Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Demo scripts support Conjur OSS and annotation-based authn-k8s #106

Closed
diverdane opened this issue Sep 29, 2020 · 0 comments
Closed

Demo scripts support Conjur OSS and annotation-based authn-k8s #106

diverdane opened this issue Sep 29, 2020 · 0 comments

Comments

@diverdane
Copy link
Contributor

Is your feature request related to a problem? Please describe.

  • The demo scripts cannot be run directly on a Conjur cluster that has
    been deployed via Conjur OSS Helm chart. For the Conjur OSS Helm
    deployed scenario, there is some configuration that needs to be
    done that is normally done by the kubernetes-conjur-deploy
    scripts... however, we don't want to muck with the kubernetes-conjur-deploy
    scripts because those are widely used and we don't want to risk breakage.
    The bits of configuration that need to be added for Conjur OSS:
    • Loading of Conjur policies for the demo
    • Initialize the Conjur CA cert
    • Followers aren't available with Conjur OSS, so things normally done
      via followers needs to be done via the Conjur master.
  • The Conjur OSS helm charts don't deploy a Conjur CLI pod, so
    this needs to be added for Conjur OSS.
  • The demo scripts don't support the new style of authn-k8s annotation-based
    identities.

Describe the solution you would like

  • Support for Conjur OSS server that's been deployed via Helm chart
  • Have scripts look for a Conjur CLI pod, and create one if it doesn't exist.
  • Selectable configuration for Annotation-based authentication vs.
    host-ID-based authentication. (Select via boolean env variable.)

Describe alternatives you have considered

Additional context

@diverdane diverdane self-assigned this Sep 29, 2020
diverdane pushed a commit that referenced this issue Sep 29, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Sep 29, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Sep 29, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Sep 29, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 2, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 3, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 3, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 3, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 5, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 5, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 5, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 6, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 6, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 6, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 6, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 6, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 6, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 6, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 8, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 8, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 9, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 9, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 9, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 9, 2020
Work-in-Progress: Needs testing on minikube/Kind, OpenShift,
and with DAP/appliance image.

This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 9, 2020
This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 9, 2020
This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for both annotation-based and host-ID based identity authentication
  for GKE and OpenShift.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 9, 2020
This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for host-ID based identity authentication for GKE and OpenShift.
- CI for annotation based identity authentication for GKE.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 19, 2020
This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for host-ID based identity authentication for GKE and OpenShift.
- CI for annotation based identity authentication for GKE.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 20, 2020
This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for host-ID based identity authentication for GKE and OpenShift.
- CI for annotation based identity authentication for GKE.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 21, 2020
This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for host-ID based identity authentication for GKE and OpenShift.
- CI for annotation based identity authentication for GKE.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 21, 2020
This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for host-ID based identity authentication for GKE and OpenShift.
- CI for annotation based identity authentication for GKE.

Addresses Issue #106
diverdane pushed a commit that referenced this issue Oct 21, 2020
This change adds support for:

- Running demo scripts directly on a Conjur OSS cluster that has been
  deployed via Conjur OSS Helm chart.
- Creation of a Conjur CLI pod if it doesn't exist.
- Selectable operation for annotation-based authn-k8s vs.
  host-ID-based authn-k8s.
- Running demo scripts on platforms that do not have a load balancer
  configured (e.g. for testing on KinD or Minikube without having to
  load MetalLB).
- CI for host-ID based identity authentication for GKE and OpenShift.
- CI for annotation based identity authentication for GKE.

Addresses Issue #106
@izgeri izgeri closed this as completed Oct 28, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants