Skip to content

Commit f21909f

Browse files
bglynnorishoshan
bglynn
and
orishoshan
authored
Doc restructuring (#196)
Co-authored-by: Ori Shoshan <[email protected]>
1 parent e4e6167 commit f21909f

File tree

79 files changed

+3198
-1204
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

79 files changed

+3198
-1204
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,4 @@ yarn-error.log*
2121

2222
.idea
2323
package-lock.json
24+
.vercel

‎docs/concepts/_category_.json

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎docs/features/README.mdx

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
sidebar_position: 1
3+
title: Features
4+
hide_title: true
5+
---
6+
7+
8+
import {
9+
useCurrentSidebarCategory
10+
} from '@docusaurus/theme-common';
11+
12+
13+
14+
export default function FeatureCards() {
15+
const category = useCurrentSidebarCategory();
16+
const features = category.items;
17+
console.log(JSON.stringify(features));
18+
return (
19+
<div className="tw-m-8">
20+
<h1 className="tw-text-2xl tw-font-medium">Features</h1>
21+
<p className="tw-">
22+
Otterize makes it easy to create and visualize authorization for your Kubernetes clusters across a
23+
variety of
24+
services. Explore each below.
25+
</p>
26+
<div role="list" className="tw-grid tw-gap-6 tw-grid-cols-3">
27+
{features.map((feature) => (
28+
<div key={feature.label}
29+
className="tw-col-span-1 tw-flex tw-flex-col tw-divide-y tw-divide-gray-200 tw-rounded-lg tw-border tw-border-solid tw-border-primary-500 tw-bg-white tw-text-center tw-border-1 tw-border-primary-400 tw-border-solid hover:tw-border-primary-600 hover:tw-shadow-md">
30+
<a href={feature.href} className="hover:tw-no-underline hover:tw-font-extrabold">
31+
<div className="tw-flex tw-flex-1 tw-flex-col tw-p-8">
32+
<div
33+
className=" tw-flex tw-max-h-16 tw-h-16 tw-w-full text-center tw-justify-center ">
34+
{feature.customProps && feature.customProps.image &&
35+
<img className="justify-self-center tw-max-h-16"
36+
src={feature.customProps.image}
37+
alt=""/>
38+
}
39+
</div>
40+
<h3 className="tw-mt-6 tw-text-lg tw-font-semibold tw-text-gray-black">{feature.label}</h3>
41+
</div>
42+
</a>
43+
</div>
44+
))}
45+
</div>
46+
</div>
47+
)
48+
}
49+
50+
51+
52+
53+
54+

‎docs/features/_category_.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"label": "Features",
3+
"position": 3,
4+
"collapsed": false,
5+
"customProps": {
6+
"image": "/img/icons/aws.png"
7+
}
8+
}

‎docs/features/aws-iam/_category_.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"label": "AWS IAM",
3+
"position": 2,
4+
"collapsed": true,
5+
"customProps": {
6+
"image": "/img/icons/aws.png"
7+
}
8+
}

