Demo supports Conjur OSS and annotation-based authn-k8s #107

diverdane · 2020-09-29T19:53:52Z

This change includes:

Adds support for running demo scripts directly on a Conjur OSS cluster that has been
deployed via Conjur OSS Helm chart.
Adds support for creating a Conjur CLI pod for scripts to use if it doesn't exist (needed
e.g. for running with Conjur OSS).
Selectable operation for annotation-based authn-k8s vs. host-ID-based authn-k8s.
Reorders and reorganizes scripts to separate the steps normally done by a security admin
vs. steps that are done to deploy the application.
Significant re-write of the README.md to differentiate security admin steps vs. app deploy
steps to reconcile this documentation with our other community repos.
CI for testing annotation-based authn-k8s on GKE.

Addresses Issue #106, Issue #92, and Issue #108

izgeri · 2020-10-06T14:30:04Z

README.md

+before running the demo scripts:
+
+  ```
+  export DEPLOY_MASTER_CLUSTER=true


We can't include this here - the DEPLOY_MASTER_CLUSTER flow is for dev only. Looking at your README updates I think there is a bit more reorganization we could do to make this extra-clear for this project - would you want to get on a call to chat about this today? Alternatively I could try to write up something based off of your branch to show what I am thinking.

I'm all ears. Whichever way you think is most efficient.

@izgeri - Thank you for the proposed changes! I incorporated your changes, but left out the command sequences for initializing the Conjur CA and loading policy since those commands are in the scripts (as optional parts of the script).

I took a stab at going a step further to reconcile this with our other repos and guides. I think we're getting closer to parity, but could maybe use a few more rounds of polishing.

I reordered, reorganized, and renamed the scripts to reconcile this workflow with our other repos. In the script names, I included either prep or admin or app to distinguish whether what's done in each script is usually preparation vs. tasks done by a security admin vs. tasks done to deploy the actual app without admin access. The scripts are now:

0_prep_check_dependencies.sh 1_prep_platform_login.sh 2_admin_load_conjur_policies.sh 3_admin_init_conjur_cert_authority.sh 4_app_create_namespace.sh 5_app_store_conjur_cert.sh 6_app_build_and_push_containers.sh 7_app_deploy.sh 8_app_verify_authentication.sh

In the README, I tried to explain the distinctions between the security admin and app deploy steps.

The CI is passing again, this is ready for re-review.

Thanks @diverdane! I'm looking forward to reading this, but as I'm just seeing it now I won't get to it until Tuesday due to the long weekend. I really appreciate your thoughtful approach to the organization of the scripts in this project!

doodlesbykumbi

This is such a great and welcome body of work! The changes to the README are a massive improvement. I left only a couple comments but I think this looks great!

doodlesbykumbi · 2020-10-19T13:56:33Z

8_app_verify_authentication.sh


 RETRIES=150
 # Seconds
 RETRY_WAIT=2

+# Dump some kubernetes resources and Conjur authentication policy if this
+# script exits prematurely
+DETAILED_DUMP_ON_EXIT=true


doodlesbykumbi · 2020-10-19T13:58:08Z

7_app_deploy.sh

@@ -217,6 +232,7 @@ deploy_init_container_app_with_host_outside_apps() {
    sed "s#{{ TEST_APP_NAMESPACE_NAME }}#$TEST_APP_NAMESPACE_NAME#g" |
    sed "s#{{ AUTHENTICATOR_ID }}#$AUTHENTICATOR_ID#g" |
    sed "s#{{ CONFIG_MAP_NAME }}#$TEST_APP_NAMESPACE_NAME#g" |
+    sed "s#{{ SERVICE_TYPE }}#$(app_service_type)#g" |


I think we should really get rid of all the sed stuff, and confirm the manifests to x.yml.sh. I think that pattern is a lot easier to maintain and work with.

That's a great idea! Or, we could use Helm charts for all of the Kubernetes YAML files, and Yaml.sh for the Conjur policy templating?

That said, I think this might be best handled as tech debt outside of the scope of our auth-k8s UX work.
I filed this issue for this cleanup: #113

utils.sh

diverdane · 2020-10-19T22:59:38Z

@kumbi, thanks for the review!

I made the change that you suggested for using CONJUR_OSS_HELM_DEPLOYED directly.
I also made an additional small change:
- I moved the configure_conjur_cli function so that it's always run
- I changed the name of this function to ensure_conjur_cli_initialized
  I did this to make things more robust. There were times when I had
  environment variables messed up, and the Conjur CLI pod got created
  but initialization failed at first. Fixing the env variable and re-running
