Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deploy Dex in MetalK8s from the Helm charts #2007

Closed
Ebaneck opened this issue Nov 5, 2019 · 5 comments
Closed

Deploy Dex in MetalK8s from the Helm charts #2007

Ebaneck opened this issue Nov 5, 2019 · 5 comments
Assignees
@Ebaneck
Labels
complexity:medium Something that requires one or few days to fix topic:authentication Anything related to user authentication topic:operations Operations-related issues
Milestone
MetalK8s 2.6.0

Comments

@Ebaneck
Copy link
Contributor

Ebaneck commented Nov 5, 2019 •
edited by gdemonet
Loading

Component:

'salt', 'kubernetes', 'containers'

Why this is needed:

To integrate a flexible identity and access management(IAM) in Metalk8s based on the authentication user requirements, we need to deploy an OIDC provider.

Dex is our choice of OIDC and needs to be deployed in a MetalK8s cluster.

What should be done:

  • Using the official Dex charts, deploy 2 replicas of the latest release of Dex(v2.19) in a Metalk8s cluster.

Implementation proposal (strongly recommended):

Test plan:

  • Have a Dex pod running in Metalk8s under the metalk8s-auth namespace

Epic iteration: #1988
@Ebaneck Ebaneck added topic:security Security-related issues topic:operations Operations-related issues moonshot complexity:medium Something that requires one or few days to fix labels Nov 5, 2019
@Ebaneck Ebaneck added this to the MetalK8s 2.5.0 milestone Nov 5, 2019
@NicolasT
Copy link
Contributor

NicolasT commented Nov 5, 2019

Please make sure to follow the exact mechanism used to install the other chart-based addons we embed.

@NicolasT
Copy link
Contributor

NicolasT commented Nov 5, 2019

Why would we want/need to run this in kube-system?

@Ebaneck
Copy link
Contributor Author

Ebaneck commented Nov 5, 2019 •
edited
Loading

Why would we want/need to run this in kube-system?

@NicolasT since the Dex storage backend we will most likely be using is the Kubernetes backend, i can't think of any reason to not leave it in the kube-system namespace.

Generally what is considered best practice for such??

@gdemonet gdemonet added topic:authentication Anything related to user authentication and removed topic:security Security-related issues labels Nov 5, 2019
@gdemonet
Copy link
Contributor

gdemonet commented Nov 6, 2019

Why would we want/need to run this in kube-system?

@NicolasT since the Dex storage backend we will most likely be using is the Kubernetes backend, i can't think of any reason to not leave it in the kube-system namespace.

Dex is using K8s API for interfacing with its storage, so it can run as any other workload (e.g. all Operators use K8s API as well). Having a dedicated namespace, as we do for the nginx-ingress-controllers (which use K8s API too), is recommended: go for metalk8s-dex.

Generally what is considered best practice for such??

kube-system is meant to group applications critical for the cluster functioning, such as etcd or kube-apiserver. One could argue salt-master shouldn't be part of it (it is today), but that's not the scope of this discussion. Dex isn't strictly necessary for the cluster to function (it's only necessary for end-users to authenticate against the API through OIDC, which they could circumvent using certificate-based auth if the need arises).

@NicolasT
Copy link
Contributor

NicolasT commented Nov 6, 2019

go for metalk8s-dex

metalk8s-auth or something along those lines. If ever we change IdP, we can keep things in the same namespace and such.

@thomasdanan thomasdanan mentioned this issue Nov 6, 2019
Closed
7 tasks
@Ebaneck Ebaneck self-assigned this Nov 7, 2019
Ebaneck added a commit that referenced this issue Nov 7, 2019
@Ebaneck
salt: add dex deployment
86a437e 
Generated using

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```

Closes: #2007
@Ebaneck Ebaneck mentioned this issue Nov 7, 2019
Merged
Ebaneck added a commit that referenced this issue Nov 7, 2019
@Ebaneck
salt: add dex deployment
646e460 
Generated using

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 7, 2019
@Ebaneck
salt: add dex deployment
ebc9116 
Generated using

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 8, 2019
@Ebaneck
salt: add dex deployment
45d5892 
Generated using

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 12, 2019
@Ebaneck
salt: add dex deployment configuration
60c5f10 
Add k8s secrets used for dex deployment
Add sls files required for dex certificate generation
Generate dex deployment chart using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly because of how we render the charts.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.

