Skip to content

Commit 1e722de

Browse files
snarayan-redhatsnarayan-redhat
authored
Merge pull request #94342 from wgabor0427/OSDOCS-14526
OSDOCS-14526 created configuration section
2 parents d0ed2fc + 20763e8 commit 1e722de

File tree

6 files changed

+381
-0
lines changed

6 files changed

+381
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1269,6 +1269,8 @@ Topics:
12691269
File: zero-trust-manager-install
12701270
- Name: Uninstalling Zero Trust Workload Identity Manager
12711271
File: zero-trust-manager-uninstall
1272+
- Name: Deploying Zero Trust Workload Identity Manager operands
1273+
File: zero-trust-manager-configuration
12721274
---
12731275
Name: Authentication and authorization
12741276
Dir: authentication

‎modules/zero-trust-manager-oidc-config.adoc

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-oidc-config_{context}"]
7+
= Deploying the SPIRE OpenID Connect Discovery Provider
8+
9+
You can configure the `SpireOIDCDiscoveryProvider` custom resource (CR) to deploy and configure the SPIRE OpenID Connect (OIDC) Discovery Provider.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
* You have installed {zero-trust-full} in the cluster.
16+
17+
.Procedure
18+
19+
. Create the `SpireOIDCDiscoveryProvider` CR:
20+
21+
.. Create a YAML file that defines the `SpireOIDCDiscoveryProvider` CR, for example, `SpireOIDCDiscoveryProvider.yaml`:
22+
+
23+
.Example `SpireOIDCDiscoveryProvider.yaml`
24+
+
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: SpireOIDCDiscoveryProvider
29+
metadata:
30+
name: cluster
31+
spec:
32+
trustDomain: <trust_domain> #<1>
33+
agentSocketPath: 'spire-agent.sock' #<2>
34+
jwtIssuer: <jwt_issuer_domain> #<3>
35+
----
36+
<1> The trust domain to be used for the SPIFFE identifiers.
37+
<2> The name of the SPIRE agent unix socket.
38+
<3> The JSON Web Token (JWT) issuer domain. The default value is set to the value specified in `oidc-discovery.$trustDomain`.
39+
40+
.. Apply the configuration by running the following command:
41+
+
42+
[source, terminal]
43+
----
44+
$ oc apply -f SpireOIDCDiscoveryProvider.yaml
45+
----
46+
47+
.Verification
48+
49+
. Verify that the deployment of OIDC Discovery Provider is ready and available by running the following command:
50+
+
51+
[source,terminal]
52+
----
53+
$ oc get deployment -l app.kubernetes.io/name=spiffe-oidc-discovery-provider -n zero-trust-workload-identity-manager
54+
----
55+
+
56+
.Example output
57+
[source,terminal]
58+
----
59+
NAME READY UP-TO-DATE AVAILABLE AGE
60+
spire-spiffe-oidc-discovery-provider 1/1 1 1 2m58s
61+
----
62+
63+
. Verify that the status of OIDC Discovery Provider pods is `Running` by running the following command:
64+
+
65+
[source,terminal]
66+
----
67+
$ oc get po -l app.kubernetes.io/name=spiffe-oidc-discovery-provider -n zero-trust-workload-identity-manager
68+
----
69+
+
70+
.Example output
71+
[source,terminal]
72+
----
73+
NAME READY STATUS RESTARTS AGE
74+
spire-spiffe-oidc-discovery-provider-64586d599f-lcc94 2/2 Running 0 7m15s
75+
----