  the script didn't work with the prior code, because the initialization was
  getting called conditionally: only when the Conjur CLI pod was created.
  Now it's always run, and it's okay if this gets called when the pod is already
  initialized.
I filed and issue for replacing sed with either Yaml.sh or Helm charts
(wherever that's possible):
Replace use of sed for yaml templating with Yaml.sh or helm charts #113

doodlesbykumbi

This looks great! For some reason the build is currently failing, once that's resolve I hink we should be good to proceed. Before merging I also wanted to make sure that there aren't an other repos using this project that might break e.g. DEPLOY_MASTER_CLUSTER is no longer being used.

doodlesbykumbi · 2020-10-21T10:41:12Z

ci/test

@@ -89,6 +91,7 @@ function prepareTestEnvironment() {
  export CONJUR_NAMESPACE_NAME=conjur-5-$UNIQUE_TEST_ID-test
  export AUTHENTICATOR_ID=conjur-5-$UNIQUE_TEST_ID-test
  export TEST_APP_NAMESPACE_NAME=test-app-5-$UNIQUE_TEST_ID
+  export CONFIGURE_CONJUR_MASTER=true

  export DEPLOY_MASTER_CLUSTER=true


I think we can get rid of this now

We still need to include this export because the scripts also clone and run the cyberark/kubernetes-conjur-deploy scripts, and those depend upon the DEPLOY_MASTER_CLUSTER environment variable.

To prevent possible breakage in the scenario where another repo is cloning & running this kubernetes-conjur-demo script repo, what I can do is this:

In set_env_vars.sh, default the DEPLOY_MASTER_CLUSTER to false

In set_env_vars.sh, default the CONFIGURE_CONJUR_MASTER to $DEPLOY_MASTER_CLUSTER

So the precedence for the value of CONFIGURE_CONJUR_MASTER would be:

CONFIGURE_CONJUR_MASTER env var, if that's set explicitly, otherwise...

DEPLOY_MASTER_CLUSTER env var, if that's set explicitly, otherwise...

false

That means for any existing workflow that depends upon DEPLOY_MASTER_CLUSTER and is unaware of the newer lingo CONFIGURE_CONJUR_MASTER, item 2 will cover them.

@diverdane Thank you I think this should work perfectly fine. I wonder if it's a good idea to invest (in the future) in finding all the things we care about that depend on this and overhauling them to the new.

diverdane · 2020-10-21T13:13:56Z

For some reason the build is currently failing...

For the life of me, I can't figure out why this failed. Just before the point of failure, the conjur-master-ext service is created:

[2020-10-20T19:49:01.750Z] ++++++++++++++++++++++++++++++++++++++
[2020-10-20T19:49:01.750Z] 
[2020-10-20T19:49:01.750Z] Creating load balancer for master and standbys.
[2020-10-20T19:49:01.750Z] 
[2020-10-20T19:49:01.750Z] ++++++++++++++++++++++++++++++++++++++
[2020-10-20T19:49:02.696Z] service/conjur-master-ext created

But then moments later, there's an error revolving around this service not existing:

[2020-10-20T19:49:03.723Z] ++++++++++++++++++++++++++++++++++++++
[2020-10-20T19:49:03.723Z] 
[2020-10-20T19:49:03.723Z] Configuring master pod.
[2020-10-20T19:49:03.723Z] 
[2020-10-20T19:49:03.723Z] ++++++++++++++++++++++++++++++++++++++
[2020-10-20T19:49:03.981Z] pod/conjur-cluster-569f787bdb-86kxd labeled
[2020-10-20T19:49:04.241Z] error: you need to provide a route port via --port when exposing a non-existent service

I looked to see that all of the parallel OpenShift CI tests that are happening are using their own projects (namespaces), and they definitely are, so it's not being caused by deletion of a project/namespace by another parallel test.

I'm going to re-run the tests.

diverdane · 2020-10-21T15:09:36Z

@kumbi, I made a stab at making sure that these scripts are backwards-compatible with other repos that use these scripts and make use of the DEPLOY_MASTER_CLUSTER env variable. Details are in my comments above. Please take a look and let me know if there's a better way.

This change adds support for: - Running demo scripts directly on a Conjur OSS cluster that has been deployed via Conjur OSS Helm chart. - Creation of a Conjur CLI pod if it doesn't exist. - Selectable operation for annotation-based authn-k8s vs. host-ID-based authn-k8s. - Running demo scripts on platforms that do not have a load balancer configured (e.g. for testing on KinD or Minikube without having to load MetalLB). - CI for host-ID based identity authentication for GKE and OpenShift. - CI for annotation based identity authentication for GKE. Addresses Issue #106

doodlesbykumbi

LGTM. Once again, really great work! This is just such a comprehensively great update.

doodlesbykumbi · 2020-10-22T08:07:45Z

ci/test

@@ -89,6 +91,7 @@ function prepareTestEnvironment() {
