From 796bb1a716e1604f239c207ae363fd5f363d8bed Mon Sep 17 00:00:00 2001 From: MCamp859 Date: Tue, 10 Mar 2020 11:32:30 -0400 Subject: [PATCH] Add Windows Active Dir Auth Support for K8s Completed review feedback. Additional feedback done. Added cengn path. Story: 2006711 Task: 38485 Change-Id: I8a3f6f8583accf3ab2eb5694a41b1750a7938252 Signed-off-by: MCamp859 --- .../configuration/figures/k8s_auth_login.png | Bin 0 -> 8175 bytes doc/source/configuration/index.rst | 1 + .../configuration/k8s_auth_winactivedir.rst | 317 ++++++++++++++++++ .../r4_release/ansible_bootstrap_configs.rst | 4 - 4 files changed, 318 insertions(+), 4 deletions(-) create mode 100644 doc/source/configuration/figures/k8s_auth_login.png create mode 100644 doc/source/configuration/k8s_auth_winactivedir.rst diff --git a/doc/source/configuration/figures/k8s_auth_login.png b/doc/source/configuration/figures/k8s_auth_login.png new file mode 100644 index 0000000000000000000000000000000000000000..0795a209ea6b0bb009736fd7574a3f7f644ab9a9 GIT binary patch literal 8175 zcmcI}cT`i`x^L7ipeU%Qh*U*Dnka|?rD#B+v?$W0C|wZZrV~h_(zc+WAYFnHsgZ<^ z7(!GO3^kO1)Tn?2NC+jNBnDm-_jz}`ao#!SjyvujYh=!~zWHT-^J~Ageh;o#f_Lvc zyb}Nb?7n=-*a`sHvdX`X32o)yF|VzT;{R+3vI2tu*iNZw{^Squ3lVM4Tx>QWJ0O$RgK3gf5rzN z!zMWHn0``hEscE*B7EIBt=kj9iLO205l4aA?TM<$b+~em5FJZ=QT0pPrfv zzTTR?dm&(UX>I+Gq8-F^#gm_V7c^9^qXXxR&W=S! z^MTn>d>C_X6wf4Xth-k0mk9&xw-%BLyY~5#YK*Vr z!2rP2rLh9GsI0+A`23f9&VqnDe@%?;VgTo;MCia4fYi~54ZivUwqzJ{tY(&P_mhU4 zekh&67z_ab;xCO^%mU{|>fJX*Gy19cFzEO)V>nbA@b*Z`N;jp=p!Ff0pyA7aYyx54xM{<`LkAT#u-pxA!0&GbfasAETdz%3| zmZfh_oCVm-M($j5M-Gs27I4?-7_%;56vk!L0kb;_H$`~t0axT~S=|{IINJs<0{F6r z#O>@%Vsa&c0VCzV4Z6j7WRib#(*`7?X26WLYUi|?gy1~*WzJK>BG$?P= z7+}XXUQcJrU!58HI0aiL=) z-?md@d&D?tMl?I~YBbSc;1H}E=V?8&RF?H}#n1Op?(uePqA@OIXyoB!s{+sPQIJ9S ztHU5-pb#&?;TUTiW!G7h`ey{N`5P%1Yt2MG7_Fv0_TRT)Z+?cfzm##lnOHfMXcX)< zV}iSsjvq&0UW65)PF*Vw(HKfh`tdBh!k?%T-(R|4v&7h(q4uQppx^qJo&vnR8$vdyZN!+LAL@*9)8vDvI<=tG#Enf+S=|SN5 zbX18|$2=W1sLN5z;t559vPHHUx zDWXGjRWQu+e~hNv^^12$b*ztS{}{Wdv^yQZ4~>kNv0#OC?6X}ZMFdBavbMNrXKhXz z(AO<=?yS#&_T$_LkRi4GjYb@acti)ty5`C_ zfyz54u+-G@)<$Ea`>Wi_qb|j zLmSYZb`ftyyB4HTgMw$TwH;-t#`C?JXhgMPULsMV;)9djw-XRUR?yz6LHg{9-sPCQ84X4>h*Y#vQ$R9>1v1Cc~;@22uDU2?w^uM#pDzJz89tpt$^(hgigr72%x0Mtns^ybBSqB&MKM_}!?PB$)90 zy2dcmL6(|DeMq<+ebJ?Q`gy@dCqkql#NbQh@v%iIw~yP93lmjrIyF|Bc=1hITg)L_B#86lpd zRaN&471Sp-;cE#@#hqTwC;@=~^Vay^>ZAWc*j0e%3%mAVXQT7pzAD&7?5P?*z?X=< z9MAK#Em04Ic$%+|v3e2tPc0POd@b})=ALF{ZvzIf2Q^8rqZAH8yb{=RpI8P^6@_J~S*xy9(^U^bCjCOWx9}+zN@Bi-zTj!6dhL^Tha%-jZiIBmNB70& zPBoIB7Ccfa?A4x}=!^VX;4@Mt-f^|mUD+BQ`4I5JgqHE{BU-fKS*f?CE7le>X>}y0 zlOj;r{o2{Iv}|9NTY*(;X?05v1qEx^O@LX~UQwG+MI7REbcDaTazec4Pxh4cMX15@ zV##gv%auGs_JK$_UvQSwnG)sj z%1;XV+@feaK)0aLZL5sTrCMzBlz-JQAO408sT5BoA8_o=FLAwsPwn7v?4#g2Qko12 zVSp!cthO6ht|JpXHj6o=yGlKCC`+EmpNjtS@YU|6%02fK- zjrQ1LW!AHj^1~|0@Z1S|&FfD!Z2IVMl_!*ZhH9LP_;rvgw5A~eMJKw^k_(-+z&M19 zT)czwfuL#QAp`NdKKvLwHIIok5BIY;nx-mE1!*yCmlhAeA?;p#9F*QLZ<}#mCOFE_ z@@N`qSi@PJRhg6UMi)GKB30ccks~NzCrr?(pEZ#-(@a(EA6h;K*rN;*1tiI{0AFz z=Qz~A&Pp+uXX*%L>RrRjD@vR;FgQOtNyE=`)N<-AR!?efI;65>Ft9JxvkKH79QQR^ zG+vqj9>mt;p&O)kO>$Ay4g~5fy;v!8)FkV(_o-P?hT|*UUwb2n@8T3vi*@q_i zHx6Z%%ZP;45xl0(+loZ4FWUw|;=`+zkbQp9a*vB;Mc`dak(GOPt(>#y8s32u6RS}@ z#ifzfle|&K56v;cucLyaie*Y=2CI|xcAZ^p_rkz+g(6SAACmudXp!Ay!Q8C#lBq7e zesi%H>*p321r~~k)NHmz8!A@}b<^#3^D?*9^wV4BY@n~~646pwxa8a4qvIT{#P^ws z#{N2I=0zjq>6xsr?6C_vkfUEm&vp#kVsT1OO2Vovba#gvM~1DCNk>xE6=aU`dR3=|~J;AG^2y^%mF>E2%Frmm~X3KoH+D zJE2)#QwEeSk*yZ#n7rA&m!LPaemv~-;ZUsR3%fjl3AwPdGnwsLV({btP?g{deQ6zL zbS5m6?VtJ%^@en{Y&c+Uxv%|EArw~)w49^u$c;79KuXQ6g%*u1hgNA>Cp#Qxy&rSA zl|-9Jw|E8Ii~&rHjJ?gjh-TQ0g1x^2doS$OwtpYeV?^Fm%eYdEOcHmsw`;>&{>P+V zgA+ehHrAJE8x4lF!gup0j%8dMJ@MsdT5_2rL(eN4c`NHjkmVRa{HM*tfA;n25tiA7 zF@WahC!)23RKxFv>p^rw-HJ(8;UYf;|4mK#PwLKpB9rXb)7o+d2z1|0J+aOHU<^Wn zg}HTWqQYJ;t20BASHfHLm1DiFJj!a5+XX+G+csI5^-`r!?SP{@{+-J2CvW2n9!~UW z9P0~oQePo}6x04{3BD*+a=W6xW=*z^UvM?C#66IgJ!_7TGSu?SNBY8y$Jy(*+Q8AF zml>KaEJ{mEfUdIe1FP%)bK>JI!r)#6CIvDJZktLlN6(1%`I5pfFixUy{fX23SJq3m zB95MH^GeU!k>b6u8<+W2{mxm|xQljvw(n0BqU|rDm8&tKWrd6-Z)=MuYebhf6n)Uro}Pa& z9eg-kH|?6%vw+zr;hJ`AM@E35kP^%Pb(JS>GAuHBoRn7)al7!0P{ZxpT3IP=#!81Z$U%S@n6NVggX`vFE#LE7{vEZ40<4lRqxbz zr8JyzZ*HoZnO3Q+zc)xN9Xbt;h^>|hmV99DkW7fSRhDv5U9he|7rDNFIiN2wT%>}E z(M?~Oxw-BstVO8GDlz+fV0g~@qQUmhB{^9SbF?d*nw}zCrS!{R@nMRNeu$Q8aU1RW zZnCQ8ZDuV7Mv8OENfIPrT{URkH4n)U+ZDV&?&S)m$S0|VQ(_GgU@%HrVR~8C89Q?q zv-T3Q`wYX3Wi@89qB@djjLs%OG1!f@J$zqXrBO~g#Wr^P_U%-*xh}~GP)Kb(XzHmg z?%HR>4R6#=|Kim|vC%4#73Na4@Lpr<~t&3r4VF^acs@J^tKfjUiLDcatB2>NvC7SAVSz@l-V!Rj+|+YuT* zfL@W-QM4N*swVxfI{iN~j<_FX0Ox#p7adSHEbvTTsrK1eV9Ic>w1zY~8P%}mY;Na` zldBV{kaZCquq8cSRJQf9OlVIJ^r7R!YL1$Qq$Pj9XD|RNLHEO_mzwcN7xOPH~yag6C7|* zgy->jA!is>S2Gzgd=AgeH{!r|ikFCXh~{pxe*kNocApQ)o`L;d&kr8ua%D&W%^J{lRe`Q68*Zi zYni^x_cn^rLEg3yp(0Teeb9TNc)+K=-QPF+kG?m*tFr0*9aGI`E*0xTU>G;`tLd@+ zuFaptxS6DThkY@RxiH`}6x*?N-eF z{|Ej4BQprGMxw7y{(HRee^K>p@L5QnK@A@tp!6bo_(}T6<;0TT32g2QL{5dVJ-D`3|$mLXqa zvw}z{dwb8AG3i1k1f?hO$Rt_TP(~zPc1zbqOBvnR3FDMr(taw+!