Skip to content

Commit efca500

Browse files
snarayan-redhatShubha Narayanan
snarayan-redhat
authored and
Shubha Narayanan
committed
ZTWIM release notes
2 parents 9b1095e + 1e4fd03 commit efca500

7 files changed

+425
-2
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1239,12 +1239,16 @@ Topics:
12391239
Topics:
12401240
- Name: Zero Trust Workload Identity Manager overview
12411241
File: zero-trust-manager-overview
1242+
- Name: Zero Trust Workload Identity Manager release notes
1243+
File: zero-trust-manager-release-notes
1244+
- Name: Zero Trust Workload Identity Manager components and features
1245+
File: zero-trust-manager-features
12421246
- Name: Installing Zero Trust Workload Identity Manager
12431247
File: zero-trust-manager-install
1248+
- Name: Deploying Zero Trust Workload Identity Manager operands
1249+
File: zero-trust-manager-configuration
12441250
- Name: Uninstalling Zero Trust Workload Identity Manager
12451251
File: zero-trust-manager-uninstall
1246-
- Name: Zero Trust Workload Identity Manager components and features
1247-
File: zero-trust-manager-features
12481252
- Name: Viewing audit logs
12491253
File: audit-log-view
12501254
- Name: Configuring the audit log policy

‎modules/zero-trust-manager-oidc-config.adoc

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-oidc-config_{context}"]
7+
= Deploying the SPIRE OpenID Connect Discovery Provider
8+
9+
You can configure the `SpireOIDCDiscoveryProvider` custom resource (CR) to deploy and configure the SPIRE OpenID Connect (OIDC) Discovery Provider.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
* You have installed {zero-trust-full} in the cluster.
16+
17+
.Procedure
18+
19+
. Create the `SpireOIDCDiscoveryProvider` CR:
20+
21+
.. Create a YAML file that defines the `SpireOIDCDiscoveryProvider` CR, for example, `SpireOIDCDiscoveryProvider.yaml`:
22+
+
23+
.Example `SpireOIDCDiscoveryProvider.yaml`
24+
+
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: SpireOIDCDiscoveryProvider
29+
metadata:
30+
name: cluster
31+
spec:
32+
trustDomain: <trust_domain> #<1>
33+
agentSocketPath: 'spire-agent.sock' #<2>
34+
jwtIssuer: <jwt_issuer_domain> #<3>
35+
----
36+
<1> The trust domain to be used for the SPIFFE identifiers.
37+
<2> The name of the SPIRE agent unix socket.
38+
<3> The JSON Web Token (JWT) issuer domain. The default value is set to the value specified in `oidc-discovery.$trustDomain`.
39+
40+
.. Apply the configuration by running the following command:
41+
+
42+
[source, terminal]
43+
----
44+
$ oc apply -f SpireOIDCDiscoveryProvider.yaml
45+
----
46+
47+
.Verification
48+
49+
. Verify that the deployment of OIDC Discovery Provider is ready and available by running the following command:
50+
+
51+
[source,terminal]
52+
----
53+
$ oc get deployment -l app.kubernetes.io/name=spiffe-oidc-discovery-provider -n zero-trust-workload-identity-manager
54+
----
55+
+
56+
.Example output
57+
[source,terminal]
58+
----
59+
NAME READY UP-TO-DATE AVAILABLE AGE
60+
spire-spiffe-oidc-discovery-provider 1/1 1 1 2m58s
61+
----
62+
63+
. Verify that the status of OIDC Discovery Provider pods is `Running` by running the following command:
64+
+
65+
[source,terminal]
66+
----
67+
$ oc get po -l app.kubernetes.io/name=spiffe-oidc-discovery-provider -n zero-trust-workload-identity-manager
68+
----
69+
+
70+
.Example output
71+
[source,terminal]
72+
----
73+
NAME READY STATUS RESTARTS AGE
74+
spire-spiffe-oidc-discovery-provider-64586d599f-lcc94 2/2 Running 0 7m15s
75+
----

