github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add kube-mgmt to OPA (#10860)

Browse Source 
* Initial attempt at adding kube-mgmt to the chart

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Updated to add auth/imagePullPolicy/rbac

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Fix linting issues

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Update kube-mgmt image to 0.8.

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Add the ability to turn off authz

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Add note about authz.

Signed-off-by: Kevin Fox <kevin@efox.cc>

* Add in fixes from tsandall

Signed-off-by: Kevin Fox <kevin@efox.cc>
This commit is contained in:
kfox1111
2019-02-26 09:37:20 -08:00
committed by Kubernetes Prow Robot
parent d5d1fbe536
commit 33d98eaa3e
7 changed files with 160 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/opa/Chart.yaml
+2 -2
View File
@@ -1,12 +1,12 @@
apiVersion: v1
appVersion: 0.10.1
appVersion: 0.10.2
description: Open source, general-purpose policy engine. Enforce fine-grained invariants over arbitrary Kubernetes resources.
name: opa
keywords:
- opa
- admission control
- policy
version: 0.2.0
version: 0.3.0
home: https://www.openpolicyagent.org
icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
sources:
stable/opa/templates/NOTES.txt
+12 -8
View File
@@ -2,14 +2,6 @@ Please wait while the OPA is deployed on your cluster.
For example policies that you can enforce with OPA see https://www.openpolicyagent.org.
You can query OPA to see the policies it has loaded:
export OPA_POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "opa.fullname" . }}" -o jsonpath="{.items[0].metadata.name}")
kubectl port-forward $OPA_POD_NAME 8080:443
curl -k -s https://localhost:8080/v1/policies | jq -r '.result[].raw'
If you installed this chart with the default values, you can exercise the sample policy.
# 1. Create a namespace called "opa-example"
@@ -53,3 +45,15 @@ spec:
EOF
kubectl -n opa-example create -f ingress-bad.yaml
If you want to turn off authz for debugging purposes, you can do so by upgrading the chart like so:
helm upgrade {{ .Release.Name }} stable/opa --reuse-values --set authz.enabled=false
You can query OPA to see the policies it has loaded (you will need to turn off authz as described above):
export OPA_POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "opa.fullname" . }}" -o jsonpath="{.items[0].metadata.name}")
kubectl port-forward $OPA_POD_NAME 8080:443
curl -k -s https://localhost:8080/v1/policies | jq -r '.result[].raw'
stable/opa/templates/_helpers.tpl
+5
View File
@@ -29,6 +29,11 @@ If release name contains chart name it will be used as a full name.
{{- printf "%s-sar" $name -}}
{{- end -}}
{{- define "opa.mgmtfullname" -}}
{{- $name := (include "opa.fullname" . | trunc 58 | trimSuffix "-") -}}
{{- printf "%s-mgmt" $name -}}
{{- end -}}
{{/*
Create chart name and version as used by the chart label.
*/}}
stable/opa/templates/deployment.yaml
+68
View File
@@ -15,9 +15,32 @@ spec:
app: {{ template "opa.fullname" . }}
name: {{ template "opa.fullname" . }}
spec:
{{- if .Values.authz.enabled }}
initContainers:
- name: initpolicy
image: {{ .Values.mgmt.image }}:{{ .Values.mgmt.imageTag }}
imagePullPolicy: {{ .Values.mgmt.imagePullPolicy }}
command:
- /bin/sh
- -c
- |
tr -dc 'A-F0-9' < /dev/urandom | dd bs=1 count=32 2>/dev/null > /authz/mgmt-token
TOKEN=`cat /authz/mgmt-token`
cat > /authz/authz.rego <<EOF
package system.authz
default allow = false
allow { input.path = [""]; input.method = "POST" }
allow { input.path = [""]; input.method = "GET" }
allow { input.identity = "$TOKEN" }
EOF
volumeMounts:
- name: authz
mountPath: /authz
{{- end }}
containers:
- name: opa
image: {{ .Values.image }}:{{ .Values.imageTag }}
imagePullPolicy: {{ .Values.imagePullPolicy }}
args:
- "run"
- "--server"
@@ -25,6 +48,15 @@ spec:
- "--tls-cert-file=/certs/tls.crt"
- "--tls-private-key-file=/certs/tls.key"
- "--addr=0.0.0.0:443"
{{- if .Values.authz.enabled }}
- "--authentication=token"
- "--authorization=basic"
- "/authz/authz.rego"
- "--ignore=.*"
{{- end }}
{{- if .Values.mgmt.enabled }}
- "--insecure-addr=127.0.0.1:8181"
{{- end }}
volumeMounts:
- name: certs
readOnly: true
@@ -32,9 +64,41 @@ spec:
- name: config
readOnly: true
mountPath: /config
{{- if .Values.authz.enabled }}
- name: authz
mountPath: /authz
{{- end }}
{{- if .Values.mgmt.enabled }}
- name: mgmt
image: {{ .Values.mgmt.image }}:{{ .Values.mgmt.imageTag }}
imagePullPolicy: {{ .Values.mgmt.imagePullPolicy }}
args:
{{- if .Values.authz.enabled }}
- --opa-auth-token-file=/authz/mgmt-token
{{- end }}
- --opa-url=http://127.0.0.1:8181/v1
- --replicate-path={{ .Values.mgmt.replicate.path }}
- --enable-policies={{ .Values.mgmt.configmapPolicies.enabled }}
{{- if .Values.mgmt.configmapPolicies.enabled }}
- --policies={{ .Values.mgmt.configmapPolicies.namespaces | join "," }}
- --require-policy-label={{ .Values.mgmt.configmapPolicies.requireLabel }}
{{- end }}
{{- if gt (len .Values.mgmt.replicate.namespace) 0 }}
- --replicate={{ .Values.mgmt.replicate.namespace | join ","}}
{{- end }}
{{- if gt (len .Values.mgmt.replicate.cluster) 0 }}
- --replicate-cluster={{ .Values.mgmt.replicate.cluster | join ","}}
{{- end }}
{{- if .Values.authz.enabled }}
volumeMounts:
- name: authz
mountPath: /authz
{{- end }}
{{- end }}
{{- if .Values.sar.enabled }}
- name: sarproxy
image: {{ .Values.sar.image }}:{{ .Values.sar.imageTag }}
imagePullPolicy: {{ .Values.sar.imagePullPolicy }}
command:
- kubectl
- proxy
@@ -52,6 +116,10 @@ spec:
- name: config
secret:
secretName: {{ template "opa.fullname" . }}-config
{{- if .Values.authz.enabled }}
- name: authz
emptyDir: {}
{{- end }}
nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
tolerations:
stable/opa/templates/mgmt-clusterrole.yaml
+14
View File
@@ -0,0 +1,14 @@
{{- if (and .Values.rbac.create .Values.mgmt.enabled) -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app: {{ template "opa.name" . }}
chart: {{ template "opa.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
component: mgmt
name: {{ template "opa.mgmtfullname" . }}
rules:
{{ toYaml .Values.rbac.rules.cluster | indent 2 }}
{{- end -}}
stable/opa/templates/mgmt-clusterrolebinding.yaml
+20
View File
@@ -0,0 +1,20 @@
{{- if (and .Values.rbac.create .Values.mgmt.enabled) -}}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
labels:
app: {{ template "opa.name" . }}
chart: {{ template "opa.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
component: mgmt
name: {{ template "opa.mgmtfullname" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ template "opa.mgmtfullname" . }}
subjects:
- kind: ServiceAccount
name: {{ template "opa.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
{{- end -}}
stable/opa/values.yaml
+39 -2
View File
@@ -9,7 +9,8 @@ opa:
url: "https://www.openpolicyagent.org"
bundle:
service: controller
name: "kubernetes/admission"
name: "helm-kubernetes-quickstart"
default_decision: "/helm_kubernetes_quickstart/main"
# To enforce mutating policies, change to MutatingWebhookConfiguration.
admissionControllerKind: ValidatingWebhookConfiguration
@@ -43,9 +44,34 @@ admissionControllerCA: ""
admissionControllerCert: ""
admissionControllerKey: ""
authz:
# Disable if you don't want authorization.
# Mostly useful for debugging.
enabled: true
# Docker image and tag to deploy.
image: openpolicyagent/opa
imageTag: 0.10.1
imageTag: 0.10.4
imagePullPolicy: IfNotPresent
mgmt:
enabled: true
image: openpolicyagent/kube-mgmt
imageTag: 0.8
imagePullPolicy: IfNotPresent
extraArgs: []
configmapPolicies:
enabled: false
namespaces: [opa, kube-federation-scheduling-policy]
requireLabel: true
replicate:
# NOTE IF you use these, remember to update the RBAC rules above to allow
# permissions to replicate these things
cluster: []
# - [group/]version/resource
namespace: []
# - [group/]version/resource
path: kubernetes
# Number of OPA replicas to deploy. OPA maintains an eventually consistent
# cache of policies and data. If you want high availability you can deploy two
@@ -68,6 +94,16 @@ rbac:
# If true, create & use RBAC resources
#
create: true
rules:
cluster: []
# - apiGroups:
# - ""
# resources:
# - namespaces
# verbs:
# - get
# - list
# - watch
serviceAccount:
# Specifies whether a ServiceAccount should be created
@@ -82,6 +118,7 @@ sar:
enabled: false
image: lachlanevenson/k8s-kubectl
imageTag: latest
imagePullPolicy: IfNotPresent
# To control the liveness and readiness probes change the fields below.
readinessProbe: