Skip to content
This repository was archived by the owner on Jan 9, 2023. It is now read-only.

Commit 2a67652

Browse files
jetstack-botjetstack-bot
authored
Merge pull request #782 from SecOpsLimited/aws-iam-authenticator-init
Adds aws-iam-authenticator initialisation and instructions
2 parents 79e9971 + 1922892 commit 2a67652

15 files changed

+408
-8
lines changed

‎docs/examples/aws-iam-authenticator.rst

+136
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
AWS IAM Authenticator
2+
---------------------
3+
4+
`AWS IAM Authenticator <https://github.com/kubernetes-sigs/aws-iam-authenticator>`_ is a daemon that lets you authenticate to the
5+
Kubernetes RBAC system via Amazon Web Services - Identity and Access Management users and roles
6+
7+
You can initialise the cluster to use this with the following configuration snippet in tarmak.yaml:
8+
9+
.. code-block:: yaml
10+
11+
...
12+
kubernetes:
13+
apiServer:
14+
amazon:
15+
awsIAMAuthenticatorInit: true
16+
...
17+
18+
You can configure the IAM authenticator server with the following config map and daemonset,
19+
replacing ``000000000000`` with your AWS account ID and ``your-tarmak-cluster`` with your cluster name,
20+
including the ``-cluster`` suffix in a single cluster environment:
21+
22+
.. code-block:: yaml
23+
24+
apiVersion: v1
25+
kind: ConfigMap
26+
metadata:
27+
namespace: kube-system
28+
name: aws-iam-authenticator
29+
labels:
30+
k8s-app: aws-iam-authenticator
31+
data:
32+
config.yaml: |
33+
# a unique-per-cluster identifier to prevent replay attacks
34+
# (good choices are a random token or a domain name that will be unique to your cluster)
35+
clusterID: your-tarmak-cluster
36+
server:
37+
mapRoles:
38+
# statically map arn:aws:iam::<your account id>:role/KubernetesAdmin to a cluster admin
39+
- roleARN: arn:aws:iam::000000000000:role/KubernetesAdmin
40+
username: kubernetes-admin
41+
groups:
42+
- system:masters
43+
---
44+
apiVersion: extensions/v1beta1
45+
kind: DaemonSet
46+
metadata:
47+
namespace: kube-system
48+
name: aws-iam-authenticator
49+
labels:
50+
k8s-app: aws-iam-authenticator
51+
spec:
52+
updateStrategy:
53+
type: RollingUpdate
54+
template:
55+
metadata:
56+
annotations:
57+
scheduler.alpha.kubernetes.io/critical-pod: ""
58+
labels:
59+
k8s-app: aws-iam-authenticator
60+
spec:
61+
# run on the host network (don't depend on CNI)
62+
hostNetwork: true
63+
# run on each master node
64+
nodeSelector:
65+
node-role.kubernetes.io/master: ""
66+
tolerations:
67+
- effect: NoSchedule
68+
key: node-role.kubernetes.io/master
69+
- key: CriticalAddonsOnly
70+
operator: Exists
71+
containers:
72+
- name: aws-iam-authenticator
73+
image: 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-iam-authenticator:v0.4.0-scratch
74+
args:
75+
- server
76+
- --config=/etc/aws-iam-authenticator/config.yaml
77+
- --state-dir=/var/aws-iam-authenticator
78+
- --generate-kubeconfig=/etc/kubernetes/aws-iam-authenticator/kubeconfig.yaml
79+
- --kubeconfig-pregenerated=true
80+
resources:
81+
requests:
82+
memory: 20Mi
83+
cpu: 10m
84+
limits:
85+
memory: 20Mi
86+
cpu: 100m
87+
securityContext:
88+
privileged: true
89+
volumeMounts:
90+
- name: config
91+
mountPath: /etc/aws-iam-authenticator/
92+
- name: state
93+
mountPath: /var/aws-iam-authenticator/
94+
securityContext:
95+
fsGroup: 0
96+
runAsUser: 0
97+
volumes:
98+
- name: config
99+
configMap:
100+
name: aws-iam-authenticator
101+
- name: state
102+
hostPath:
103+
path: /var/aws-iam-authenticator/
104+
105+
You can then authenticate to the cluster with e.g. the following, as long as aws-iam-authenticator is
106+
downloaded and on your path:
107+
108+
.. code-block:: yaml
109+
110+
apiVersion: v1
111+
clusters:
112+
- cluster:
113+
certificate-authority-data: <snip - get these from ~/.tarmak/your-cluster/kubeconfig>
114+
server: https://api.your-cluster.somedomain.io ##see above
115+
name: your-cluster
116+
contexts:
117+
- context:
118+
cluster: your-cluster
119+
namespace: default
120+
user: your-cluster
121+
name: your-cluster
122+
users:
123+
- name: your-cluster
124+
user:
125+
exec:
126+
apiVersion: client.authentication.k8s.io/v1alpha1
127+
args:
128+
- token
129+
- -i
130+
- your-cluster ##change me
131+
- -r
132+
- arn:aws:iam::000000000000:role/KubernetesAdmin ##change me
133+
command: aws-iam-authenticator-aws
134+
env:
135+
- name: AWS_PROFILE
136+
value: your_profile ##change or remove me

‎docs/generated/reference/output/api-docs.html

+9-1
Original file line numberDiff line numberDiff line change
@@ -919,7 +919,11 @@ <h2 id="clusterkubernetesapiserver-v1alpha1">ClusterKubernetesAPIServer v1alpha1
919919
</tr>
920920
<tr>
921921
<td><code>amazon</code><br /> <em><a href="#clusterkubernetesapiserveramazon-v1alpha1">ClusterKubernetesAPIServerAmazon</a></em></td>
922-
<td>AWS specifc options</td>
922+
<td>AWS specific options</td>
923+
</tr>
924+
<tr>
925+
<td><code>authTokenWebhookFile</code><br /> <em>string</em></td>
926+
<td></td>
923927
</tr>
924928
<tr>
925929
<td><code>disableAdmissionControllers</code><br /> <em>string array</em></td>
@@ -976,6 +980,10 @@ <h2 id="clusterkubernetesapiserveramazon-v1alpha1">ClusterKubernetesAPIServerAma
976980
</thead>
977981
<tbody>
978982
<tr>
983+
<td><code>awsIAMAuthenticatorInit</code><br /> <em>boolean</em></td>
984+
<td></td>
985+
</tr>
986+
<tr>
979987
<td><code>internalELBAccessLogs</code><br /> <em><a href="#clusterkubernetesapiserveramazonaccesslogs-v1alpha1">ClusterKubernetesAPIServerAmazonAccessLogs</a></em></td>
980988
<td></td>
981989
</tr>

‎docs/spelling_wordlist.txt

+29
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,18 @@ amoungst
66
ansible
77
api
88
apiserver
9+
Appscode
910
attestor
1011
auth
12+
authenticator
13+
Authenticator
14+
authorisation
1115
authorization
1216
authz
1317
autoscale
1418
autoscaler
1519
autoscaling
20+
aws
1621
backend
1722
backends
1823
calico
@@ -24,13 +29,18 @@ Config
2429
configmap
2530
cryptographic
2631
ctrl
32+
customise
33+
customised
34+
customisation
35+
daemonset
2736
doesn
2837
EBS
2938
ec
3039
ecdsa
3140
Elasticsearch
3241
env
3342
etcd
43+
favour
3444
fluentbit
3545
Gi
3646
gid
@@ -45,6 +55,9 @@ heptio
4555
hostname
4656
iam
4757
init
58+
initialise
59+
Initialise
60+
initialised
4861
initialize
4962
initializers
5063
io
@@ -57,6 +70,8 @@ kubeconfig
5770
kubectl
5871
kubelet
5972
kubernetes
73+
licence
74+
license
6075
lifecycle
6176
localhost
6277
login
@@ -66,6 +81,7 @@ macOS
6681
masterless
6782
millicores
6883
minio
84+
modelling
6985
multi
7086
nameservers
7187
namespace
@@ -75,6 +91,9 @@ nistp
7591
offline
7692
oneshot
7793
ons
94+
optimise
95+
optimised
96+
optimisation
7897
overprovisioning
7998
pki
8099
plugable
@@ -85,18 +104,25 @@ postgresql
85104
preempted
86105
prepended
87106
prometheus
107+
realise
108+
realised
109+
recognise
110+
recognised
88111
refactoring
89112
ReplicaSet
90113
rolename
91114
runtime
92115
setup
93116
sha
94117
stateful
118+
standardised
95119
stdin
96120
subcommand
97121
subdomain
98122
subtree
99123
subtrees
124+
summarises
125+
synchronised
100126
systemd
101127
tarmak
102128
templating
@@ -105,11 +131,14 @@ testability
105131
Todo
106132
toolkit
107133
ttl
134+
tunnelling
108135
typha
109136
ubuntu
110137
uid
111138
unsealer
112139
username
113140
velero
141+
webhook
142+
Webhook
114143
wrt
115144
yaml

‎docs/user-guide.rst

+33
Original file line numberDiff line numberDiff line change
@@ -458,6 +458,24 @@ The following `tarmak.yaml` snippet shows how to enable encrypted EBS.
458458
ebsEncrypted: true
459459
...
460460
461+
IAM Authentication
462+
~~~~~~~~~~~~~~~~~~
463+
464+
Tarmak supports authentication using aws-iam-authenticator. You can enable this using the following
465+
snippet, although this doesn't deploy the authenticator to the cluster - this will need configuring
466+
for your environment using the instructions on `github <https://github.com/kubernetes-sigs/aws-iam-authenticator>`_.
467+
Effectively, the snippet below performs steps 2 and 3 of these instructions for you.
468+
469+
.. code-block:: yaml
470+
471+
kubernetes:
472+
apiServer:
473+
amazon:
474+
awsIAMAuthenticatorInit: true
475+
...
476+
477+
See the examples section for yaml files to configure the authenticator daemon set, config map and kubeconfig.
478+
461479
OIDC Authentication
462480
~~~~~~~~~~~~~~~~~~~
463481

@@ -640,6 +658,21 @@ This can be used together with `Secure public endpoints <user-guide.html#secure-
640658
apiServer:
641659
public: true
642660
661+
Authenticator Token Webhook file
662+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
663+
664+
You can configure an authentication token webhook for the apiserver - this is the path to the file
665+
containing said configuration. There is a *default* value for this if using the aws-iam-authenticator,
666+
but if you are customising this component, or using an alternative webhook authentication system (e.g.
667+
Appscode Guard) you can set / override it here as appropriate. The file must exist for the apiserver
668+
to start up.
669+
670+
.. code-block:: yaml
671+
672+
kubernetes:
673+
apiServer:
674+
authTokenWebhookFile: /etc/kubernetes/shiny-new-authenticator/kubeconfig.yaml
675+
643676
Secure public endpoints
644677
~~~~~~~~~~~~~~~~~~~~~~~
645678

‎docs/vault-setup-config.rst

+2-2
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ Init Tokens
4545
Tokens are used as the main authentication method in Vault and provide a
4646
mapping to one or more policies. On first boot, each instance generates their
4747
own unique token via a given token - the init token. These init-tokens are role
48-
dependant meaning the same init-token is shared with instances only with the
48+
dependent meaning the same init-token is shared with instances only with the
4949
same role. Once generated, the init token is erased by all instances in favour
5050
of their own new unique token making the init token no longer accessible on any
5151
instance. Unlike the init-tokens, generated tokens are short lived and so need
@@ -64,7 +64,7 @@ requirements of the policy - if successful, returns a signed certificate.
6464
Instances can only obtain certificates from CSRs because of the permissions
6565
that its unique token provides. Upon receiving, the instance will store the
6666
signed certificate locally to be shared with its relevant services and start or
67-
restart all services which are dependant.
67+
restart all services which are dependent.
6868

6969
Expiration of Tokens and Certificates
7070
-------------------------------------

‎pkg/apis/cluster/v1alpha1/cluster.go

+6-3
Original file line numberDiff line numberDiff line change
@@ -152,9 +152,11 @@ type ClusterKubernetesAPIServer struct {
152152
// OIDC
153153
OIDC *ClusterKubernetesAPIServerOIDC `json:"oidc,omitempty"`
154154

155-
// AWS specifc options
155+
// AWS specific options
156156
Amazon *ClusterKubernetesAPIServerAmazon `json:"amazon,omitempty"`
157157

158+
AuthTokenWebhookFile string `json:"authTokenWebhookFile,omitempty"`
159+
158160
FeatureGates map[string]bool `json:"featureGates,omitempty"`
159161
}
160162

@@ -194,8 +196,9 @@ type ClusterKubernetesAPIServerOIDC struct {
194196
}
195197

196198
type ClusterKubernetesAPIServerAmazon struct {
197-
PublicELBAccessLogs *ClusterKubernetesAPIServerAmazonAccessLogs `json:"publicELBAccessLogs,omitempty"`
198-
InternalELBAccessLogs *ClusterKubernetesAPIServerAmazonAccessLogs `json:"internalELBAccessLogs,omitempty"`
199+
PublicELBAccessLogs *ClusterKubernetesAPIServerAmazonAccessLogs `json:"publicELBAccessLogs,omitempty"`
200+
InternalELBAccessLogs *ClusterKubernetesAPIServerAmazonAccessLogs `json:"internalELBAccessLogs,omitempty"`
201+
AwsIAMAuthenticatorInit bool `json:"awsIAMAuthenticatorInit,omitempty"`
199202
}
200203

201204
type ClusterKubernetesAPIServerAmazonAccessLogs struct {

‎pkg/puppet/puppet.go

+8
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,14 @@ func kubernetesClusterConfig(conf *clusterv1alpha1.ClusterKubernetes, hieraData
165165
}
166166
}
167167

168+
if conf.APIServer != nil && conf.APIServer.AuthTokenWebhookFile != "" {
169+
hieraData.variables = append(hieraData.variables, fmt.Sprintf(`kubernetes::apiserver::auth_token_webhook_file: "%s"`, conf.APIServer.AuthTokenWebhookFile))
170+
}
171+
172+
if conf.APIServer != nil && conf.APIServer.Amazon != nil && conf.APIServer.Amazon.AwsIAMAuthenticatorInit {
173+
hieraData.variables = append(hieraData.variables, "kubernetes::apiserver::aws_iam_authenticator_init: true")
174+
}
175+
168176
if conf.PodSecurityPolicy != nil {
169177
if conf.PodSecurityPolicy.Enabled {
170178
hieraData.variables = append(hieraData.variables, fmt.Sprintf(`tarmak::kubernetes_pod_security_policy: true`))

0 commit comments

Comments
 (0)