🥇Timakhazikitsa chilolezo cha ActiveDirectory ku Kubernetes pogwiritsa ntchito Keycloak

Nkhaniyi yalembedwa kuti ionjezerepo kale alipo, koma amalankhula za mawonekedwe a mtolo ndi Microsoft ActiveDirectory, komanso amakwaniritsa.

M'nkhaniyi ndikuwuzani momwe mungayikitsire ndikusintha:

chikhomo ndi ntchito yotseguka. Zomwe zimapereka malo amodzi olowera pazofunsira. Imagwira ntchito ndi ma protocol ambiri, kuphatikiza LDAP ndi OpenID zomwe timakonda.
mlonda pachipata - sinthani pulogalamu ya proxy yomwe imakupatsani mwayi wophatikiza chilolezo kudzera ku Keycloak.
gulu - pulogalamu yomwe imapanga config ya kubectl yomwe mutha kulowamo ndikulumikizana ndi Kubernetes API kudzera pa OpenID.

Momwe zilolezo zimagwirira ntchito ku Kubernetes.

Titha kuyang'anira ufulu wa ogwiritsa ntchito / gulu pogwiritsa ntchito RBAC, zolemba zambiri zidapangidwa kale za izi, sindikhala pa izi mwatsatanetsatane. Vuto ndiloti mutha kugwiritsa ntchito RBAC kuletsa ufulu wa ogwiritsa ntchito, koma Kubernetes sadziwa chilichonse chokhudza ogwiritsa ntchito. Zikuwoneka kuti tikufuna njira yoperekera ogwiritsa ntchito ku Kubernetes. Kuti tichite izi, tidzawonjezera wothandizira ku Kuberntes OpenID, yomwe inganene kuti wogwiritsa ntchitoyo alipodi, ndipo Kubernetes mwiniyo adzamupatsa ufulu.

Kukonzekera

Mufunika gulu la Kubernetes kapena minikube
Active Directory
Madomeni:
keycloak.example.org
kubernetes-dashboard.example.org
gangway.example.org
Satifiketi ya madambwe kapena satifiketi yodzisainira

Sindidzangokhalira kuganizira za momwe mungapangire satifiketi yodzilembera nokha, muyenera kupanga ziphaso za 2, uwu ndiye muzu (Certificate Authority) ndi kasitomala waku wildcard wa *.example.org domain

Mukalandira / kupereka ziphaso, kasitomala ayenera kuwonjezeredwa ku Kubernetes, chifukwa cha izi timapanga chinsinsi chake:

kubectl create secret tls tls-keycloak --cert=example.org.crt --key=example.org.pem

Kenako, tidzagwiritsa ntchito ingress controller yathu.

Kuyika Keycloak

Ndinaganiza kuti njira yosavuta ndiyo kugwiritsa ntchito njira zokonzekera izi, zomwe ndi ma chart a helm.

Ikani chosungira ndikusintha:

helm repo add codecentric https://codecentric.github.io/helm-charts
helm repo update

Pangani fayilo ya keycloak.yml yokhala ndi izi:

keycloak.yml

keycloak:
  # Имя администратора
  username: "test_admin"
  # Пароль администратор  
  password: "admin"
  # Эти флаги нужны что бы позволить загружать в Keycloak скрипты прямо через web морду. Это нам 
  понадобиться что бы починить один баг, о котором ниже.
  extraArgs: "-Dkeycloak.profile.feature.script=enabled -Dkeycloak.profile.feature.upload_scripts=enabled" 
  # Включаем ingress, указываем имя хоста и сертификат который мы предварительно сохранили в secrets
  ingress:
    enabled: true 
    path: /
    annotations:
      kubernetes.io/ingress.class: nginx
      ingress.kubernetes.io/affinity: cookie
    hosts:
      - keycloak.example.org
    tls:
    - hosts:
        - keycloak.example.org
      secretName: tls-keycloak
  # Keycloak для своей работы требует базу данных, в тестовых целях я разворачиваю Postgresql прямо в Kuberntes, в продакшене так лучше не делать!
  persistence:
    deployPostgres: true
    dbVendor: postgres

postgresql:
  postgresUser: keycloak
  postgresPassword: ""
  postgresDatabase: keycloak
  persistence:
    enabled: true