‎docs/features/aws-iam/index.mdx

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
sidebar_position: 1
3+
title: AWS IAM | Overview
4+
hide_table_of_contents: true
5+
hide_title: true
6+
---
7+
8+
import DocsLinkCard from "@site/src/components/LinkCard";
9+
10+
export const tutorials = [
11+
{
12+
title: 'Automate AWS IAM for EKS',
13+
description: 'Create just-in-time AWS IAM roles and policies that are kept in sync with your workloads',
14+
url: 'aws-iam/tutorials/aws-iam-eks'
15+
},
16+
];
17+
18+
19+
# AWS IAM
20+
21+
Otterize can create just-in-time AWS IAM roles and policies for your workloads running on EKS Kubernetes clusters, greatly simplifying the lifecycle of managing IAM roles and policies.
22+
23+
### Tutorials
24+
25+
To learn how to use the Intents Operator and Credentials Operator to manage just-in-time AWS IAM access, check out the tutorial.
26+
<DocsLinkCard items={tutorials} colSize={"sm"}/>
27+
28+
29+
### How does Otterize work with AWS IAM?
30+
31+
1. First, the EKS cluster must have [Otterize installed](/overview/installation).
32+
2. To have a role created for a pod, label the pod with `credentials-operator.otterize.com/create-aws-role: "true"`
33+
3. The credentials operator will create a role and an `AssumeRolePolicy` (trust relationship) bound to the pod's ServiceAccount. The ServiceAccount will be annotated automatically.
34+
4. At this point, the pod is able to assume the role, but role does not have the ability to perform any actions. We will need to create a ClientIntents YAML for the access the service requires and apply it to our cluster. Below is an example of a ClientIntents file for accessing an S3 bucket. View the [reference](/features/aws-iam/reference) to learn more about the AWS IAM ClientIntents syntax.
35+
5. Once the intent is applied, the intents operator will create a new policy, which will be attached to the service’s role with the appropriate access.
36+
6. Done!
37+
38+
```yaml
39+
apiVersion: k8s.otterize.com/v1alpha3
40+
kind: ClientIntents
41+
metadata:
42+
name: server
43+
spec:
44+
service:
45+
name: server
46+
calls:
47+
- name: arn:aws:s3:::example-bucket-*/*
48+
type: aws
49+
awsActions:
50+
- "s3:PutObject"
51+
- "s3:GetObject"
52+
```
53+
54+
### Automatically generating ClientIntents for AWS IAM
55+
56+
Figuring out which access you need for AWS can be a painful, trial and error process, and something you _must_ do if you're tightening production access.
57+
58+
Otterize is getting ready to release support for using existing traffic to generate least-privilege IAM policies. Keen to try this out as part of early access? Sign up to the [Early Access Beta Program](https://otterize.com/EarlyAccessBetaProgram) and we'll be in touch!
59+

‎docs/features/aws-iam/reference.mdx

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
sidebar_position: 3
3+
title: Reference
4+
---
5+
6+
### ClientIntents example (YAML)
7+
8+
```yaml
9+
apiVersion: k8s.otterize.com/v1alpha3
10+
kind: ClientIntents
11+
metadata:
12+
name: server
13+
spec:
14+
service:
15+
# The name of the pod that will be granted access
16+
name: server
17+
calls:
18+
# The AWS ARN or ARN wildcard that references the resource(s) for the authorization
19+
- name: arn:aws:s3:::example-bucket-*/*
20+
type: aws
21+
# one or more AWS Actions or Action wildcards that will be provided to the specified resources
22+
awsActions:
23+
- "s3:PutObject"
24+
- "s3:GetObject"
25+
# Multiple call definitions can be defined for a single service.
26+
- name: arn:aws:s3:::read-only-bucket-*/*
27+
type: aws
28+
awsActions:
29+
- "s3:GetObject"
30+
```
31+
32+
### Annotations
33+
34+
| Key | Description | Default |
35+
|------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|
36+
| `credentials-operator.otterize.com/create-aws-role` | By setting to **true** the credential operator will create an unique AWS Role for the associated pod | `false` |
37+
38+
39+
### Helm Chart options
40+
41+
| Key | Description | Default |
42+
|------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|
43+
| `global.aws.enabled` | Enable or disable AWS integration | `false` |
44+
| `global.aws.eksClusterNameOverride` | EKS cluster name (overrides auto-detection) | `(none)` |
45+
| `aws.roleARN` | ARN of the AWS role the operator will use to access AWS. By defeault, Otterize will create a unique role for each service an annotate the service with the role's ARN. | `(none)` |
46+
47+
View the [Helm chart reference](/reference/configuration/otterize-chart) for all other options

‎docs/quickstart/visualization/_category_.json renamed to ‎docs/features/aws-iam/tutorials/_category_.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"label": "Visualization",
2+
"label": "Tutorials",
33
"position": 2,
44
"collapsed": false
55
}

‎docs/quickstart/access-control/aws-iam-eks.mdx renamed to ‎docs/features/aws-iam/tutorials/aws-iam-eks.mdx