‎modules/zero-trust-manager-spiffe-csidriver-config.adoc

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-spire-csidriver-config_{context}"]
7+
= Deploying the SPIFFE Container Storage Interface driver
8+
9+
You can configure the `SpiffeCSIDriver` custom resource (CR) to deploy and configure a SPIRE agent.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
* You have installed {zero-trust-full} in the cluster.
16+
17+
.Procedure
18+
19+
. Create the `SpiffeCSIDriver` CR:
20+
21+
.. Create a YAML file that defines the `SpiffeCSIDriver` CR object, for example, `SpiffeCSIDriver.yaml`:
22+
+
23+
.Example `SpiffeCSIDriver.yaml`
24+
+
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: SpiffeCSIDriver
29+
metadata:
30+
name: cluster
31+
spec:
32+
agentSocketPath: '/run/spire/agent-sockets/spire-agent.sock' #<1>
33+
----
34+
<1> The UNIX socket path to the SPIRE agent.
35+
36+
.. Apply the configuration by running the following command:
37+
+
38+
[source, terminal]
39+
----
40+
$ oc apply -f SpiffeCSIDriver.yaml
41+
----
42+
43+
.Verification
44+
45+
. Verify that the daemon set of the SPIFFE CSI driver is ready and available by running the following command:
46+
+
47+
[source,terminal]
48+
----
49+
$ oc get daemonset -l app.kubernetes.io/name=spiffe-csi-driver -n zero-trust-workload-identity-manager
50+
----
51+
+
52+
.Example output
53+
[source,terminal]
54+
----
55+
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
56+
spire-spiffe-csi-driver 3 3 3 3 3 <none> 114s
57+
----
58+
59+
. Verify that the status of SPIFFE Container Storage Interface (CSI) Driver pods is `Running` by running the following command:
60+
+
61+
[source,terminal]
62+
----
63+
$ oc get po -l app.kubernetes.io/name=spiffe-csi-driver -n zero-trust-workload-identity-manager
64+
----
65+
+
66+
.Example output
67+
[source,terminal]
68+
----
69+
NAME READY STATUS RESTARTS AGE
70+
spire-spiffe-csi-driver-gpwcp 2/2 Running 0 2m37s
71+
spire-spiffe-csi-driver-rrbrd 2/2 Running 0 2m37s
72+
spire-spiffe-csi-driver-w6s6q 2/2 Running 0 2m37s
73+
----

‎modules/zero-trust-manager-spire-agent-config.adoc

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-spire-agent-config_{context}"]
7+
= Deploying the SPIRE agent
8+
9+
You can configure the `SpireAgent` custom resource (CR) to deploy and configure a SPIRE agent.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
* You have installed {zero-trust-full} in the cluster.
16+
17+
.Procedure
18+
19+
. Create the `SpireAgent` CR:
20+
21+
.. Create a YAML file that defines the `SpireAgent` CR, for example, `SpireAgent.yaml`:
22+
+
23+
.Example `SpireAgent.yaml`
24+
+
25+
[source,yaml]
26+
----
27+
apiVersion: operator.openshift.io/v1alpha1
28+
kind: SpireAgent
29+
metadata:
30+
name: cluster
31+
spec:
32+
trustDomain: <trust_domain> #<1>
33+
clusterName: <cluster_name> #<2>
34+
nodeAttestor:
35+
k8sPSATEnabled: "true" #<3>
36+
workloadAttestors:
37+
k8sEnabled: "true" #<4>
38+
workloadAttestorsVerification:
39+
type: "auto" #<5>
40+
----
41+
<1> The trust domain to be used for the SPIFFE identifiers.
42+
<2> The name of your cluster.
43+
<3> Enable or disable the projected service account token (PSAT) Kubernetes node attestor. The valid options are `true` and `false`.
44+
<4> Enable or disable the Kubernetes workload attestor. The valid options are `true` and `false`.
45+
<5> The type of verification to be done against kubelet. Valid options are `auto`, `hostCert`, `apiServerCA`, `skip`. The `auto` option initially attempts to use `hostCert`, and then falls back to `apiServerCA`.
46+
47+
.. Apply the configuration by running the following command:
48+
+
49+
[source, terminal]
50+
----
51+
$ oc apply -f SpireAgent.yaml
52+
----
53+
54+
.Verification
55+
56+
. Verify that the daemon set of the SPIRE agent is ready and available by running the following command
57+
+
58+
[source,terminal]
59+
----
60+
$ oc get daemonset -l app.kubernetes.io/name=agent -n zero-trust-workload-identity-manager
61+
----
62+
+
63+
.Example output
64+
[source,terminal]
65+
----
66+
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
67+
spire-agent 3 3 3 3 3 <none> 10m
68+
----
69+
70+
. Verify that the status of SPIRE agent pods is `Running` by running the following command:
71+
+
72+
[source,terminal]
73+
----
74+
$ oc get po -l app.kubernetes.io/name=agent -n zero-trust-workload-identity-manager
75+
----
76+
+
77+
.Example output
78+
[source,terminal]
79+
----
80+
NAME READY STATUS RESTARTS AGE
81+
spire-agent-dp4jb 1/1 Running 0 12m
82+
spire-agent-nvwjm 1/1 Running 0 12m
83+
spire-agent-vtvlk 1/1 Running 0 12m
84+
----

