress-nginx \
|
||||||
--values examples/production/example-your-values.yaml \
|
|
||||||
--render-subchart-notes --debug
|
--render-subchart-notes --debug
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|||||||
@@ -0,0 +1,114 @@
|
|||||||
|
# Deploy Tornjak with Authentication Enabled
|
||||||
|
|
||||||
|
This example demonstrates Tornjak's capability to control access to the Frontend Application using
|
||||||
|
User Management via [Keycloak](https://www.keycloak.org/).
|
||||||
|
|
||||||
|
Tested on:
|
||||||
|
- Keycloak Application Version - 24.0.3
|
||||||
|
- Keycloak Chart Version - 21.0.3
|
||||||
|
|
||||||
|
For more information regarding Tornjak User Management, please refer to the following documentation:
|
||||||
|
|
||||||
|
* [Tornjak User Management](https://github.com/spiffe/tornjak/blob/main/docs/keycloak-configuration.md)
|
||||||
|
* [Keycloak Configuration for Tornjak](https://github.com/spiffe/tornjak/blob/main/docs/keycloak-configuration.md)
|
||||||
|
* [Detailed Blogs on Tornjak User Management](https://github.com/spiffe/tornjak/blob/main/docs/blogs.md)
|
||||||
|
|
||||||
|
**NOTE:** This example works only with the Vanilla version of Kubernetes; it does not yet support Openshift.
|
||||||
|
|
||||||
|
As part of the exercise, an instance of Keycloak is deployed to illustrate how to manage users' access to Tornjak.
|
||||||
|
Once enabled, the Tornjak UI will redirect all authentication calls to the Keycloak instance to obtain the
|
||||||
|
correct credentials. Authorization is based on these credentials and occurs at the Tornjak application level.
|
||||||
|
|
||||||
|
## Deploy Keycloak Instance (Authentication Service)
|
||||||
|
|
||||||
|
We will deploy the instance of Keycloak in the same namespace as the SPIRE Server
|
||||||
|
|
||||||
|
```shell
|
||||||
|
# Create a namespace to deploy Keycloak and SPIRE-server
|
||||||
|
kubectl create namespace spire-server
|
||||||
|
```
|
||||||
|
|
||||||
|
```shell
|
||||||
|
# Deploy Keycloak as an authentication service
|
||||||
|
helm upgrade --install -n spire-server keycloak --values examples/tornjak/keycloak/values.yaml oci://registry-1.docker.io/bitnamicharts/keycloak --render-subchart-notes
|
||||||
|
```
|
||||||
|
|
||||||
|
* It's important to start the service before configuring Tornjak with auth.
|
||||||
|
|
||||||
|
```shell
|
||||||
|
# Start an auth Service [Keycloak] (Terminal 3)
|
||||||
|
kubectl -n spire-server port-forward service/keycloak 8080:80
|
||||||
|
```
|
||||||
|
## Deploy SPIRE with Tornjak User Management Enabled
|
||||||
|
|
||||||
|
Please follow the instructions for deploying Tornjak as specified in Tornjak Example [here](../README.md)
|
||||||
|
with addition of the User Management values `--values examples/tornjak/values-auth.yaml`.
|
||||||
|
|
||||||
|
For example:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
# Install SPIRE CRDs
|
||||||
|
helm upgrade --install --create-namespace -n spire-mgmt spire-crds charts/spire-crds
|
||||||
|
```
|
||||||
|
|
||||||
|
```shell
|
||||||
|
# Standard SPIRE and Tornjak deployment with Authentication enabled
|
||||||
|
helm upgrade --install \
|
||||||
|
--set global.spire.namespaces.system.create=true \
|
||||||
|
--values tests/integration/psat/values.yaml \
|
||||||
|
--values examples/tornjak/values.yaml \
|
||||||
|
--values examples/tornjak/values-auth.yaml \
|
||||||
|
--render-subchart-notes spire charts/spire
|
||||||
|
```
|
||||||
|
|
||||||
|
To test the deployment, you can run the SPIRE test:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
# Test the Tornjak deployment
|
||||||
|
helm test spire
|
||||||
|
```
|
||||||
|
|
||||||
|
## Access Tornjak
|
||||||
|
|
||||||
|
To access Tornjak use port-forwarding or check the ingress option below.
|
||||||
|
|
||||||
|
Run following commands from your shell, if you run with different values your namespace might differ. Consult the install notes printed when running above `helm upgrade` command in that case.