To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 12, 2019
@Ebaneck
salt: add dex deployment configuration
2ee237f 
Add k8s secrets used for dex deployment
Add sls files required for dex certificate generation
Generate dex deployment chart using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly because of how we render the charts.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.

To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 12, 2019
@Ebaneck
salt: add dex deployment configuration
194a22c 
Add k8s secrets used for dex deployment
Add sls files required for dex certificate generation
Generate dex deployment chart using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly because of how we render the charts.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.

To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 12, 2019
@Ebaneck
salt: add dex deployment configuration
072df01 
Add k8s secrets used for dex deployment
Add sls files required for dex certificate generation
Generate dex deployment chart using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly because of how we render the charts.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.

To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 12, 2019
@Ebaneck
salt: add dex deployment configuration
51fb44a 
Add k8s secrets used for dex deployment
Add sls files required for dex certificate generation
Generate dex deployment chart using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly because of how we render the charts.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.

To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 13, 2019
@Ebaneck
salt: add dex deployment configuration
676f94b 
Add k8s secrets used for dex deployment
Add sls files required for dex certificate generation
Generate dex deployment chart using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly because of how we render the charts.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.

To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 14, 2019
@Ebaneck
salt: add dex deployment configuration
cfffb0f 
Automatically generate dex deployment, service account,
cluster role and cluster role bindings

The above is generated from the charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.
To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 14, 2019
@Ebaneck
salt: add dex deployment configuration
4aff928 
Automatically generate dex deployment, service account,
cluster role and cluster role bindings

The above is generated from the charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.
To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 18, 2019
@Ebaneck
salt: add dex deployment configuration
6122fd8 
Automatically generate dex deployment, service account,
cluster role and cluster role bindings

The above is generated from the charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.
To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 18, 2019
@Ebaneck
salt: add dex deployment configuration
a6b47b9 
Automatically generate dex deployment, service account,
cluster role and cluster role bindings

The above is generated from the charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.
To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 18, 2019
@Ebaneck
salt: add dex deployment configuration
4a9ddb9 
Automatically generate dex deployment, service account,
cluster role and cluster role bindings

The above is generated from the charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.
To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 20, 2019
@Ebaneck
charts: import stable/dex 2.19.0
8f4b5ba 
```
$ helm fetch -d charts --untar stable/dex
```

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 20, 2019
@Ebaneck
Salt: Add and Render DEX deployment configuration
0f647b9 
This commit adds the following:

Adds method to obtain OIDC service IP and binds this
static IP as the ClusterIP address for DEX service

Adds `metalk8-auth` namespace which holds OIDC/authentication
cluster resources(PODS)

Automatically generate dex deployment, service account,
cluster role and cluster role bindings

The DEX chart.sls is generated from the charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls

Add states to deploy DEX and related server certificates

Closes: #2007
Closes: #2011
Ebaneck added a commit that referenced this issue Nov 20, 2019
@Ebaneck
charts: import stable/dex 2.19.0
910d0b7 
```
$ helm fetch -d charts --untar stable/dex
```

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 20, 2019
@Ebaneck
Salt: Add and Render DEX deployment configuration
9d11d65 
This commit adds the following:

Adds method to obtain OIDC service IP and binds this
static IP as the ClusterIP address for DEX service

Adds `metalk8-auth` namespace which holds OIDC/authentication
cluster resources(PODS)

Automatically generate dex deployment, service account,
cluster role and cluster role bindings

The DEX chart.sls is generated from the charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls

Add states to deploy DEX and related server certificates

Closes: #2007
Closes: #2011
Ebaneck added a commit that referenced this issue Nov 20, 2019
@Ebaneck
Salt: Add and Render DEX deployment configuration
2647f67 
This commit adds the following:

Adds method to obtain OIDC service IP and binds this
static IP as the ClusterIP address for DEX service

Adds `metalk8-auth` namespace which holds OIDC/authentication
cluster resources(PODS)

Automatically generate dex deployment, service account,
cluster role and cluster role bindings

The DEX chart.sls is generated from the charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls

Add states to deploy DEX and related server certificates

Closes: #2007
Closes: #2011
Ebaneck added a commit that referenced this issue Nov 21, 2019
@Ebaneck
charts: import stable/dex 2.19.0
804ff7f 
```
$ helm fetch -d charts --untar stable/dex
```

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 21, 2019
@Ebaneck
Salt: Add and Render DEX deployment configuration
6747bfe 
This commit adds the following:

Adds method to obtain OIDC service IP and binds this
static IP as the ClusterIP address for DEX service