‎modules/zero-trust-manager-spire-server-config.adoc

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-spire-server-config_{context}"]
7+
= Deploying the SPIRE server
8+
9+
You can configure the `SpireServer` custom resource (CR) to deploy and configure a SPIRE server.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
* You have installed {zero-trust-full} in the cluster.
15+
.Procedure
16+
17+
. Create the `SpireServer` CR:
18+
19+
.. Create a YAML file that defines the `SpireServer` CR, for example, `SpireServer.yaml`:
20+
+
21+
.Example `SpireServer.yaml`
22+
+
23+
[source,yaml]
24+
----
25+
apiVersion: operator.openshift.io/v1alpha1
26+
kind: SpireServer
27+
metadata:
28+
name: cluster
29+
spec:
30+
trustDomain: <trust_domain> #<1>
31+
clusterName: <cluster_name> #<2>
32+
caSubject:
33+
commonName: example.org #<3>
34+
country: "US" #<4>
35+
organization: "RH" #<5>
36+
persistence:
37+
type: pvc #<6>
38+
size: "5Gi" #<7>
39+
accessMode: ReadWriteOnce #<8>
40+
datastore:
41+
databaseType: sqlite3
42+
connectionString: "/run/spire/data/datastore.sqlite3"
43+
maxOpenConns: 100 #<9>
44+
maxIdleConns: 2 #<10>
45+
connMaxLifetime: 3600 #<11>
46+
jwtIssuer: <jwt_issuer_domain> #<12>
47+
----
48+
<1> The trust domain to be used for the SPIFFE identifiers.
49+
<2> The name of your cluster.
50+
<3> The common name for SPIRE server CA.
51+
<4> The country for SPIRE server CA.
52+
<5> The organization for SPIRE server CA.
53+
<6> The type of volume to be used for persistence. The valid options are `pvc` and `hostPath`.
54+
<7> The size of volume to be used for persistence
55+
<8> The access mode to be used for persistence. The valid options are `ReadWriteOnce`, `ReadWriteOncePod`, and `ReadWriteMany`.
56+
<9> The maximum number of open database connections.
57+
<10> The maximum number of idle connections in the pool.
58+
<11> The maximum amount of time a connection can be reused. To specify an unlimited time, you can set the value to `0`.
59+
<12> The JSON Web Token (JWT) issuer domain. The default value is set to the value specified in `oidc-discovery.$trustDomain`.
60+
61+
.. Apply the configuration by running the following command:
62+
+
63+
[source, terminal]
64+
----
65+
$ oc apply -f SpireServer.yaml
66+
----
67+
68+
.Verification
69+
70+
. Verify that the stateful set of SPIRE server is ready and available by running the following command:
71+
+
72+
[source,terminal]
73+
----
74+
$ oc get statefulset -l app.kubernetes.io/name=server -n zero-trust-workload-identity-manager
75+
----
76+
+
77+
.Example output
78+
[source,terminal]
79+
----
80+
NAME READY AGE
81+
spire-server 1/1 65s
82+
----
83+
84+
. Verify that the status of SPIRE server pod is `Running` by running the following command:
85+
+
86+
[source,terminal]
87+
----
88+
$ oc get po -l app.kubernetes.io/name=server -n zero-trust-workload-identity-manager
89+
----
90+
+
91+
.Example output
92+
[source,terminal]
93+
----
94+
NAME READY STATUS RESTARTS AGE
95+
spire-server-0 2/2 Running 1 (108s ago) 111s
96+
----
97+
98+
. Verify that the persistent volume claim (PVC) is bound, by running the following command:
99+
+
100+
[source,terminal]
101+
----
102+
$ oc get pvc -l app.kubernetes.io/name=server -n zero-trust-workload-identity-manager
103+
----
104+
+
105+
.Example output
106+
[source,terminal]
107+
----
108+
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTECLASS AGE
109+
spire-data-spire-server-0 Bound pvc-27a36535-18a1-4fde-ab6d-e7ee7d3c2744 5Gi RW0 gp3-csi <unset> 22m
110+
----

0 commit comments

Comments
 (0)