Skip to content

Commit 20763e8

Browse files
snarayan-redhatShubha Narayanan
snarayan-redhat
authored and
Shubha Narayanan
committed
ZTWIM deploying operands
2 parents 729c5c8 + cdb601c commit 20763e8

10 files changed

+443
-1
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1263,10 +1263,14 @@ Topics:
12631263
Topics:
12641264
- Name: Zero Trust Workload Identity Manager overview
12651265
File: zero-trust-manager-overview
1266+
- Name: Zero Trust Workload Identity Manager features
1267+
File: zero-trust-manager-features
12661268
- Name: Installing Zero Trust Workload Identity Manager
12671269
File: zero-trust-manager-install
12681270
- Name: Uninstalling Zero Trust Workload Identity Manager
12691271
File: zero-trust-manager-uninstall
1272+
- Name: Deploying Zero Trust Workload Identity Manager operands
1273+
File: zero-trust-manager-configuration
12701274
---
12711275
Name: Authentication and authorization
12721276
Dir: authentication

‎modules/zero-trust-manager-about-components.adoc

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zer-trust-manager-features.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="zero-trust-manager-about-features_{context}"]
7+
= {zero-trust-full} components
8+
9+
The following components are available as part of the initial release of {zero-trust-full}.
10+
11+
[id="spiffe-csi-driver_{context}"]
12+
== SPIFFE CSI Driver
13+
14+
The SPIFFE Container Storage Interface (CSI) is a plugin that helps pods securely obtain their {svid-full} by delivering the Workload API socket into the pod. The SPIFFE CSI driver is deployed as a daemonset on the cluster ensuring that a driver instance runs on each node. The driver uses the ephemeral inline volume capability of Kubernetes allowing pods to request volumes directly provided by the SPIFFE CSI driver. This simplifies their use by applications that need temporary storage.
15+
16+
When the pod starts, the Kubelet calls the SPIFFE CSI driver to provision and mount a volume into the pod's containers. The SPIFFE CSI driver mounts a directory that contains the SPIFFE Workload API into the pod. Applications in the pod then communicate with the Workload API to obtain their SVIDs. The driver guarantees that each SVID is unique.
17+
18+
[id="spire-oidc-federation_{context}"]
19+
== SPIRE OpenID Connect Discovery Provider
20+
21+
The SPIRE OpenID Connect Discovery Provider is a standalone component that makes SPIRE-issued JWT-SVIDs compatible with standard OpenID Connect (OIDC) users by exposing a open ID configuration endpoint and a JWKS URI for token verification. It is essential for integrating SPIRE-based workload identity with systems that require OIDC-compliant tokens, especially, external APIs. While SPIRE primarily issues identities for workloads, additional workload-related claims can be embedded into JWT-SVIDs through the configuration of SPIRE, which these claims to be included in the token and verified by OIDC-compliant clients.
22+
23+
[id="spire-controller-manager_{context}"]
24+
== SPIRE Controller Manager
25+
26+
The SPIRE Controller Manager uses custom resource definitions (CRDs) to facilitate the registration of workloads. To facilitate workload registration, the SPIRE Controller Manager registers controllers against pods and CRDs. When changes are detected on these resources, a workload reconciliation process is triggered. This process determines which SPIRE entries should exist based on the existing pods and CRDs. The reconciliation process creates, updates, and deletes entries on the SPIRE server as appropriate.
27+
28+
The SPIRE Controller Manager is designed to be deployed on the same pod as the SPIRE server. The manager communicates with the SPIRE server API using a private UNIX Domain Socket within a shared volume.
29+
30+

‎modules/zero-trust-manager-about-features.adoc

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zer-trust-manager-features.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="ztwim_features_{context}"]
7+
= {zero-trust-full} features
8+
9+
[id="spire-telemetry_{context}"]
10+
== SPIRE server and agent telemetry
11+
12+
SPIRE server and agent telemetry provide insight into the health of the SPIRE deployment. The metrics are in the format provided by the Prometheus Operator. The metrics exposed help in understanding server health & lifecycle, spire component performance, attestation and SVID issuance and plugin statistics.

‎modules/zero-trust-manager-oidc-config.adoc

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-oidc-config_{context}"]
7+
= Deploying the SPIRE OpenID Connect Discovery Provider
8+
9+
You can configure the `SpireOIDCDiscoveryProvider` custom resource (CR) to deploy and configure the SPIRE OpenID Connect (OIDC) Discovery Provider.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
* You have installed {zero-trust-full} in the cluster.
16+
17+
.Procedure
18+
19+
. Create the `SpireOIDCDiscoveryProvider` CR:
20+
21+
.. Create a YAML file that defines the `SpireOIDCDiscoveryProvider` CR, for example, `SpireOIDCDiscoveryProvider.yaml`:
22+
+
23+
.Example `SpireOIDCDiscoveryProvider.yaml`
24+
+
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: SpireOIDCDiscoveryProvider
29+
metadata:
30+
name: cluster
31+
spec:
32+
trustDomain: <trust_domain> #<1>
33+
agentSocketPath: 'spire-agent.sock' #<2>
34+
jwtIssuer: <jwt_issuer_domain> #<3>
35+
----
36+
<1> The trust domain to be used for the SPIFFE identifiers.
37+
<2> The name of the SPIRE agent unix socket.
38+
<3> The JSON Web Token (JWT) issuer domain. The default value is set to the value specified in `oidc-discovery.$trustDomain`.
39+
40+
.. Apply the configuration by running the following command:
41+
+
42+
[source, terminal]
43+
----
44+
$ oc apply -f SpireOIDCDiscoveryProvider.yaml
45+
----
46+
47+
.Verification
48+
49+
. Verify that the deployment of OIDC Discovery Provider is ready and available by running the following command:
50+
+
51+
[source,terminal]
52+
----
53+
$ oc get deployment -l app.kubernetes.io/name=spiffe-oidc-discovery-provider -n zero-trust-workload-identity-manager
54+
----
55+
+
56+
.Example output
57+
[source,terminal]
58+
----
59+
NAME READY UP-TO-DATE AVAILABLE AGE
60+
spire-spiffe-oidc-discovery-provider 1/1 1 1 2m58s
61+
----
62+
63+
. Verify that the status of OIDC Discovery Provider pods is `Running` by running the following command:
64+
+
65+
[source,terminal]
66+
----
67+
$ oc get po -l app.kubernetes.io/name=spiffe-oidc-discovery-provider -n zero-trust-workload-identity-manager
68+
----
69+
+
70+
.Example output
71+
[source,terminal]
72+
----
73+
NAME READY STATUS RESTARTS AGE
74+
spire-spiffe-oidc-discovery-provider-64586d599f-lcc94 2/2 Running 0 7m15s
75+
----

‎modules/zero-trust-manager-spiffe-csidriver-config.adoc

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-spire-csidriver-config_{context}"]
7+
= Deploying the SPIFFE Container Storage Interface driver
8+
9+
You can configure the `SpiffeCSIDriver` custom resource (CR) to deploy and configure a SPIRE agent.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
* You have installed {zero-trust-full} in the cluster.
16+
17+
.Procedure
18+
19+
. Create the `SpiffeCSIDriver` CR:
20+
21+
.. Create a YAML file that defines the `SpiffeCSIDriver` CR object, for example, `SpiffeCSIDriver.yaml`:
22+
+
23+
.Example `SpiffeCSIDriver.yaml`
24+
+
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: SpiffeCSIDriver
29+
metadata:
30+
name: cluster
31+
spec:
32+
agentSocketPath: '/run/spire/agent-sockets/spire-agent.sock' #<1>
33+
----
34+
<1> The UNIX socket path to the SPIRE agent.
35+
36+
.. Apply the configuration by running the following command:
37+
+
38+
[source, terminal]
39+
----
40+
$ oc apply -f SpiffeCSIDriver.yaml
41+
----
42+
43+
.Verification
44+
45+
. Verify that the daemon set of the SPIFFE CSI driver is ready and available by running the following command:
46+
+
47+
[source,terminal]
48+
----
49+
$ oc get daemonset -l app.kubernetes.io/name=spiffe-csi-driver -n zero-trust-workload-identity-manager
50+
----
51+
+
52+
.Example output
53+
[source,terminal]
54+
----
55+
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
56+
spire-spiffe-csi-driver 3 3 3 3 3 <none> 114s
57+
----
58+
59+
. Verify that the status of SPIFFE Container Storage Interface (CSI) Driver pods is `Running` by running the following command:
60+
+
61+
[source,terminal]
62+
----
63+
$ oc get po -l app.kubernetes.io/name=spiffe-csi-driver -n zero-trust-workload-identity-manager
64+
----
65+
+
66+
.Example output
67+
[source,terminal]
68+
----
69+
NAME READY STATUS RESTARTS AGE
70+
spire-spiffe-csi-driver-gpwcp 2/2 Running 0 2m37s
71+
spire-spiffe-csi-driver-rrbrd 2/2 Running 0 2m37s
72+
spire-spiffe-csi-driver-w6s6q 2/2 Running 0 2m37s
73+
----

