Skip to content

Commit ea4b89b

Browse files
author
Simone Bruzzese
committed
Moved pomerium from ingress module
1 parent d0f0a80 commit ea4b89b

File tree

12 files changed

+450
-0
lines changed

12 files changed

+450
-0
lines changed

‎LICENSE

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
BSD 3-Clause License
2+
3+
Copyright (c) 2022, SIGHUP
4+
All rights reserved.
5+
6+
Redistribution and use in source and binary forms, with or without
7+
modification, are permitted provided that the following conditions are met:
8+
9+
* Redistributions of source code must retain the above copyright notice, this
10+
list of conditions and the following disclaimer.
11+
12+
* Redistributions in binary form must reproduce the above copyright notice,
13+
this list of conditions and the following disclaimer in the documentation
14+
and/or other materials provided with the distribution.
15+
16+
* Neither the name of the copyright holder nor the names of its
17+
contributors may be used to endorse or promote products derived from
18+
this software without specific prior written permission.
19+
20+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
21+
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22+
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
23+
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
24+
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25+
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
26+
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27+
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28+
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

‎README.md

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
<h1>
2+
<img src="https://github.com/sighupio/fury-distribution/blob/master/docs/assets/fury-epta-white.png?raw=true" align="left" width="90" style="margin-right: 15px"/>
3+
Kubernetes Fury Auth
4+
</h1>
5+
6+
![Release](https://img.shields.io/github/v/release/sighupio/fury-kubernetes-auth?label=Latest%20Release)
7+
![License](https://img.shields.io/github/license/sighupio/fury-kubernetes-auth?label=License)
8+
![Slack](https://img.shields.io/badge/slack-@kubernetes/fury-yellow.svg?logo=slack&label=Slack)
9+
10+
<!-- <KFD-DOCS> -->
11+
**Kubernetes Fury Auth** provides Authentication Management for [Kubernetes Fury Distribution (KFD)][kfd-repo].
12+
13+
If you are new to KFD please refer to the [official documentation][kfd-docs] on how to get started with KFD.
14+
15+
## Overview
16+
17+
**Kubernetes Fury Auth** use CNCF recommended, Cloud Native projects, such as [Pomerium][pomerium-repo], an identity-aware proxy that enables secure access to internal applications.
18+
19+
## Packages
20+
21+
Kubernetes Fury Auth provides the following packages:
22+
23+
| Package | Version | Description |
24+
|--------------------------------------------|-----------|-------------------------------------------------------------------------------------------------------------------------------|
25+
| [pomerium](katalog/pomerium) | `v0.15.8` | Identity-aware proxy that enables secure access to internal applications. |
26+
27+
## Compatibility
28+
29+
| Kubernetes Version | Compatibility | Notes |
30+
| ------------------ | :----------------: | --------------------------------------------------- |
31+
| `1.20.x` | :white_check_mark: | No known issues |
32+
| `1.21.x` | :white_check_mark: | No known issues |
33+
| `1.22.x` | :white_check_mark: | No known issues |
34+
| `1.23.x` | :warning: | Conformance tests passed. Not officially supported. |
35+
36+
Check the [compatibility matrix][compatibility-matrix] for additional informations about previous releases of the modules.
37+
38+
## Usage
39+
40+
### Prerequisites
41+
42+
| Tool | Version | Description |
43+
|-----------------------------------------|------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|
44+
| [furyctl][furyctl-repo] | `>=0.6.0` | The recommended tool to download and manage KFD modules and their packages. To learn more about `furyctl` read the [official documentation][furyctl-repo]. |
45+
| [kustomize][kustomize-repo] | `>=3.5.0` | Packages are customized using `kustomize`. To learn how to create your customization layer with `kustomize`, please refer to the [repository][kustomize-repo]. |
46+
47+
### Deployment
48+
49+
1. List the packages you want to deploy and their version in a `Furyfile.yml`:
50+
51+
```yaml
52+
bases:
53+
- name: auth/pomerium
54+
version: "v0.15.8"
55+
```
56+
57+
58+
> See `furyctl` [documentation][furyctl-repo] for additional details about `Furyfile.yml` format.
59+
60+
2. Execute `furyctl vendor -H` to download the packages
61+
62+
3. Inspect the download packages under `./vendor/katalog/auth/`.
63+
64+
4. Define a `kustomization.yaml` that includes the `./vendor/katalog/auth` directory as resource.
65+
66+
```yaml
67+
resources:
68+
- ./vendor/katalog/auth
69+
```
70+
71+
5. To deploy the packages to your cluster, execute:
72+
73+
```bash
74+
kustomize build . | kubectl apply -f -
75+
```
76+
77+
<!-- Links -->
78+
[furyctl-repo]: https://github.com/sighupio/furyctl
79+
[sighup-page]: https://sighup.io
80+
[kfd-repo]: https://github.com/sighupio/fury-distribution
81+
[kustomize-repo]: https://github.com/kubernetes-sigs/kustomize
82+
[kfd-docs]: https://docs.kubernetesfury.com/docs/distribution/
83+
[compatibility-matrix]: https://github.com/sighupio/fury-kubernetes-auth/blob/master/docs/COMPATIBILITY_MATRIX.md
84+
[pomerium-repo]: https://github.com/pomerium/pomerium
85+
<!-- </KFD-DOCS> -->
86+
87+
<!-- <FOOTER> -->
88+
## Contributing
89+
90+
Before contributing, please read first the [Contributing Guidelines](docs/CONTRIBUTING.md).
91+
92+
### Reporting Issues
93+
94+
In case you experience any problem with the module, please [open a new issue](https://github.com/sighupio/fury-kubernetes-auth/issues/new/choose).
95+
96+
## License
97+
98+
This module is open-source and it's released under the following [LICENSE](LICENSE)
99+
<!-- </FOOTER> -->

