mirror of
https://github.com/versity/versitygw.git
synced 2026-09-22 16:04:15 +00:00
niksis02
1c1272c8a5
`AssumeRoleWithWebIdentity` always fetched a provider's discovery document from `<provider url>/.well-known/openid-configuration`, so an identity provider that issues tokens naming a public issuer while serving its metadata and keys on a cluster-internal path could not be used: reaching it meant relaxing the endpoint checks for every registered provider. `--oidc-discovery-url` moves that one fetch to an operator-named endpoint, which is how keys can be looked up over an optimized private path while the tokens themselves stay verifiable from the public internet against the issuer alone, as the JWT spec requires. The flag takes `<provider url>=<discovery url>` pairs, can be repeated once per provider, and is also read from `VGW_IAM_OIDC_DISCOVERY_URLS` as a comma-separated list; the Helm chart exposes the same list as `iamServer.oidc.discoveryUrls`. The discovery URL is fetched exactly as written, so it must carry the `/.well-known/openid-configuration` path when the provider serves it there. A malformed pair is rejected at startup rather than at the first assume-role call. Only the fetch moves. The provider URL is still what a token's `iss` claim is matched against, the fetched document's own `issuer` field must still equal it, and the key set still comes from the `jwks_uri` that document publishes. A configured discovery endpoint is named by the operator at startup rather than by a request, so it and the `jwks_uri` it publishes waive the private-address check for that provider's fetch chain only, without `--oidc-allow-private-endpoints` and its far broader effect on every other provider. Transport rules are unchanged: a plaintext discovery URL still requires `--oidc-allow-insecure-transport`. Thumbprint auto-fetch follows the override and pins the discovery endpoint's certificate chain, since that is the host every later fetch is verified against.