|
||||||
|
|
||||||
|
Since `port-forward` is a blocking command, execute them in three different consoles (one for backend, one for frontend and one for auth that you already started in the previous step):
|
||||||
|
|
||||||
|
```shell
|
||||||
|
# Start a backend Service (Terminal 1)
|
||||||
|
kubectl -n spire-server port-forward service/spire-tornjak-backend 10000:10000
|
||||||
|
```
|
||||||
|
|
||||||
|
```shell
|
||||||
|
# Start a frontend Service (Terminal 2)
|
||||||
|
kubectl -n spire-server port-forward service/spire-tornjak-frontend 3000:3000
|
||||||
|
```
|
||||||
|
|
||||||
|
* You can now access Tornjak at [localhost:3000](http://localhost:3000).
|
||||||
|
|
||||||
|
* This will redirect to the auth service for authentication to [localhost:8080](http://localhost:8080)
|
||||||
|
|
||||||
|
See [values.yaml](./values.yaml) for more details on the chart configurations to customize authentication config.
|
||||||
|
|
||||||
|
## Deploy SPIRE with Tornjak User Management Enabled using Ingress
|
||||||
|
|
||||||
|
When deployment uses Ingress, the access to Tornjak application and Keycloak will be different from above.
|
||||||
|
Please follow the deployment and configuration instructions as described [here](../README.md)
|
||||||
|
and make sure to add the `--values examples/tornjak/values-auth.yaml` parameter that is referencing Tornjak Authentication values.
|
||||||
|
|
||||||
|
And update your `examples/production/example-your-values.yaml` most importantly, `trustDomain`, accordingly.
|
||||||
|
|
||||||
|
E.g:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
helm upgrade --install \
|
||||||
|
--set global.spire.namespaces.create=true \
|
||||||
|
--set global.spire.ingressControllerType=ingress-nginx \
|
||||||
|
--values tests/integration/psat/values.yaml \
|
||||||
|
--values examples/tornjak/values.yaml \
|
||||||
|
--values examples/tornjak/values-auth.yaml \
|
||||||
|
--values examples/tornjak/values-ingress.yaml \
|
||||||
|
--render-subchart-notes spire charts/spire
|
||||||
|
```
|
||||||
@@ -0,0 +1,128 @@
|
|||||||
|
auth:
|
||||||
|
## @param keycloak.auth.realm Realm name in which to create users## @param auth.adminUser Keycloak administrator user
|
||||||
|
##
|
||||||
|
adminUser: admin
|
||||||
|
## @param auth.adminPassword Keycloak administrator password for the new user
|
||||||
|
##
|
||||||
|
adminPassword: admin
|
||||||
|
proxy: edge # for https proxy reverse mode
|
||||||
|
keycloakConfigCli:
|
||||||
|
enabled: true
|
||||||
|
configuration: # tornjak realm configuration
|
||||||
|
tornjak.json: |
|
||||||
|
{
|
||||||
|
"realm": "tornjak",
|
||||||
|
"enabled": true,
|
||||||
|
"roles" : {
|
||||||
|
"realm" : [ {
|
||||||
|
"name" : "tornjak-viewer-realm-role"
|
||||||
|
}, {
|
||||||
|
"name" : "tornjak-admin-realm-role"
|
||||||
|
} ],
|
||||||
|
"client" : {
|
||||||
|
"tornjak" : [ {
|
||||||
|
"name" : "viewer",
|
||||||
|
"composite" : true,
|
||||||
|
"composites" : {
|
||||||
|
"realm" : [ "tornjak-viewer-realm-role" ]
|
||||||
|
},
|
||||||
|
"clientRole" : true
|
||||||
|
}, {
|
||||||
|
"name" : "admin",
|
||||||
|
"composite" : true,
|
||||||
|
"composites" : {
|
||||||
|
"realm" : [ "tornjak-admin-realm-role" ]
|
||||||
|
},
|
||||||
|
"clientRole" : true
|
||||||
|
} ]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"groups" : [ {
|
||||||
|
"name" : "admin",
|
||||||
|
"path" : "/admin",
|
||||||
|
"realmRoles" : [ "tornjak-admin-realm-role" ]
|
||||||
|
}, {
|
||||||
|
"name" : "viewer",
|
||||||
|
"path" : "/viewer",
|
||||||
|
"realmRoles" : [ "tornjak-viewer-realm-role" ]
|
||||||
|
} ],
|
||||||
|
"users" : [ {
|
||||||
|
"username" : "admin",
|
||||||
|
"enabled" : true,
|
||||||
|
"firstName" : "Admin",
|