`>ohY;WOW9)dH? zWfEQ04ib3`=!WQ*?Vps7DfRFvlF64Z*q9{pInY=_D(U6GEQz~>apldZ;uG1AR$5ydc{AHw)%g34i$d+LSEv$ATzgJ{lJ_sk)rIv*Dy}?!?QKYi5=w1=yHG zGXDJ7J^q=(SLeUhHL}&Y0^6|~7?V?whNM~B^udWBe=AVmv`9_kz)A}qG52Kr{@ zwGN4iVB&r)&Vw%x3d%;^pk}|V`K1;_d?Q2UZ+L_e-P0wxE?*t}2^rgn0F6h==N!h?9#-d25Q^o=p`>lFf@f?7?%# z#dpJB9JfmjRsJDYZt}NDc89w$@ec_jX<*i$ASgtK&w%hffb{zIFcw40|=*8mE_kF=iWTdUb-7%0~tWW+b(WY565PYJ*G7_!;<{5xUNo)`xRW z3vH#Y5Z5}OL%`$n?woo0L5;@lWUGm%0o$S`610Xx;hO>jK~_ zcq(sbpwWw3@;2znHQG7qTGBJiKr2#-g3=+ht1~~B7b_f_oyHf!PaYZ}A~(8_>p}R@ zv5!@RMDNs8u;mfmClkRbsiv0d-~DY5qr+kz)|$_H&a>-?JPQLqL&T5OjsIF9tWjTo zn98%}PL^dPe_rg2;^(9HTj9soE?FMa%`I-&CPeU?(7%-++8`HnVo*#N^N_sl?zoUX zKqu*cHt395?=QP9IXwI~Gnxa0?&EWY{g-KykK%q)l{Et{kxLywJ~8?FHyH`7aa3X9 z8abt#5^!(tmKEM3uc}+Wxk^5}NrlapJ>qK{`pL&;=6z`7Ee}hU*|z;8Pd}KGiQGB7 zq-J^DCez7nB;xV-BZS{m;!@{1MrfoFY@=BcI?@oa)ci;i`D0vmV?N&Sw!c5`JCL|W z!69rg6vX;c-Uh44kVk?b7Wo3JU_(x~C~~!FLx+Lf253Bersl|l@|X7a)g01w%w8z; zrT9IleR+NB35kqMvmOPymkyH8>h7K#jw^L0yUCu0Bp):30556/dex + username_claim: email + groups_claim: groups + +The ``username_claim`` and ``groups_claim`` parameter values can vary for +different user and group configurations within your Windows Active Directory +server. + +~~~~~~~~~~~~~~~~~~~~~~ +Configure post-install +~~~~~~~~~~~~~~~~~~~~~~ + +Execute the following commands to add the OIDC parameters to the kube-apiserver: + +:: + + system service-parameter-add kubernetes kube_apiserver oidc_client_id=value + system service-parameter-add kubernetes kube_apiserver oidc_groups_claim=value + system service-parameter-add kubernetes kube_apiserver oidc_issuer_url=value + system service-parameter-add kubernetes kube_apiserver oidc_username_claim=value + system service-parameter-apply kubernetes + + +------------------------------------ +Configure oidc-auth-apps application +------------------------------------ + +The oidc-auth-apps application is a system managed application that is +packaged in the ISO and uploaded by default. To use the oidc-auth-apps +application for authentication, you must first configure and deploy the +oidc-auth-apps application as described below. + +These commands assume the cert and key pem files for creating these secrets +are in ``/home/sysadmin/ssl/``. + +#. Create a secret with the certificate and key (``local-dex.tls``) to be used + by the oidc-auth-apps as well as a secret with the CA that signed this + certificate (``dex-client-secret``) for the client. The certificate should + be signed by a CA trusted by the system. If the certificate is signed by a + CA that is not trusted by default, you can make the system trust the CA + by specifying it during bootstrap by specifying ssl_ca_cert in + ``localhost.yml``, or through ``system certificate-install -m ssl_ca ...`` + after bootstrap. + + :: + + kubectl create secret tls local-dex.tls --cert=ssl/dex-cert.pem --key=ssl/dex-key.pem -n kube-system + kubectl create secret generic dex-client-secret --from-file=/home/sysadmin/ssl/dex-ca.pem -n kube-system + + Create a Kubernetes secret wadcert with the CA's certificate that signed the + Active Directory's certificate using the following command: + + :: + + kubectl create secret generic wadcert --from-file=ssl/AD_CA.cer -n kube-system + +#. Specify user overrides for oidc-auth-apps. + + :: + + system helm-override-update oidc-auth-apps dex kube-system --values /home/sysadmin/dex-overrides.yaml + + The only mandatory section is the "connectors" section, which will vary for + different Windows Active Directory deployments. Refer to the upstream dex + documentation for more details: + https://github.com/dexidp/dex/blob/master/Documentation/connectors/ldap.md + + Here is an example ``dex-overrides.yaml`` file: + + :: + + config: + expiry: + idTokens: "10h" + connectors: + - type: ldap + name: OpenLDAP + id: ldap + config: + host: pv-windows-acti.cumulus.wrs.com:636 + rootCA: /etc/ssl/certs/adcert/AD_CA.cer + insecureNoSSL: false + insecureSkipVerify: false + bindDN: cn=Administrator,cn=Users,dc=cumulus,dc=wrs,dc=com + bindPW: Li69nux* + usernamePrompt: Username + userSearch: + baseDN: ou=Users,ou=Titanium,dc=cumulus,dc=wrs,dc=com + filter: "(objectClass=user)" + username: sAMAccountName + idAttr: sAMAccountName + emailAttr: sAMAccountName + nameAttr: displayName + groupSearch: + baseDN: ou=Users,ou=Titanium,dc=corp,dc=cumulus,dc=wrs,dc=com + filter: "(objectClass=group)" + userAttr: DN + groupAttr: member + nameAttr: cn + extraVolumes: + - name: certdir + secret: + secretName: wadcert + extraVolumeMounts: + - name: certdir + mountPath: /etc/ssl/certs/adcert + +#. Apply oidc-auth-apps: + + :: + + system application-apply oidc-auth-apps + + +--------------------------------------- +Set up users, groups, and authorization +--------------------------------------- + +These steps assume there is a user called "testuser" who is a member of both a +billingDeptGroup and a managerGroup set up in the Windows Active Directory +deployments. + +On StarlingX, bind Kubernetes RBAC role(s) to this user and/or group(s). For +example, give this user admin privileges by creating the following deployment +file and deploy it with the ``kubectl apply -f filename`` command. + +:: + + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: testuser-rolebinding + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin + subjects: + - apiGroup: rbac.authorization.k8s.io + kind: User + name: testuser + +Alternatively, you can also bind Kubernetes RBAC role(s) for the group(s) of +testuser. For example, give all members of the billingDeptGroup admin +privileges by creating the following deployment file and deploy it with the +:command:`kubectl apply -f filename` command. + +:: + + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: testuser-rolebinding + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin + subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: billingDeptGroup + +Set up kubectl with a Kubernetes user to authenticate through dex. This can be +done locally on controller-0 or remotely on a workstation. + +:: + + # setup cluster if you haven’t already + kubectl config set-cluster mystxcluster –server=https://:6443 + kubectl config set-context testuser@mystxcluster --cluster=mystxcluster --user=testuser + +--------------------------- +Obtain authentication token +--------------------------- + +You can get the authentication token using the ``oidc-auth`` CLI or using a +browser. + +~~~~~~~~~~~~~~~~~~~~~ +Use ``oidc-auth`` CLI +~~~~~~~~~~~~~~~~~~~~~ + +The ``oidc-auth`` CLI retrieves the ID token from Windows Active Directory using +the OIDC client, and dex, and updates the Kubernetes credentials for the user in +the kubectl config file. + +On controller-0, ``oidc-auth`` is installed as part of the base installation, +and is ready to use. + +On a remote host with kubectl and helm client installed on the host, perform the +following required setup: + +#. Install the Python ``mechanize`` module: + + :: + + sudo pip2 install mechanize + +#. Get the ``oidc-auth`` script from the public + `CENGN StarlingX mirror `_. + For example, + ``http://mirror.starlingx.cengn.ca/mirror/starlingx/master/centos/latest_docker_image_build/outputs/remote-cli/`` + +After setup is complete, run the ``oidc-auth`` script to authenticate and update +user credentials in the kubectl config file with the retrieved token. + +:: + + oidc-auth -c -u testuser + Password: + Login succeeded. + Updating kubectl config ... + User testuser set. + +Switch to the context for this user: + +:: + + kubectl config use-context testuser@mystxcluster + +Run a kubectl command to ensure the