mirror of
https://github.com/versity/versitygw.git
synced 2026-09-22 16:04:15 +00:00
niksis02
658c37907d
Closes #2364 `AssumeRoleWithWebIdentity` only ever trusted an `OIDC` provider reachable over verified `https`, at a publicly routable address, on the implicit `:443`. That posture is right for an internet-facing IdP but rejects every address an internal one can have, so a `SPIFFE/SPIRE` OIDC discovery provider in the same cluster — or as a sidecar in the same pod — could never be registered, let alone verified against, and no setting could express "this private address is the IdP". Two opt-in flags on `versitygw iam`, both off by default: `--oidc-allow-private-endpoints` Permit a provider `Url` resolving to a loopback/private/link-local address, and an explicit port. Transport is unchanged: still `https`, still fully verified (a self-signed in-cluster cert is trusted the way AWS documents, through `ThumbprintList`). `--oidc-allow-insecure-transport` Additionally permit plaintext `http` provider URLs, discovery/JWKS endpoints and redirects, and drop TLS verification (`thumbprint` pinning included) for `https` ones. Both apply uniformly to the thumbprint auto-fetch at `CreateOpenIDConnectProvider` time and to the discovery-document plus `JWKS` fetch at `AssumeRoleWithWebIdentity` time. Neither weakens anything past the endpoint: signature verification, issuer matching, audience and trust policy evaluation are untouched, and the DNS-resolve-once/dial-the-resolved-IP shape stays in place so a rebind still cannot redirect a connection. An `http` provider keeps its scheme in its stored `Url`, `ARN` and `iss` matching, rather than being stripped like an `https` one — otherwise `"http://host"` and `"https://host"` would collapse onto a single ARN and storage key and each could satisfy the other's trust policy. It also stores an empty `ThumbprintList` rather than failing: a plaintext provider presents no certificate to thumbprint. Helm: `iamServer.oidc.{allowPrivateEndpoints,allowInsecureTransport}`, alongside `disableThumbprintAutofetch` moved into the same block (the flat `iamServer.disableOidcThumbprintAutofetch` stays honored). Chart `0.4.1 -> 0.4.2`. The WebUI's create-provider form no longer rejects `http` URLs and ports client-side; it cannot see the service's settings, so those two rules are left to the server, whose error surfaces as a toast like any other.
156 lines
5.1 KiB
Plaintext
156 lines
5.1 KiB
Plaintext
##########################################
|
|
# VersityGW standalone IAM configuration #
|
|
##########################################
|
|
|
|
# Copy this file to /etc/versitygw.d/ and rename it to a unique service name.
|
|
# For example, /etc/versitygw.d/iam.conf is started with:
|
|
# systemctl start versitygw@iam
|
|
# systemctl enable versitygw@iam
|
|
|
|
##############################
|
|
# VersityGW Required Options #
|
|
##############################
|
|
|
|
# Run the standalone IAM API server.
|
|
VGW_BACKEND=iam
|
|
|
|
# The IAM API needs one storage backend. Set VGW_IAM_DIR for local file-backed
|
|
# storage, or configure VGW_IAM_VAULT_ENDPOINT_URL and its authentication
|
|
# options below for HashiCorp Vault storage.
|
|
VGW_IAM_DIR=/var/lib/versitygw/iam
|
|
|
|
# The access and secret options specify the root account credentials. The root
|
|
# account has full authorization to IAM API requests after authentication.
|
|
ROOT_ACCESS_KEY_ID=
|
|
ROOT_SECRET_ACCESS_KEY=
|
|
|
|
############################
|
|
# VersityGW Global Options #
|
|
############################
|
|
|
|
# The IAM API listener address. It accepts the same comma-separated TCP or
|
|
# UNIX-socket addresses as the gateway, for example :7076 or /run/vgw/iam.sock.
|
|
#VGW_PORT=:7076
|
|
|
|
# TLS certificate and private key for the IAM API listener.
|
|
#VGW_CERT=
|
|
#VGW_KEY=
|
|
|
|
# Maximum concurrent connections and in-flight requests.
|
|
#VGW_MAX_CONNECTIONS=250000
|
|
#VGW_MAX_REQUESTS=100000
|
|
|
|
# Region returned by IAM responses. Defaults to us-east-1.
|
|
#VGW_REGION=us-east-1
|
|
|
|
# Silence request logging to stdout.
|
|
#VGW_QUIET=false
|
|
|
|
# Enable HTTP keep-alive connections.
|
|
#VGW_KEEP_ALIVE=false
|
|
|
|
# File-mode permissions for file-backed UNIX sockets, as an octal integer.
|
|
#VGW_SOCKET_PERM=
|
|
|
|
# Configure this when a browser-based WebUI on another origin accesses IAM.
|
|
#VGW_CORS_ALLOW_ORIGIN=
|
|
|
|
# Override the S3 gateway URLs offered by the WebUI. Specify one or more
|
|
# comma-separated URLs, for example http://localhost:7070 or
|
|
# https://s3.example.com.
|
|
#VGW_WEBUI_GATEWAYS=
|
|
|
|
#################
|
|
# Vault Storage #
|
|
#################
|
|
|
|
# Use Vault instead of VGW_IAM_DIR by setting the Vault endpoint and suitable
|
|
# credentials.
|
|
|
|
# Vault server URL for IAM storage.
|
|
#VGW_IAM_VAULT_ENDPOINT_URL=
|
|
|
|
# Fallback Vault namespace for both AppRole authentication and KV v2 storage.
|
|
# The more-specific authentication and storage namespace options override it.
|
|
#VGW_IAM_VAULT_NAMESPACE=
|
|
|
|
# KV v2 path prefix used to store IAM users. Defaults to iam.
|
|
#VGW_IAM_VAULT_SECRET_STORAGE_PATH=iam
|
|
|
|
# Vault namespace for the KV v2 IAM storage path. Overrides VGW_IAM_VAULT_NAMESPACE.
|
|
#VGW_IAM_VAULT_SECRET_STORAGE_NAMESPACE=
|
|
|
|
# Vault authentication method mount path. Defaults to approle.
|
|
#VGW_IAM_VAULT_AUTH_METHOD=approle
|
|
|
|
# Vault namespace used for AppRole login. Overrides VGW_IAM_VAULT_NAMESPACE.
|
|
#VGW_IAM_VAULT_AUTH_NAMESPACE=
|
|
|
|
# Vault KV v2 secrets engine mount path. Defaults to kv-v2.
|
|
#VGW_IAM_VAULT_MOUNT_PATH=kv-v2
|
|
|
|
# Vault root token for authentication. Do not set this with the AppRole ID or
|
|
# secret options below.
|
|
#VGW_IAM_VAULT_ROOT_TOKEN=
|
|
|
|
# Vault AppRole role ID for authentication. Set with VGW_IAM_VAULT_ROLE_SECRET
|
|
# instead of VGW_IAM_VAULT_ROOT_TOKEN.
|
|
#VGW_IAM_VAULT_ROLE_ID=
|
|
|
|
# Vault AppRole secret ID for authentication. Set with VGW_IAM_VAULT_ROLE_ID
|
|
# instead of VGW_IAM_VAULT_ROOT_TOKEN.
|
|
#VGW_IAM_VAULT_ROLE_SECRET=
|
|
|
|
# PEM-encoded Vault server TLS certificate used to verify the Vault server.
|
|
#VGW_IAM_VAULT_SERVER_CERT=
|
|
|
|
# PEM-encoded client TLS certificate presented to Vault.
|
|
#VGW_IAM_VAULT_CLIENT_CERT=
|
|
|
|
# PEM-encoded private key for VGW_IAM_VAULT_CLIENT_CERT.
|
|
#VGW_IAM_VAULT_CLIENT_CERT_KEY=
|
|
|
|
############################
|
|
# Private IAM API Listener #
|
|
############################
|
|
|
|
# This private endpoint serves the VersityGW protocol used by S3 gateway
|
|
# instances to communicate directly with the standalone IAM service.
|
|
|
|
# Private endpoint listen addresses. Set one or more comma-separated UNIX
|
|
# socket paths, or TCP addresses such as :7077 or 127.0.0.1:7077. TCP listeners
|
|
# require the three mTLS settings below; UNIX sockets do not.
|
|
#VGW_IAM_PRIVATE_PORTS=
|
|
|
|
# TLS server certificate for TCP private endpoint listeners.
|
|
#VGW_IAM_PRIVATE_CERT=
|
|
|
|
# TLS private key for VGW_IAM_PRIVATE_CERT.
|
|
#VGW_IAM_PRIVATE_CERT_KEY=
|
|
|
|
# PEM-encoded CA bundle used to verify the S3 gateway's client certificate on
|
|
# TCP private endpoint listeners.
|
|
#VGW_IAM_PRIVATE_CLIENT_CA=
|
|
|
|
# Octal permissions for file-backed UNIX private sockets, for example 0660.
|
|
# This does not affect TCP or Linux abstract-namespace sockets.
|
|
#VGW_IAM_PRIVATE_SOCKET_PERM=
|
|
|
|
#################
|
|
# OIDC Settings #
|
|
#################
|
|
|
|
# Reject OIDC provider creation without an explicit certificate thumbprint.
|
|
#VGW_IAM_DISABLE_OIDC_THUMBPRINT_AUTOFETCH=false
|
|
|
|
# Allow OIDC provider URLs that resolve to loopback/private/link-local
|
|
# addresses and that carry an explicit port; needed for an identity provider
|
|
# that only exists on an internal network, and also re-permits cloud
|
|
# metadata endpoints as fetch targets.
|
|
#VGW_IAM_OIDC_ALLOW_PRIVATE_ENDPOINTS=false
|
|
|
|
# Allow plaintext http OIDC provider URLs and skip TLS certificate
|
|
# verification (thumbprint pinning included) for https ones; only for an
|
|
# identity provider reached over an already-trusted path, such as a
|
|
# loopback-bound sidecar.
|
|
#VGW_IAM_OIDC_ALLOW_INSECURE_TRANSPORT=false |