‎modules/zero-trust-manager-spiffe-csidriver-config.adoc

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-spire-csidriver-config_{context}"]
7+
= Deploying the SPIFFE Container Storage Interface driver
8+
9+
You can configure the `SpiffeCSIDriver` custom resource (CR) to deploy and configure a SPIRE agent.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
* You have installed {zero-trust-full} in the cluster.
16+
17+
.Procedure
18+
19+
. Create the `SpiffeCSIDriver` CR:
20+
21+
.. Create a YAML file that defines the `SpiffeCSIDriver` CR object, for example, `SpiffeCSIDriver.yaml`:
22+
+
23+
.Example `SpiffeCSIDriver.yaml`
24+
+
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: SpiffeCSIDriver
29+
metadata:
30+
name: cluster
31+
spec:
32+
agentSocketPath: '/run/spire/agent-sockets/spire-agent.sock' #<1>
33+
----
34+
<1> The UNIX socket path to the SPIRE agent.
35+
36+
.. Apply the configuration by running the following command:
37+
+
38+
[source, terminal]
39+
----
40+
$ oc apply -f SpiffeCSIDriver.yaml
41+
----
42+
43+
.Verification
44+
45+
. Verify that the daemon set of the SPIFFE CSI driver is ready and available by running the following command:
46+
+
47+
[source,terminal]
48+
----
49+
$ oc get daemonset -l app.kubernetes.io/name=spiffe-csi-driver -n zero-trust-workload-identity-manager
50+
----
51+
+
52+
.Example output
53+
[source,terminal]
54+
----
55+
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
56+
spire-spiffe-csi-driver 3 3 3 3 3 <none> 114s
57+
----
58+
59+
. Verify that the status of SPIFFE Container Storage Interface (CSI) Driver pods is `Running` by running the following command:
60+
+
61+
[source,terminal]
62+
----
63+
$ oc get po -l app.kubernetes.io/name=spiffe-csi-driver -n zero-trust-workload-identity-manager
64+
----
65+
+
66+
.Example output
67+
[source,terminal]
68+
----
69+
NAME READY STATUS RESTARTS AGE
70+
spire-spiffe-csi-driver-gpwcp 2/2 Running 0 2m37s
71+
spire-spiffe-csi-driver-rrbrd 2/2 Running 0 2m37s
72+
spire-spiffe-csi-driver-w6s6q 2/2 Running 0 2m37s
73+
----

‎modules/zero-trust-manager-spire-agent-config.adoc

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-spire-agent-config_{context}"]
7+
= Deploying the SPIRE agent
8+
9+
You can configure the `SpireAgent` custom resource (CR) to deploy and configure a SPIRE agent.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
* You have installed {zero-trust-full} in the cluster.
16+
17+
.Procedure
18+
19+
. Create the `SpireAgent` CR:
20+
21+
.. Create a YAML file that defines the `SpireAgent` CR, for example, `SpireAgent.yaml`:
22+
+
23+
.Example `SpireAgent.yaml`
24+
+
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: SpireAgent
29+
metadata:
30+
name: cluster
31+
spec:
32+
trustDomain: <trust_domain> #<1>
33+
clusterName: <cluster_name> #<2>
34+
nodeAttestor:
35+
k8sPSATEnabled: "true" #<3>
36+
workloadAttestors:
37+
k8sEnabled: "true" #<4>
38+
workloadAttestorsVerification:
39+
type: "auto" #<5>
40+
----
41+
<1> The trust domain to be used for the SPIFFE identifiers.
42+
<2> The name of your cluster.
43+
<3> Enable or disable the projected service account token (PSAT) Kubernetes node attestor. The valid options are `true` and `false`.
44+
<4> Enable or disable the Kubernetes workload attestor. The valid options are `true` and `false`.
45+
<5> The type of verification to be done against kubelet. Valid options are `auto`, `hostCert`, `apiServerCA`, `skip`. The `auto` option initially attempts to use `hostCert`, and then falls back to `apiServerCA`.
46+
47+
.. Apply the configuration by running the following command:
48+
+
49+
[source, terminal]
50+
----
51+
$ oc apply -f SpireAgent.yaml
52+
----
53+
54+
.Verification
55+
56+
. Verify that the daemon set of the SPIRE agent is ready and available by running the following command
57+
+
58+
[source,terminal]
59+
----
60+
$ oc get daemonset -l app.kubernetes.io/name=agent -n zero-trust-workload-identity-manager
61+
----
62+
+
63+
.Example output
64+
[source,terminal]
65+
----
66+
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
67+
spire-agent 3 3 3 3 3 <none> 10m
68+
----
69+
70+
. Verify that the status of SPIRE agent pods is `Running` by running the following command:
71+
+
72+
[source,terminal]
73+
----
74+
$ oc get po -l app.kubernetes.io/name=agent -n zero-trust-workload-identity-manager
75+
----
76+
+
77+
.Example output
78+
[source,terminal]
79+
----
80+
NAME READY STATUS RESTARTS AGE
81+
spire-agent-dp4jb 1/1 Running 0 12m
82+
spire-agent-nvwjm 1/1 Running 0 12m
83+
spire-agent-vtvlk 1/1 Running 0 12m
84+
----