Kupanga Federation

Kenako, pitani ku mawonekedwe a intaneti keycloak.example.org

Dinani kumanzere ngodya Onjezani dziko

Mfungulo
mtengo

dzina
kubernetes

Dzina lowonetsa
Kubernetes

Letsani kutsimikizira kwa imelo kwa ogwiritsa ntchito:
Makasitomala -> Imelo -> Mappers -> Imelo yotsimikizika (Chotsani)

Tidakhazikitsa bungwe kuti tilowetse ogwiritsa ntchito kuchokera ku ActiveDirectory, ndikusiya zithunzi pansipa, ndikuganiza kuti zimveka bwino.

Bungwe la ogwiritsa ntchito -> Onjezani wopereka… -> ldap

Kupanga Federation

Ngati zonse zili bwino, ndiye pambuyo kukanikiza batani Lumikizani ogwiritsa ntchito onse mudzawona uthenga wokhudza kulowetsa bwino kwa ogwiritsa ntchito.

Kenako tiyenera kupanga mapu magulu athu

Bungwe la ogwiritsa ntchito -> ldap_localhost --> Mappers -> Pangani

Kupanga mapu

Kukonzekera kwa kasitomala

Ndikofunikira kupanga kasitomala, malinga ndi Keycloak, iyi ndi ntchito yomwe idzaloledwa kuchokera kwa iye. Ndidzawonetsa mfundo zofunika pazithunzi zofiira.

Makasitomala -> Pangani

Kukonzekera kwa kasitomala

Tiyeni tipange scoupe kwa magulu:

Makasitomala -> Pangani

Pangani kuchuluka

Ndipo kuwakonzera mapu:

Makasitomala —> magulu —> Mappers —> Pangani

Mapper

Onjezani mapu amagulu athu ku Default Client Scopes:

Makasitomala —> kubernetes —> Makasitomala —> Makasitomala a Makasitomala
Sankhani magulu в Kupezeka kwa Makasitomala, kanda Onjezani osankhidwa

Timapeza chinsinsi (ndikuchilembera ku ulusi) chomwe tidzagwiritsa ntchito chilolezo ku Keycloak:

Makasitomala -> kubernetes -> Zizindikiro -> Chinsinsi
Izi zimamaliza kukhazikitsidwa, koma ndinali ndi cholakwika pamene, nditavomerezedwa bwino, ndidalandira cholakwika 403. Ripoti la cholakwika.

Konzani:

Kuchuluka kwa Makasitomala -> maudindo -> Mapu -> Pangani

Mapepala

Script kodi

// add current client-id to token audience
token.addAudience(token.getIssuedFor());

// return token issuer as dummy result assigned to iss again
token.getIssuer();

Kukonza Kubernetes

Tiyenera kufotokoza komwe chiphaso chathu chochokera patsambali chagona, komanso komwe operekera OIDC ali.
Kuti muchite izi, sinthani fayilo /etc/kubernetes/manifests/kube-apiserver.yaml

kukhala-apiserver.yaml


...
spec:
  containers:
  - command:
    - kube-apiserver
...
    - --oidc-ca-file=/var/lib/minikube/certs/My_Root.crt
    - --oidc-client-id=kubernetes
    - --oidc-groups-claim=groups
    - --oidc-issuer-url=https://keycloak.example.org/auth/realms/kubernetes
    - --oidc-username-claim=email
...