||||||
|
"lastName" : "User",
|
||||||
|
"credentials" : [ {
|
||||||
|
"type" : "password",
|
||||||
|
"userLabel" : "My password",
|
||||||
|
"secretData" : "{\"value\":\"Y1Kcmx/XxLWtnRLyMy/zn6wWbfu2fSKdaefrXM50cva3P+kA2BqBDvTZDswGP6JZ+IWrJaitm8RKV0L9LiwaFQ==\",\"salt\":\"Mh5g1EgTo26xhzoj67bovA==\",\"additionalParameters\":{}}",
|
||||||
|
"credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}"
|
||||||
|
} ],
|
||||||
|
"groups" : [ "/admin" ]
|
||||||
|
}, {
|
||||||
|
"username" : "viewer",
|
||||||
|
"enabled" : true,
|
||||||
|
"firstName" : "Viewer",
|
||||||
|
"lastName" : "User",
|
||||||
|
"credentials" : [ {
|
||||||
|
"type" : "password",
|
||||||
|
"userLabel" : "My password",
|
||||||
|
"secretData" : "{\"value\":\"1ow3LfLDvpBRLfRbr2LtFRqje8NsKouHMw95Wwpsg5NP2Pga4ZBL7+T62bCDV6dOvy3U9xEEU4CRkhSWFaeDLg==\",\"salt\":\"qML2gBVSG7xYRZcaffW68A==\",\"additionalParameters\":{}}",
|
||||||
|
"credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}"
|
||||||
|
} ],
|
||||||
|
"groups" : [ "/viewer" ]
|
||||||
|
} ],
|
||||||
|
"clients" : [ {
|
||||||
|
"clientId" : "tornjak",
|
||||||
|
"name" : "Tornjak",
|
||||||
|
"enabled" : true,
|
||||||
|
"alwaysDisplayInConsole" : true,
|
||||||
|
"clientAuthenticatorType" : "client-secret",
|
||||||
|
"redirectUris" : [ "http://localhost:3000/*" ],
|
||||||
|
"webOrigins" : [ "*" ],
|
||||||
|
"standardFlowEnabled" : true,
|
||||||
|
"implicitFlowEnabled" : false,
|
||||||
|
"directAccessGrantsEnabled" : false,
|
||||||
|
"serviceAccountsEnabled" : false,
|
||||||
|
"publicClient" : true,
|
||||||
|
"frontchannelLogout" : true,
|
||||||
|
"protocol" : "openid-connect",
|
||||||
|
"attributes" : {
|
||||||
|
"post.logout.redirect.uris" : "http://localhost:3000/*"
|
||||||
|
},
|
||||||
|
"fullScopeAllowed" : true,
|
||||||
|
"defaultClientScopes": [
|
||||||
|
"role_list",
|
||||||
|
"profile",
|
||||||
|
"email",
|
||||||
|
"roles",
|
||||||
|
"web-origins",
|
||||||
|
"acr",
|
||||||
|
"tornjak-backend",
|
||||||
|
]
|
||||||
|
}],
|
||||||
|
"clientScopes": [{
|
||||||
|
"name": "tornjak-backend",
|
||||||
|
"description": "tornjak backend audience check",
|
||||||
|
"protocol": "openid-connect",
|
||||||
|
"attributes": {
|
||||||
|
"include.in.token.scope": "false",
|
||||||
|
"display.on.consent.screen": "false",
|
||||||
|
"gui.order": "",
|
||||||
|
"consent.screen.text": ""
|
||||||
|
},
|
||||||
|
"protocolMappers": [{
|
||||||
|
"name": "tornjak-backend",
|
||||||
|
"protocol": "openid-connect",
|
||||||
|
"protocolMapper": "oidc-audience-mapper",
|
||||||
|
"consentRequired": false,
|
||||||
|
"config": {
|
||||||
|
"introspection.token.claim": "true",
|
||||||
|
"included.custom.audience": "tornjak-backend",
|
||||||
|
"userinfo.token.claim": "false",
|
||||||
|
"id.token.claim": "false",
|
||||||
|
"lightweight.claim": "false",
|
||||||
|
"access.token.claim": "true"
|
||||||
|
}
|
||||||
|
}]
|
||||||
|
}]
|
||||||
|
}
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
spire-server:
|
||||||
|
tornjak:
|
||||||
|
config:
|
||||||
|
## @extra tornjak.config.userManagement [object] UserManagement config
|
||||||
|
userManagement:
|
||||||
|
issuer: "http://keycloak:80/realms/tornjak"
|
||||||
|
audience: "tornjak-backend"
|
||||||
|
|
||||||
|
tornjak-frontend:
|
||||||
|
auth:
|
||||||
|
enabled: true
|
||||||
|
serverURL: http://localhost:8080/ # enable auth by providing url
|
||||||
@@ -4,6 +4,7 @@ spire-server:
|
|||||||
|
|
||||||
tornjak-frontend:
|
tornjak-frontend:
|
||||||
enabled: true
|
enabled: true
|
||||||
|
apiServerURL: "http://localhost:10000"
|
||||||
service:
|
service:
|
||||||
type: ClusterIP
|
type: ClusterIP
|
||||||
port: 3000
|
port: 3000
|
||||||
|
|||||||
Reference in New Issue
Block a user