token works: + +:: + + kubectl get pods --all-namespaces + +~~~~~~~~~~~ +Use browser +~~~~~~~~~~~ + +#. From a browser, enter the following: + + :: + + https://oam-floating-ip-address:30555 + +#. In the dialog box, enter your username, password and click Login. + + .. figure:: figures/k8s_auth_login.png + :scale: 100% + :alt: Login dialog box + + An ID token is displayed as shown below: + + :: + + ID Token: + + eyJhbGciOiJSUzI1NiIsImtpZCI6IjkwYTcyYmIwZTRjNTJhZDhiNGYxMmYxNzc3NTVmNDdmODc5M2ZkYTAifQ.eyJpc3MiOiJodHRwczovLzEwLjEwLjEwLjM6MzA1NTYvZGV4Iiwic3ViIjoiQ2dkbmQyRnBibVZ6RWdSc1pHRnciLCJhdWQiOiJzdHgtb2lkYy1jbGllbnQtYXBwIiwiZXhwIjoxNTgwODQ4NTkzLCJpYXQiOjE1ODA3NjIxOTMsImF0X2hhc2giOiJNU0YtNDBpOWVuM1QyVjdUMWdSZW5RIiwiZW1haWwiOiJnd2FpbmVzIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsIm5hbWUiOiJHcmVnb3J5IEEuIFdhaW5lcyJ9.oNIabUhd5wx3tFCIuewtzsbYfx1OsrGXtEUEPL0l5Y944WE2c1HP6YUHWxvYTMw1_Ldl-jx-koiYbiE8Eztgy9anfJqclUFa6xlxP666Z7AYxndsULylqzfT0dvySaddIEEYDffx7aH6g7q2PKZjMHFierRyqmCu8WTPRSNy3NymLmQaGGjUmFHqbvpEBgg_ytpsDgbRIpk1EbyP63l79hBNlRvcffTRLi3LYYRaJLgSbx2tha43OX5rKxylF_GrzZHaqxxT6MjIHKHagUrcqa054RwPWUHKyV26ErkMg6gN5uyMm462UtnW7jJucYrWBpbaWaj0U0OTWv_1NnKlJw + + Access Token: + + jwcj46v3vmumpixr54wbyrstf + + Claims: + + { + "iss": "https://10.10.10.3:30556/dex", + "sub": "Cgdnd2FpbmVzEgRsZGFw", + "aud": "stx-oidc-client-app", + "exp": 1580848593, + "iat": 1580762193, + "at_hash": "MSF-40i9en3T2V7T1gRenQ", + "email": "testuser", + "email_verified": true, + "groups": [ + "billingDeptGroup", + "managerGroup" + ], + "name": "testuser" + } + + +#. Set Kubernetes credentials with the above ID token: + + :: + + ~(keystone_admin)]$ TOKEN= + ~(keystone_admin)]$ kubectl config setcredentials testuser --token $TOKEN + +#. Switch to the context for this user: + + :: + + ~(keystone_admin)]$ kubectl config use-context testuser@mystxcluster + +#. Run the command ``kubectl get pods --all-namespaces``. + +This command should be successful because authentication is complete. + diff --git a/doc/source/deploy_install_guides/r4_release/ansible_bootstrap_configs.rst b/doc/source/deploy_install_guides/r4_release/ansible_bootstrap_configs.rst index 6d1cbe5cc..f5a8e3dd0 100644 --- a/doc/source/deploy_install_guides/r4_release/ansible_bootstrap_configs.rst +++ b/doc/source/deploy_install_guides/r4_release/ansible_bootstrap_configs.rst @@ -118,10 +118,6 @@ Install-time-only parameters * ``apiserver_oidc`` - * ``client_id`` - * ``issuer_id`` - * ``username_claim`` - ---- IPv6 ----