Adds `metalk8-auth` namespace which holds OIDC/authentication
cluster resources(PODS)

Automatically generate dex deployment, service account,
cluster role and cluster role bindings

The DEX chart.sls is generated from the charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls

Add states to deploy DEX and related server certificates

Closes: #2007
Closes: #2011
Ebaneck added a commit that referenced this issue Nov 21, 2019
@Ebaneck
Salt: Add and Render DEX deployment configuration
70e80fd 
This commit adds the following:

Adds Dex Image to the buildchain

Adds method to obtain OIDC service IP and binds this
static IP as the ClusterIP address for Dex service

Adds `metalk8-auth` namespace which holds OIDC/authentication
cluster resources(PODS)

Automatically generate Dex deployment, service account,
cluster role and clusterrolebindings

The Dex chart.sls is generated from the Helm charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls

Add states to deploy Dex and related server certificates

Closes: #2007
Closes: #2011
ChengYanJin pushed a commit that referenced this issue Nov 21, 2019
@Ebaneck @ChengYanJin
salt: add dex deployment configuration
d7a6d61 
Automatically generate dex deployment, service account,
cluster role and cluster role bindings

The above is generated from the charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls
```
Note: The generated dex `charts.sls` can not render the `Secret` template properly.
The render injects `\\..` which makes the sls invalid and cannot be applied by K8s.
To resolve this, after chart generation we delete the secret section and make use of `dex-conf.sls`

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 21, 2019
@Ebaneck
charts: import stable/dex 2.19.0
f513d89 
```
$ helm fetch -d charts --untar stable/dex
```

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 21, 2019
@Ebaneck
Salt: Add and Render Dex deployment configuration
7bd1920 
This commit adds the following:

Adds Dex Image to the buildchain

Adds method to obtain OIDC service IP and binds this
static IP as the ClusterIP address for Dex service

Adds `metalk8-auth` namespace which holds OIDC/authentication
cluster resources(PODS)

Automatically generate Dex deployment, service account,
cluster role and clusterrolebindings

The Dex chart.sls is generated from the Helm charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls

Add states to deploy Dex and related server certificates

Closes: #2007
Closes: #2011
Ebaneck added a commit that referenced this issue Nov 22, 2019
@Ebaneck
charts: import stable/dex 2.19.0
d406987 
```
$ helm fetch -d charts --untar stable/dex
```

Closes: #2007
Ebaneck added a commit that referenced this issue Nov 22, 2019
@Ebaneck
Salt: Add and Render Dex deployment configuration
2a5e6e8 
This commit adds the following:

Adds Dex Image to the buildchain

Adds method to obtain OIDC service IP and binds this
static IP as the ClusterIP address for Dex service

Adds `metalk8-auth` namespace which holds OIDC/authentication
cluster resources(PODS)

Automatically generate Dex deployment, service account,
cluster role and clusterrolebindings

The Dex chart.sls is generated from the Helm charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls

Add states to deploy Dex and related server certificates

Closes: #2007
Closes: #2011
@Ebaneck Ebaneck closed this as completed Nov 22, 2019
ChengYanJin pushed a commit that referenced this issue Dec 17, 2019
@Ebaneck @ChengYanJin
charts: import stable/dex 2.19.0
912bf14 
```
$ helm fetch -d charts --untar stable/dex
```

Closes: #2007
ChengYanJin pushed a commit that referenced this issue Dec 17, 2019
@Ebaneck @ChengYanJin
Salt: Add and Render Dex deployment configuration
344c329 
This commit adds the following:

Adds Dex Image to the buildchain

Adds method to obtain OIDC service IP and binds this
static IP as the ClusterIP address for Dex service

Adds `metalk8-auth` namespace which holds OIDC/authentication
cluster resources(PODS)

Automatically generate Dex deployment, service account,
cluster role and clusterrolebindings

The Dex chart.sls is generated from the Helm charts using:

```
$ ./charts/render.py dex metalk8s-auth charts/dex.yaml charts/dex/ >
salt/metalk8s/addons/dex/deployed/chart.sls

Add states to deploy Dex and related server certificates

Closes: #2007
Closes: #2011
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Ebaneck Ebaneck

Labels
complexity:medium Something that requires one or few days to fix topic:authentication Anything related to user authentication topic:operations Operations-related issues
Projects
None yet
Milestone
MetalK8s 2.6.0
Development

No branches or pull requests
3 participants
@NicolasT @Ebaneck @gdemonet