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ In this tutorial, we will:
1818
## Prerequisites
1919
Already have Otterize deployed with the IAM integration configured on your cluster? [Skip to the tutorial.](#tutorial)
2020

21-
#### 1. Create an AWS EKS cluster
21+
### 1. Create an AWS EKS cluster
2222
Before you start, you'll need an AWS EKS cluster. Any cluster will do; there are no special requirements or setup.
2323

2424
<details>
@@ -83,7 +83,7 @@ Don't forget to configure your kubeconfig for your cluster. If using the example
8383
aws eks update-kubeconfig --region us-west-2 --name otterize-iam-eks-tutorial
8484
```
8585

86-
#### 2. Deploy Otterize for AWS IAM
86+
### 2. Deploy Otterize for AWS IAM
8787
To deploy Otterize, head over to [Otterize Cloud](https://app.otterize.com) and:
8888

8989
1. Create a Kubernetes cluster on the [Integrations page](https://app.otterize.com/integrations), and follow the instructions. *Make sure to enable enforcement mode for this tutorial.* If you already have a Kubernetes cluster connected, skip this step.
@@ -185,7 +185,7 @@ kubectl patch deployment -n otterize-tutorial-iam server --type='json' -p="[{\"o
185185
<summary>Expand to see the deployment YAML</summary>
186186

187187
```yaml
188-
{@include: ../../../static/code-examples/aws-iam-eks/client-and-server.yaml}
188+
{@include: ../../../../static/code-examples/aws-iam-eks/client-and-server.yaml}
189189
```
190190

191191
</details>
@@ -285,7 +285,7 @@ By annotating the pod, we've created an IAM role. We now need to specify what we
285285
286286
We will specify the following ClientIntents, granting the PutObject permission to the `otterize-tutorial-bucket` S3 bucket.
287287
```yaml
288-
{@include: ../../../static/code-examples/aws-iam-eks/clientintents.yaml}
288+
{@include: ../../../../static/code-examples/aws-iam-eks/clientintents.yaml}
289289
```
290290

291291
To apply these intents, run the following command:
@@ -322,7 +322,7 @@ aws s3 ls $BUCKET_NAME
322322
2023-11-17 20:42:55 19 testfile.3.txt
323323
```
324324

325-
## What's next?
325+
### What's next?
326326

327327
Try out some of the other quick tutorials to learn about how to use ClientIntents to manage network policies, Istio policies, PostgreSQL access, and more. You can use a single ClientIntents resource to specify all the access required for a pod.
328328

‎docs/features/istio/_category_.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"label": "Istio",
3+
"position": 4,
4+
"collapsed": true,
5+
"customProps": {
6+
"image": "/img/icons/istio-no-word-mark.svg"
7+
}
8+
}