‎modules/zero-trust-manager-spire-server-config.adoc

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-spire-server-config_{context}"]
7+
= Deploying the SPIRE server
8+
9+
You can configure the `SpireServer` custom resource (CR) to deploy and configure a SPIRE server.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
* You have installed {zero-trust-full} in the cluster.
16+
17+
.Procedure
18+
19+
. Create the `SpireServer` CR:
20+
21+
.. Create a YAML file that defines the `SpireServer` CR, for example, `SpireServer.yaml`:
22+
+
23+
.Example `SpireServer.yaml`
24+
+
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: SpireServer
29+
metadata:
30+
name: cluster
31+
spec:
32+
trustDomain: <trust_domain> #<1>
33+
clusterName: <cluster_name> #<2>
34+
caSubject:
35+
commonName: example.org #<3>
36+
country: "US" #<4>
37+
organization: "RH" #<5>
38+
persistence:
39+
type: pvc #<6>
40+
size: "5Gi" #<7>
41+
accessMode: ReadWriteOnce #<8>
42+
datastore:
43+
databaseType: sqlite3
44+
connectionString: "/run/spire/data/datastore.sqlite3"
45+
maxOpenConns: 100 #<9>
46+
maxIdleConns: 2 #<10>
47+
connMaxLifetime: 3600 #<11>
48+
jwtIssuer: <jwt_issuer_domain> #<12>
49+
----
50+
<1> The trust domain to be used for the SPIFFE identifiers.
51+
<2> The name of your cluster.
52+
<3> The common name for SPIRE server CA.
53+
<4> The country for SPIRE server CA.
54+
<5> The organization for SPIRE server CA.
55+
<6> The type of volume to be used for persistence. The valid options are `pvc` and `hostPath`.
56+
<7> The size of volume to be used for persistence
57+
<8> The access mode to be used for persistence. The valid options are `ReadWriteOnce`, `ReadWriteOncePod`, and `ReadWriteMany`.
58+
<9> The maximum number of open database connections.
59+
<10> The maximum number of idle connections in the pool.
60+
<11> The maximum amount of time a connection can be reused. To specify an unlimited time, you can set the value to `0`.
61+
<12> The JSON Web Token (JWT) issuer domain. The default value is set to the value specified in `oidc-discovery.$trustDomain`.
62+
63+
.. Apply the configuration by running the following command:
64+
+
65+
[source, terminal]
66+
----
67+
$ oc apply -f SpireServer.yaml
68+
----
69+
70+
.Verification
71+
72+
. Verify that the stateful set of SPIRE server is ready and available by running the following command:
73+
+
74+
[source,terminal]
75+
----
76+
$ oc get statefulset -l app.kubernetes.io/name=server -n zero-trust-workload-identity-manager
77+
----
78+
+
79+
.Example output
80+
[source,terminal]
81+
----
82+
NAME READY AGE
83+
spire-server 1/1 65s
84+
----
85+
86+
. Verify that the status of SPIRE server pod is `Running` by running the following command:
87+
+
88+
[source,terminal]
89+
----
90+
$ oc get po -l app.kubernetes.io/name=server -n zero-trust-workload-identity-manager
91+
----
92+
+
93+
.Example output
94+
[source,terminal]
95+
----
96+
NAME READY STATUS RESTARTS AGE
97+
spire-server-0 2/2 Running 1 (108s ago) 111s
98+
----
99+
100+
. Verify that the persistent volume claim (PVC) is bound, by running the following command:
101+
+
102+
[source,terminal]
103+
----
104+
$ oc get pvc -l app.kubernetes.io/name=server -n zero-trust-workload-identity-manager
105+
----
106+
+
107+
.Example output
108+
[source,terminal]
109+
----
110+
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTECLASS AGE
111+
spire-data-spire-server-0 Bound pvc-27a36535-18a1-4fde-ab6d-e7ee7d3c2744 5Gi RW0 gp3-csi <unset> 22m
112+
----

‎security/zero_trust_workload_identity_manager/zero-trust-manager-configuration.adoc

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="zero-trust-manager-configuration"]
3+
= Deploying Zero Trust Workload Identity Manager operands
4+
5+
include::_attributes/common-attributes.adoc[]
6+
:context: zero-trust-manager-configuration
7+
8+
toc::[]
9+
10+
:FeatureName: Zero Trust Workload Identity Manager
11+
include::snippets/technology-preview.adoc[]
12+
13+
You can deploy the following operands by creating the respective custom resources (CRs). You must deploy the operands in the following sequence to ensure successful installation.
14+
15+
. SPIRE Server
16+
17+
. SPIRE Agent
18+
19+
. SPIFFE CSI driver
20+
21+
. SPIRE OIDC discovery provider
22+
23+
// Deploying and configuring SPIRE server
24+
include::modules/zero-trust-manager-spire-server-config.adoc[leveloffset=+1]
25+
26+
// Deploying and configuring SPIRE agent
27+
include::modules/zero-trust-manager-spire-agent-config.adoc[leveloffset=+1]
28+
29+
// Deploying and configuring SPIFFE CSI Driver
30+
include::modules/zero-trust-manager-spiffe-csidriver-config.adoc[leveloffset=+1]
31+
32+
// Deploying and configuring OIDC Discovery Provider
33+
include::modules/zero-trust-manager-oidc-config.adoc[leveloffset=+1]
34+
35+

0 commit comments

Comments
 (0)