Sinthani kasinthidwe ka kubeadm mumagulu:

kukhalaadmconfig

kubectl edit -n kube-system configmaps kubeadm-config


...
data:
  ClusterConfiguration: |
    apiServer:
      extraArgs:
        oidc-ca-file: /var/lib/minikube/certs/My_Root.crt
        oidc-client-id: kubernetes
        oidc-groups-claim: groups
        oidc-issuer-url: https://keycloak.example.org/auth/realms/kubernetes
        oidc-username-claim: email
...

kukhazikitsa kwa auth-proxy

Mutha kugwiritsa ntchito keycloak gatekeeper kuti muteteze pulogalamu yanu yapaintaneti. Kuphatikiza pa mfundo yakuti pulojekitiyi idzavomereza wogwiritsa ntchito musanawonetse tsambalo, idzaperekanso zambiri za inu kumapeto kwa ntchito pamutu. Chifukwa chake, ngati pulogalamu yanu imathandizira OpenID, ndiye kuti wogwiritsa ntchitoyo amaloledwa nthawi yomweyo. Taganizirani chitsanzo cha Kubernetes Dashboard

Kukhazikitsa Kubernetes Dashboard


helm install stable/kubernetes-dashboard --name dashboard -f values_dashboard.yaml

values_dashboard.yaml

enableInsecureLogin: true
service:
  externalPort: 80
rbac:
  clusterAdminRole: true
  create: true
serviceAccount:
  create: true
  name: 'dashboard-test'

Kukhazikitsa maufulu olowa:

Tiyeni tipange ClusterRoleBinding yomwe idzapatse maufulu a admin cluster (standard ClusterRole cluster-admin) kwa ogwiritsa ntchito mugulu la DataOPS.


kubectl apply -f rbac.yaml

rbac.yaml


apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dataops_group
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: DataOPS

Ikani keycloak gatekeeper:


helm repo add gabibbo97 https://gabibbo97.github.io/charts/
helm repo update
helm install gabibbo97/keycloak-gatekeeper --version 2.1.0 --name keycloak-gatekeeper -f values_proxy.yaml

values_proxy.yaml



# Включаем ingress
ingress:
  enabled: true
  annotations:
    kubernetes.io/ingress.class: nginx
  path: /
  hosts:
    - kubernetes-dashboard.example.org
  tls:
   - secretName: tls-keycloak
     hosts:
       - kubernetes-dashboard.example.org

# Говорим где мы будем авторизовываться у OIDC провайдера
discoveryURL: "https://keycloak.example.org/auth/realms/kubernetes"
# Имя клиента которого мы создали в Keycloak
ClientID: "kubernetes"
# Secret который я просил записать
ClientSecret: "c6ec03b8-d0b8-4cb6-97a0-03becba1d727"
# Куда перенаправить в случае успешной авторизации. Формат <SCHEMA>://<SERVICE_NAME>.><NAMESAPCE>.<CLUSTER_NAME>
upstreamURL: "http://dashboard-kubernetes-dashboard.default.svc.cluster.local"
# Пропускаем проверку сертификата, если у нас самоподписанный
skipOpenidProviderTlsVerify: true
# Настройка прав доступа, пускаем на все path если мы в группе DataOPS
rules:
  - "uri=/*|groups=DataOPS"

Pambuyo pake, pamene mukuyesera kupita kubernetes-dashboard.example.org, tidzatumizidwa ku Keycloak ndipo ngati tivomerezedwa bwino tidzafika ku Dashboard yomwe yalowetsedwa kale.

kukhazikitsa gangway

Kuti mumve mosavuta, mutha kuwonjezera gulu lachigawenga lomwe lingapange fayilo yosinthira kubectl, mothandizidwa ndi zomwe titha kulowa Kubernetes pansi pa ogwiritsa ntchito.