  export CONJUR_NAMESPACE_NAME=conjur-5-$UNIQUE_TEST_ID-test
  export AUTHENTICATOR_ID=conjur-5-$UNIQUE_TEST_ID-test
  export TEST_APP_NAMESPACE_NAME=test-app-5-$UNIQUE_TEST_ID
+  export CONFIGURE_CONJUR_MASTER=true

  export DEPLOY_MASTER_CLUSTER=true


@diverdane Thank you I think this should work perfectly fine. I wonder if it's a good idea to invest (in the future) in finding all the things we care about that depend on this and overhauling them to the new.

diverdane self-assigned this Sep 29, 2020

diverdane force-pushed the conjur-oss-demo branch 3 times, most recently from 7e1529d to 483120b Compare September 29, 2020 21:04

diverdane requested a review from doodlesbykumbi September 29, 2020 21:05

diverdane marked this pull request as draft September 29, 2020 21:05

diverdane force-pushed the conjur-oss-demo branch 11 times, most recently from 07cc486 to 0f2dd66 Compare October 6, 2020 13:19

diverdane marked this pull request as ready for review October 6, 2020 13:21

diverdane changed the title ~~WIP - Demo supports Conjur OSS and annotation-based authn-k8s~~ Demo supports Conjur OSS and annotation-based authn-k8s Oct 6, 2020

diverdane force-pushed the conjur-oss-demo branch 3 times, most recently from e4f0461 to 055ada3 Compare October 6, 2020 14:26

izgeri reviewed Oct 6, 2020

View reviewed changes

diverdane mentioned this pull request Oct 6, 2020

Test authn-k8s authentication on Conjur-OSS deployed via Helm on KinD #108

Closed

diverdane force-pushed the conjur-oss-demo branch 6 times, most recently from e297a80 to eeef8af Compare October 9, 2020 12:13

diverdane force-pushed the conjur-oss-demo branch from eeef8af to 5b8e937 Compare October 9, 2020 14:43

diverdane requested a review from izgeri October 9, 2020 15:57

diverdane mentioned this pull request Oct 9, 2020

Adds CI for testing annotation-based authn on OpenShift with DAP #111

Merged

diverdane force-pushed the conjur-oss-demo branch 2 times, most recently from 82c79ac to 17a52b3 Compare October 9, 2020 22:23

doodlesbykumbi reviewed Oct 19, 2020

View reviewed changes

diverdane force-pushed the conjur-oss-demo branch from 17a52b3 to 1e799d5 Compare October 19, 2020 22:00

diverdane mentioned this pull request Oct 19, 2020

Replace use of sed for yaml templating with Yaml.sh or helm charts #113

Open

diverdane closed this Oct 19, 2020

diverdane reopened this Oct 19, 2020

diverdane force-pushed the conjur-oss-demo branch from 1e799d5 to 8f2ea26 Compare October 20, 2020 19:20

doodlesbykumbi reviewed Oct 21, 2020

View reviewed changes

diverdane force-pushed the conjur-oss-demo branch from 8f2ea26 to 2da6bf4 Compare October 21, 2020 13:46

diverdane force-pushed the conjur-oss-demo branch from 2da6bf4 to 826965b Compare October 21, 2020 15:44

diverdane force-pushed the conjur-oss-demo branch from 826965b to a8c21fe Compare October 21, 2020 18:00

doodlesbykumbi approved these changes Oct 22, 2020

View reviewed changes

diverdane merged commit 19e5743 into master Oct 22, 2020

diverdane deleted the conjur-oss-demo branch October 22, 2020 14:49

This was referenced Oct 23, 2020

CI test cases exist for using deployment name as K8s authn ID #92

Closed

WIP: CI test cases exist for using deployment name as k8s authn ID #93

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Demo supports Conjur OSS and annotation-based authn-k8s #107

Demo supports Conjur OSS and annotation-based authn-k8s #107

diverdane commented Sep 29, 2020 •

edited

Loading

izgeri Oct 6, 2020

diverdane Oct 6, 2020

diverdane Oct 9, 2020

izgeri Oct 9, 2020

doodlesbykumbi left a comment

doodlesbykumbi Oct 19, 2020

doodlesbykumbi Oct 19, 2020

diverdane Oct 19, 2020

diverdane commented Oct 19, 2020

doodlesbykumbi left a comment

doodlesbykumbi Oct 21, 2020

diverdane Oct 21, 2020

doodlesbykumbi Oct 22, 2020

diverdane commented Oct 21, 2020

diverdane commented Oct 21, 2020

doodlesbykumbi left a comment •

edited

Loading

doodlesbykumbi Oct 22, 2020

Demo supports Conjur OSS and annotation-based authn-k8s #107

Demo supports Conjur OSS and annotation-based authn-k8s #107

Conversation

diverdane commented Sep 29, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

doodlesbykumbi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

diverdane commented Oct 19, 2020

doodlesbykumbi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

diverdane commented Oct 21, 2020

diverdane commented Oct 21, 2020

doodlesbykumbi left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

diverdane commented Sep 29, 2020 •

edited

Loading

doodlesbykumbi left a comment •

edited

Loading