‎katalog/pomerium/README.md

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# Pomerium
2+
3+
<!-- <KFD-DOCS> -->
4+
5+
Pomerium is an identity-aware proxy that enables secure access to internal applications. Pomerium provides a standardized interface to add access control to applications regardless of whether the application itself has authorization or authentication baked-in
6+
7+
## Pomerium Setup
8+
9+
This document is intended to give a brief overview on how Pomerium can be implemented, for further details, please look at the [official documentation][pomerium-docs].
10+
11+
## Deploy
12+
13+
The base kustomization file present [here](./kustomization.yaml) allows to quickly integrate this service with an existing Dex service, that could, for example, be connected to LDAP.
14+
15+
> See [Dex official documentation][dex-docs] for more details.
16+
17+
In order to do so, you will need to edit your Dex configuration, adding a static client to be used by Pomerium, like in the example below:
18+
19+
```yaml
20+
>>staticClients:
21+
- id: "pomerium-auth-client"
22+
secret: "your-super-secret"
23+
name: "Pomerium"
24+
redirectURIs:
25+
- "https://pomerium.example.com/oauth2/callback"
26+
```
27+
28+
Configure the `redirectURIs` section accordingly to the hosts used for the pomerium ingress.
29+
30+
Once dex is configured correctly, you will need to ovverride the configuration example ([policy](./config/policy.example.yaml) and environment variables via a [configmap](./config/config.example.env) and [secret](secrets/pomerium.example.env)) like in the example below:
31+
32+
```yaml
33+
configMapGenerator:
34+
- name: pomerium-policy
35+
behavior: replace
36+
files:
37+
- policy.yml=config/pomerium-policy.yml
38+
- name: pomerium
39+
behavior: replace
40+
envs:
41+
- config/pomerium-config.env
42+
43+
secretGenerator:
44+
- name: pomerium-env
45+
behavior: replace
46+
envs:
47+
- secrets/pomerium.env
48+
```
49+
50+
Just copy the examples in the module and override them according to your settings.
51+
52+
**⚠ WARNING: in the policy file, you'll need to set up a policy for each ingress you want to protect with Pomerium authorization service.**
53+
54+
## Ingresses
55+
56+
Once Pomerium and Dex are correctly configured, the last step is to add annotations to the ingresses you've added previously in the policy yaml file:
57+
58+
```yaml
59+
---
60+
apiVersion: networking.k8s.io/v1beta1
61+
kind: Ingress
62+
metadata:
63+
annotations:
64+
forecastle.stakater.com/expose: "true"
65+
forecastle.stakater.com/appName: "Prometheus"
66+
forecastle.stakater.com/icon: "https://github.com/stakater/ForecastleIcons/raw/master/prometheus.png"
67+
kubernetes.io/ingress.class: "internal"
68+
kubernetes.io/tls-acme: "true"
69+
# authentication annotations
70+
nginx.ingress.kubernetes.io/auth-url: "https://pomerium.example.com/verify?uri=$scheme://$host$request_uri"
71+
nginx.ingress.kubernetes.io/auth-signin: "https://pomerium.example.com/?uri=$scheme://$host$request_uri"
72+
name: prometheus
73+
namespace: monitoring
74+
spec:
75+
rules:
76+
- host: prometheus.example.com
77+
http:
78+
paths:
79+
- path: /
80+
backend:
81+
service:
82+
name: prometheus-k8s
83+
port:
84+
name: web
85+
tls:
86+
- hosts:
87+
- prometheus.example.com
88+
secretName: prometheus-tls
89+
```
90+
91+
Now if you'll try to reach the `prometheus.example.com` you'll be forwarded to the dex login page accordingly with the rules set in your policy. Enjoy!
92+
93+
<!-- Links -->
94+
[pomerium-docs]: https://www.pomerium.io/docs/
95+
[dex-docs]: https://dexidp.io/docs/kubernetes/
96+
97+
<!-- </KFD-DOCS> -->

‎katalog/pomerium/config/config.example.env

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
AUTHENTICATE_SERVICE_HOST=pomerium.example.com
2+
AUTHENTICATE_SERVICE_URL=https://$(AUTHENTICATE_SERVICE_HOST)
3+
FORWARD_AUTH_HOST=pomerium.example.com
4+
FORWARD_AUTH_URL=https://$(FORWARD_AUTH_HOST)
5+
# IDP_CLIENT_ID is the name of the staticClient in Dex
6+
IDP_CLIENT_ID=pomerium-auth-client
7+
# See https://docs.pomerium.io/configuration/#identity-provider-name
8+
IDP_PROVIDER=oidc
9+
# IDP_PROVIDER_URL is the url of dex ingress
10+
IDP_PROVIDER_URL=https://dex.example.com/
11+
IDP_SCOPES=openid profile email offline_access groups
12+
# used by `ingress.yaml` by default.

‎katalog/pomerium/config/policy.example.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Copyright (c) 2021 SIGHUP s.r.l All rights reserved.
2+
# Use of this source code is governed by a BSD-style
3+
# license that can be found in the LICENSE file.
4+
5+
address: ":8080"
6+
metrics_address: ":9090"
7+
grcp_address: ":8080"
8+
9+
# this is set because the service is behind an ssl ingress
10+
insecure_server: true
11+
autocert: false
12+
13+
policy:
14+
# from and to should be set to the prometheus ingress
15+
- from: https://prometheus.example.com
16+
to: https://prometheus.example.com
17+
allowed_idp_claims:
18+
groups:
19+
# ldap groups configured in dex
20+
- group1
21+
- group2

‎katalog/pomerium/deploy.yml

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Copyright (c) 2021 SIGHUP s.r.l All rights reserved.
2+
# Use of this source code is governed by a BSD-style
3+
# license that can be found in the LICENSE file.
4+
5+
apiVersion: apps/v1
6+
kind: Deployment
7+
metadata:
8+
name: pomerium
9+
10+
spec:
11+
replicas: 1
12+
template:
13+
spec:
14+
containers:
15+
- name: pomerium
16+
image: pomerium/pomerium
17+
ports:
18+
- containerPort: 8080
19+
name: http
20+
protocol: TCP
21+
args:
22+
- -config
23+
- /etc/pomerium/policy.yml
24+
envFrom:
25+
- secretRef:
26+
name: pomerium-env
27+
- configMapRef:
28+
name: pomerium
29+
env:
30+
- name: SERVICES
31+
value: all
32+
- name: INSECURE_SERVER
33+
value: "TRUE"
34+
- name: JWT_CLAIMS_HEADERS
35+
value: "email"
36+
- name: LOG_LEVEL
37+
value: "debug"
38+
- name: PROXY_LOG_LEVEL
39+
value: "debug"
40+
- name: POMERIUM_DEBUG
41+
value: "true"
42+
livenessProbe:
43+
failureThreshold: 3
44+
httpGet:
45+
path: /ping
46+
port: 8080
47+
scheme: HTTP
48+
initialDelaySeconds: 10
49+
timeoutSeconds: 1
50+
readinessProbe:
51+
httpGet:
52+
path: /ping
53+
port: 8080
54+
scheme: HTTP
55+
resources:
56+
limits:
57+
cpu: 500m
58+
memory: 256Mi
59+
requests:
60+
cpu: 100m
61+
memory: 128Mi
62+
volumeMounts:
63+
- mountPath: /etc/pomerium/
64+
name: pomerium-policy
65+
volumes:
66+
- configMap:
67+
defaultMode: 420
68+
name: pomerium-policy
69+
name: pomerium-policy

‎katalog/pomerium/ingress.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Copyright (c) 2021 SIGHUP s.r.l All rights reserved.
2+
# Use of this source code is governed by a BSD-style
3+
# license that can be found in the LICENSE file.
4+
5+
apiVersion: networking.k8s.io/v1
6+
kind: Ingress
7+
metadata:
8+
name: pomerium
9+
annotations:
10+
forecastle.stakater.com/expose: "true"
11+
forecastle.stakater.com/appName: "Pomerium"
12+
forecastle.stakater.com/icon: "https://pbs.twimg.com/profile_images/1161448498849390592/fJZaKEGR.png"
13+
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
14+
nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
15+
kubernetes.io/tls-acme: "true"
16+
spec:
17+
ingressClassName: internal
18+
rules:
19+
- host: $(AUTHENTICATE_SERVICE_HOST)
20+
http:
21+
paths:
22+
- path: /
23+
pathType: Prefix
24+
backend:
25+
service:
26+
name: pomerium
27+
port:
28+
number: 80
29+
tls:
30+
- hosts:
31+
- $(AUTHENTICATE_SERVICE_HOST)
32+
secretName: pomerium-tls

0 commit comments

Comments
 (0)