helm install --name gangway stable/gangway -f values_gangway.yaml

values_gangway.yaml


gangway:
  # Произвольное имя кластера
  clusterName: "my-k8s"
  # Где у нас OIDC провайдер
  authorizeURL: "https://keycloak.example.org/auth/realms/kubernetes/protocol/openid-connect/auth"
  tokenURL: "https://keycloak.example.org/auth/realms/kubernetes/protocol/openid-connect/token"
  audience: "https://keycloak.example.org/auth/realms/kubernetes/protocol/openid-connect/userinfo"
  # Теоритически сюда можно добавить groups которые мы замапили
  scopes: ["openid", "profile", "email", "offline_access"]
  redirectURL: "https://gangway.example.org/callback"
  # Имя клиента
  clientID: "kubernetes"
  # Секрет
  clientSecret: "c6ec03b8-d0b8-4cb6-97a0-03becba1d727"
  # Если оставить дефолтное значние, то за имя пользователя будет братья <b>Frist name</b> <b>Second name</b>, а при "sub" его логин
  usernameClaim: "sub"
  # Доменное имя или IP адресс API сервера
  apiServerURL: "https://192.168.99.111:8443"

# Включаем Ingress
ingress:
  enabled: true
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/proxy-buffer-size: "64k"
  path: /
  hosts:
  - gangway.example.org
  tls:
  - secretName: tls-keycloak
    hosts:
      - gangway.example.org

# Если используем самоподписанный сертификат, то его(открытый корневой сертификат) надо указать.
trustedCACert: |-
 -----BEGIN CERTIFICATE-----
 MIIDVzCCAj+gAwIBAgIBATANBgkqhkiG9w0BAQsFADA1MQswCQYDVQQGEwJVUzEQMA4GA1UEChMHRGF0YU9QUzEUMBIGA1UEAxMLbXkgcm9vdCBrZXkwHhcNMjAwMjE0MDkxODAwWhcNMzAwMjE0MDkxODAwWjA1MQswCQYDVQQGEwJVUzEQMA4GA1UEChMHRGF0YU9QUzEUMBIGA1UEAxMLbXkgcm9vdCBrZXkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDyP749PqqIRwNSqaK6qr0Zsi03G4PTCUlgaYTPZuMrwUVPK8xX2dWWs9MPRMOdXpgr8aSTZnVfmelIlVz4D7o2vK5rfmAe9GPcK0WbwKwXyhFU0flS9sU/g46ogHFrk03SZxQAeJhMLfEmAJm8LF5HghtGDs3t4uwGsB95o+lqPLiBvxRB8ZS3jSpYpvPgXAuZWKdZUQ3UUZf0X3hGLp7uIcIwJ7i4MduOGaQEO4cePeEJy9aDAO6qV78YmHbyh9kaW+1DL/Sgq8NmTgHGV6UOnAPKHTnMKXl6KkyUz8uLBGIdVhPxrlzG1EzXresJbJenSZ+FZqm3oLqZbw54Yp5hAgMBAAGjcjBwMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHISTOU/6BQqqnOZj+1xJfxpjiG0MAsGA1UdDwQEAwIBBjARBglghkgBhvhCAQEEBAMCAAcwHgYJYIZIAYb4QgENBBEWD3hjYSBjZXJ0aWZpY2F0ZTANBgkqhkiG9w0BAQsFAAOCAQEAj7HC8ObibwOLT4ZYmISJZwub9lcE0AZ5cWkPW39j/syhdbbqjK/6jy2D3WUEbR+s1Vson5Ov7JhN5In2yfZ/ByDvBnoj7CP8Q/ZMjTJgwN7j0rgmEb3CTZvnDPAz8Ijw3FP0cjxfoZ1Z0V2F44Ry7gtLJWr06+MztXVyto3aIz1/XbMQnXYlzc3c3B5yUQIy44Ce5aLRVsAjmXNqVRmDJ2QPNLicvrhnUJsO0zFWI+zZ2hc4Ge1RotCrjfOc9hQY63jZJ17myCZ6QCD7yzMzAob4vrgmkD4q7tpGrhPY/gDcE+lUNhC7DO3l0oPy2wsnT2TEn87eyWmDiTFG9zWDew==
 -----END CERTIFICATE-----

Zikuwoneka ngati izi. Imakulolani kuti mutsitse nthawi yomweyo fayilo ya config ndikuipanga pogwiritsa ntchito malamulo angapo:

Source: www.habr.com

Timakhazikitsa chilolezo cha ActiveDirectory ku Kubernetes pogwiritsa ntchito Keycloak