‎modules/zero-trust-manager-spire-agent-config.adoc

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-spire-agent-config_{context}"]
7+
= Deploying the SPIRE agent
8+
9+
You can configure the `SpireAgent` custom resource (CR) to deploy and configure a SPIRE agent.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
* You have installed {zero-trust-full} in the cluster.
16+
17+
.Procedure
18+
19+
. Create the `SpireAgent` CR:
20+
21+
.. Create a YAML file that defines the `SpireAgent` CR, for example, `SpireAgent.yaml`:
22+
+
23+
.Example `SpireAgent.yaml`
24+
+
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: SpireAgent
29+
metadata:
30+
name: cluster
31+
spec:
32+
trustDomain: <trust_domain> #<1>
33+
clusterName: <cluster_name> #<2>
34+
nodeAttestor:
35+
k8sPSATEnabled: "true" #<3>
36+
workloadAttestors:
37+
k8sEnabled: "true" #<4>
38+
workloadAttestorsVerification:
39+
type: "auto" #<5>
40+
----
41+
<1> The trust domain to be used for the SPIFFE identifiers.
42+
<2> The name of your cluster.
43+
<3> Enable or disable the projected service account token (PSAT) Kubernetes node attestor. The valid options are `true` and `false`.
44+
<4> Enable or disable the Kubernetes workload attestor. The valid options are `true` and `false`.
45+
<5> The type of verification to be done against kubelet. Valid options are `auto`, `hostCert`, `apiServerCA`, `skip`. The `auto` option initially attempts to use `hostCert`, and then falls back to `apiServerCA`.
46+
47+
.. Apply the configuration by running the following command:
48+
+
49+
[source, terminal]
50+
----
51+
$ oc apply -f SpireAgent.yaml
52+
----
53+
54+
.Verification
55+
56+
. Verify that the daemon set of the SPIRE agent is ready and available by running the following command
57+
+
58+
[source,terminal]
59+
----
60+
$ oc get daemonset -l app.kubernetes.io/name=agent -n zero-trust-workload-identity-manager
61+
----
62+
+
63+
.Example output
64+
[source,terminal]
65+
----
66+
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
67+
spire-agent 3 3 3 3 3 <none> 10m
68+
----
69+
70+
. Verify that the status of SPIRE agent pods is `Running` by running the following command:
71+
+
72+
[source,terminal]
73+
----
74+
$ oc get po -l app.kubernetes.io/name=agent -n zero-trust-workload-identity-manager
75+
----
76+
+
77+
.Example output
78+
[source,terminal]
79+
----
80+
NAME READY STATUS RESTARTS AGE
81+
spire-agent-dp4jb 1/1 Running 0 12m
82+
spire-agent-nvwjm 1/1 Running 0 12m
83+
spire-agent-vtvlk 1/1 Running 0 12m
84+
----

0 commit comments

Comments
 (0)