165 lines
5.7 KiB
Plaintext
165 lines
5.7 KiB
Plaintext
##########################################
|
|
# VersityGW standalone IAM configuration #
|
|
##########################################
|
|
|
|
# Copy this file to /etc/versitygw.d/ and rename it to a unique service name.
|
|
# For example, /etc/versitygw.d/iam.conf is started with:
|
|
# systemctl start versitygw@iam
|
|
# systemctl enable versitygw@iam
|
|
|
|
##############################
|
|
# VersityGW Required Options #
|
|
##############################
|
|
|
|
# Run the standalone IAM API server.
|
|
VGW_BACKEND=iam
|
|
|
|
# The IAM API needs one storage backend. Set VGW_IAM_DIR for local file-backed
|
|
# storage, or configure VGW_IAM_VAULT_ENDPOINT_URL and its authentication
|
|
# options below for HashiCorp Vault storage.
|
|
VGW_IAM_DIR=/var/lib/versitygw/iam
|
|
|
|
# The access and secret options specify the root account credentials. The root
|
|
# account has full authorization to IAM API requests after authentication.
|
|
ROOT_ACCESS_KEY_ID=
|
|
ROOT_SECRET_ACCESS_KEY=
|
|
|
|
############################
|
|
# VersityGW Global Options #
|
|
############################
|
|
|
|
# The IAM API listener address. It accepts the same comma-separated TCP or
|
|
# UNIX-socket addresses as the gateway, for example :7076 or /run/vgw/iam.sock.
|
|
#VGW_PORT=:7076
|
|
|
|
# TLS certificate and private key for the IAM API listener.
|
|
#VGW_CERT=
|
|
#VGW_KEY=
|
|
|
|
# Maximum concurrent connections and in-flight requests.
|
|
#VGW_MAX_CONNECTIONS=250000
|
|
#VGW_MAX_REQUESTS=100000
|
|
|
|
# Region returned by IAM responses. Defaults to us-east-1.
|
|
#VGW_REGION=us-east-1
|
|
|
|
# Silence request logging to stdout.
|
|
#VGW_QUIET=false
|
|
|
|
# Enable HTTP keep-alive connections.
|
|
#VGW_KEEP_ALIVE=false
|
|
|
|
# File-mode permissions for file-backed UNIX sockets, as an octal integer.
|
|
#VGW_SOCKET_PERM=
|
|
|
|
# Configure this when a browser-based WebUI on another origin accesses IAM.
|
|
#VGW_CORS_ALLOW_ORIGIN=
|
|
|
|
# Override the S3 gateway URLs offered by the WebUI. Specify one or more
|
|
# comma-separated URLs, for example http://localhost:7070 or
|
|
# https://s3.example.com.
|
|
#VGW_WEBUI_GATEWAYS=
|
|
|
|
#################
|
|
# Vault Storage #
|
|
#################
|
|
|
|
# Use Vault instead of VGW_IAM_DIR by setting the Vault endpoint and suitable
|
|
# credentials.
|
|
|
|
# Vault server URL for IAM storage.
|
|
#VGW_IAM_VAULT_ENDPOINT_URL=
|
|
|
|
# Fallback Vault namespace for both AppRole authentication and KV v2 storage.
|
|
# The more-specific authentication and storage namespace options override it.
|
|
#VGW_IAM_VAULT_NAMESPACE=
|
|
|
|
# KV v2 path prefix used to store IAM users. Defaults to iam.
|
|
#VGW_IAM_VAULT_SECRET_STORAGE_PATH=iam
|
|
|
|
# Vault namespace for the KV v2 IAM storage path. Overrides VGW_IAM_VAULT_NAMESPACE.
|
|
#VGW_IAM_VAULT_SECRET_STORAGE_NAMESPACE=
|
|
|
|
# Vault authentication method mount path. Defaults to approle.
|
|
#VGW_IAM_VAULT_AUTH_METHOD=approle
|
|
|
|
# Vault namespace used for AppRole login. Overrides VGW_IAM_VAULT_NAMESPACE.
|
|
#VGW_IAM_VAULT_AUTH_NAMESPACE=
|
|
|
|
# Vault KV v2 secrets engine mount path. Defaults to kv-v2.
|
|
#VGW_IAM_VAULT_MOUNT_PATH=kv-v2
|
|
|
|
# Vault root token for authentication. Do not set this with the AppRole ID or
|
|
# secret options below.
|
|
#VGW_IAM_VAULT_ROOT_TOKEN=
|
|
|
|
# Vault AppRole role ID for authentication. Set with VGW_IAM_VAULT_ROLE_SECRET
|
|
# instead of VGW_IAM_VAULT_ROOT_TOKEN.
|
|
#VGW_IAM_VAULT_ROLE_ID=
|
|
|
|
# Vault AppRole secret ID for authentication. Set with VGW_IAM_VAULT_ROLE_ID
|
|
# instead of VGW_IAM_VAULT_ROOT_TOKEN.
|
|
#VGW_IAM_VAULT_ROLE_SECRET=
|
|
|
|
# PEM-encoded Vault server TLS certificate used to verify the Vault server.
|
|
#VGW_IAM_VAULT_SERVER_CERT=
|
|
|
|
# PEM-encoded client TLS certificate presented to Vault.
|
|
#VGW_IAM_VAULT_CLIENT_CERT=
|
|
|
|
# PEM-encoded private key for VGW_IAM_VAULT_CLIENT_CERT.
|
|
#VGW_IAM_VAULT_CLIENT_CERT_KEY=
|
|
|
|
############################
|
|
# Private IAM API Listener #
|
|
############################
|
|
|
|
# This private endpoint serves the VersityGW protocol used by S3 gateway
|
|
# instances to communicate directly with the standalone IAM service.
|
|
|
|
# Private endpoint listen addresses. Set one or more comma-separated UNIX
|
|
# socket paths, or TCP addresses such as :7077 or 127.0.0.1:7077. TCP listeners
|
|
# require the three mTLS settings below; UNIX sockets do not.
|
|
#VGW_IAM_PRIVATE_PORTS=
|
|
|
|
# TLS server certificate for TCP private endpoint listeners.
|
|
#VGW_IAM_PRIVATE_CERT=
|
|
|
|
# TLS private key for VGW_IAM_PRIVATE_CERT.
|
|
#VGW_IAM_PRIVATE_CERT_KEY=
|
|
|
|
# PEM-encoded CA bundle used to verify the S3 gateway's client certificate on
|
|
# TCP private endpoint listeners.
|
|
#VGW_IAM_PRIVATE_CLIENT_CA=
|
|
|
|
# Octal permissions for file-backed UNIX private sockets, for example 0660.
|
|
# This does not affect TCP or Linux abstract-namespace sockets.
|
|
#VGW_IAM_PRIVATE_SOCKET_PERM=
|
|
|
|
#################
|
|
# OIDC Settings #
|
|
#################
|
|
|
|
# Reject OIDC provider creation without an explicit certificate thumbprint.
|
|
#VGW_IAM_DISABLE_OIDC_THUMBPRINT_AUTOFETCH=false
|
|
|
|
# Allow OIDC provider URLs that resolve to loopback/private/link-local
|
|
# addresses and that carry an explicit port; needed for an identity provider
|
|
# that only exists on an internal network, and also re-permits cloud
|
|
# metadata endpoints as fetch targets.
|
|
#VGW_IAM_OIDC_ALLOW_PRIVATE_ENDPOINTS=false
|
|
|
|
# Allow plaintext http OIDC provider URLs and skip TLS certificate
|
|
# verification (thumbprint pinning included) for https ones; only for an
|
|
# identity provider reached over an already-trusted path, such as a
|
|
# loopback-bound sidecar.
|
|
#VGW_IAM_OIDC_ALLOW_INSECURE_TRANSPORT=false
|
|
|
|
# Fetch one OIDC provider's discovery document from somewhere other than the
|
|
# provider URL itself, as '<provider url>=<discovery url>'. Specify one or
|
|
# more comma-separated entries. The discovery URL is fetched exactly as
|
|
# given, so include the '/.well-known/openid-configuration' path, and it may
|
|
# be a private in-cluster address without VGW_IAM_OIDC_ALLOW_PRIVATE_ENDPOINTS.
|
|
# Tokens are still matched against the provider URL, and keys are still read
|
|
# from the jwks_uri the fetched document publishes.
|
|
#VGW_IAM_OIDC_DISCOVERY_URLS= |