‎docs/features/istio/index.mdx

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
---
2+
sidebar_position: 1
3+
title: Istio | Overview
4+
hide_title: true
5+
---
6+
7+
import DocsLinkCard from "@site/src/components/LinkCard";
8+
9+
export const istio_tutorials = [
10+
{
11+
title: 'Istio AuthorizationPolicy automation',
12+
description: 'Generate AuthorizationPolicy docs from existing connections',
13+
url: 'istio/tutorials/k8s-istio-authorization-policies'
14+
},
15+
{
16+
title: 'Istio HTTP-level access mapping',
17+
description: 'Map access between services including HTTP paths and methods',
18+
url: 'istio/tutorials/k8s-istio-watcher'
19+
}
20+
];
21+
22+
23+
24+
# Istio
25+
26+
Otterize can build a map of your cluster based on Istio Envoy metrics, and enforce access between services using Istio Authorization Policies.
27+
28+
### Tutorials
29+
30+
To learn how to use the Intents Operator to enforce access using Istio authorization policies, or map your cluster, try one of these quickstart tutorials.
31+
32+
<DocsLinkCard items={istio_tutorials} colSize={"sm"}/>
33+
34+
35+
### How does Otterize work with Istio?
36+
37+
1. First, the cluster must have [Otterize installed](/overview/installation).
38+
2. To have Otterize generate Istio authorization policies, declare and apply ([IBAC](/overview/intent-based-access-control)) ClientIntents for your services.
39+
Once you do so, Otterize will generate an Istio authorization policy allowing access from the client service, identified by its ServiceAccount, to the server, identified by its labels.
40+
The HTTP Resources section in the ClientIntents is optional: if you do not specify it, all pod-to-pod access is allowed.
41+
42+
```yaml
43+
44+
apiVersion: k8s.otterize.com/v1alpha3
45+
kind: ClientIntents
46+
metadata:
47+
name: client
48+
namespace: otterize-tutorial-istio
49+
spec:
50+
service:
51+
name: client
52+
calls:
53+
- name: server-abc
54+
type: http
55+
HTTPResources:
56+
- path: /client-path
57+
methods: [ GET ]
58+
59+
```
60+
61+
3. If you would like Otterize to be able to autogenerate ClientIntents and map your network at the HTTP path and method level, we need to enable connection telemetry data within Istio. This can be enabled with the following YAML:
62+
63+
```yaml
64+
apiVersion: telemetry.istio.io/v1alpha1
65+
kind: Telemetry
66+
metadata:
67+
name: mesh-default
68+
namespace: istio-system
69+
spec:
70+
# Configure access logging for Istio services
71+
accessLogging:
72+
# Define the access logging provider, in this case, Envoy
73+
- providers:
74+
- name: envoy
75+
metrics:
76+
# Configure metrics collection for Istio services using Prometheus
77+
- providers:
78+
- name: prometheus
79+
# Customize metric tag overrides
80+
overrides:
81+
- tagOverrides:
82+
# Map the "request_method" metric tag to "request.method" value
83+
request_method:
84+
value: request.method
85+
# Map the "request_path" metric tag to "request.path" value
86+
request_path:
87+
value: request.path
88+
```
89+
90+
Or, as a ready-to-paste command:
91+
```
92+
kubectl apply -f ${ABSOLUTE_URL}/code-examples/network-mapper/istio-telemetry-enablement.yaml -n istio-system
93+
```
94+
95+
Once installed, Otterize will query Envoy sidecars for known connections and build an in-memory map of the relationships. After the map is built you can then view those relationships.
96+

‎docs/features/istio/reference.mdx

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
sidebar_position: 3
3+
title: Reference
4+
---
5+
6+
### ClientIntents example (YAML)
7+
8+
```yaml
9+
apiVersion: k8s.otterize.com/v1alpha3
10+
kind: ClientIntents
11+
metadata:
12+
name: client
13+
namespace: otterize-tutorial-istio
14+
spec:
15+
service:
16+
name: client
17+
calls:
18+
- name: nginx
19+
type: http
20+
HTTPResources:
21+
- path: /client-path
22+
methods: [ GET ]
23+
```
24+
25+
26+
### Helm Chart options
27+
28+
| Key | Description | Default |
29+
|---------------------------------|-----------------------------------------|--------------------------------|
30+
| `istiowatcher.enable` | Enable Istio watcher deployment (beta). | `false` |
31+
| `istiowatcher.image.repository` | Istio watcher image repository. | `otterize` |
32+
| `istiowatcher.image.image` | Istio watcher image. | `network-mapper-istio-watcher` |
33+
| `istiowatcher.image.tag` | Istio watcher image tag. | `latest` |
34+
| `istiowatcher.pullPolicy` | Istio watcher pull policy. | `(none)` |
35+
| `istiowatcher.pullSecrets` | Istio watcher pull secrets. | `(none)` |
36+
| `istiowatcher.resources` | Resources override. | `(none)` |
37+
38+
View the [Helm chart reference](/reference/configuration/otterize-chart) for all other options

‎docs/features/istio/tutorials/_category_.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"label": "Tutorials",
3+
"position": 2,
4+
"collapsed": false
5+
}

0 commit comments

Comments
 (0)