mirror of
https://github.com/versity/versitygw.git
synced 2026-09-24 08:54:47 +00:00
niksis02
658c37907d
Closes #2364 `AssumeRoleWithWebIdentity` only ever trusted an `OIDC` provider reachable over verified `https`, at a publicly routable address, on the implicit `:443`. That posture is right for an internet-facing IdP but rejects every address an internal one can have, so a `SPIFFE/SPIRE` OIDC discovery provider in the same cluster — or as a sidecar in the same pod — could never be registered, let alone verified against, and no setting could express "this private address is the IdP". Two opt-in flags on `versitygw iam`, both off by default: `--oidc-allow-private-endpoints` Permit a provider `Url` resolving to a loopback/private/link-local address, and an explicit port. Transport is unchanged: still `https`, still fully verified (a self-signed in-cluster cert is trusted the way AWS documents, through `ThumbprintList`). `--oidc-allow-insecure-transport` Additionally permit plaintext `http` provider URLs, discovery/JWKS endpoints and redirects, and drop TLS verification (`thumbprint` pinning included) for `https` ones. Both apply uniformly to the thumbprint auto-fetch at `CreateOpenIDConnectProvider` time and to the discovery-document plus `JWKS` fetch at `AssumeRoleWithWebIdentity` time. Neither weakens anything past the endpoint: signature verification, issuer matching, audience and trust policy evaluation are untouched, and the DNS-resolve-once/dial-the-resolved-IP shape stays in place so a rebind still cannot redirect a connection. An `http` provider keeps its scheme in its stored `Url`, `ARN` and `iss` matching, rather than being stripped like an `https` one — otherwise `"http://host"` and `"https://host"` would collapse onto a single ARN and storage key and each could satisfy the other's trust policy. It also stores an empty `ThumbprintList` rather than failing: a plaintext provider presents no certificate to thumbprint. Helm: `iamServer.oidc.{allowPrivateEndpoints,allowInsecureTransport}`, alongside `disableThumbprintAutofetch` moved into the same block (the flat `iamServer.disableOidcThumbprintAutofetch` stays honored). Chart `0.4.1 -> 0.4.2`. The WebUI's create-provider form no longer rejects `http` URLs and ports client-side; it cannot see the service's settings, so those two rules are left to the server, whose error surfaces as a toast like any other.
314 lines
14 KiB
YAML
314 lines
14 KiB
YAML
{{- $iamServer := .Values.iamServer | default dict -}}
|
|
{{- if ($iamServer.enabled | default false) }}
|
|
{{- $iamServerAuth := .Values.iamServer.auth | default dict -}}
|
|
{{- $iamServerOidc := .Values.iamServer.oidc | default dict -}}
|
|
{{- if not (or (eq .Values.iamServer.storage.type "internal") (eq .Values.iamServer.storage.type "vault")) }}
|
|
{{- fail "iamServer.storage.type must be either internal or vault" }}
|
|
{{- end }}
|
|
{{- if and (gt (int .Values.iamServer.replicaCount) 1) (eq .Values.iamServer.storage.type "internal") }}
|
|
{{- fail "iamServer.replicaCount > 1 requires iamServer.storage.type=vault; the internal file store does not coordinate concurrent writers" }}
|
|
{{- end }}
|
|
{{- if and (eq .Values.iamServer.storage.type "internal") .Values.iamServer.persistence.enabled (not .Values.iamServer.persistence.create) (not .Values.iamServer.persistence.claimName) }}
|
|
{{- fail "iamServer.persistence.claimName is required when iamServer.persistence.create is false" }}
|
|
{{- end }}
|
|
{{- if and (eq .Values.iamServer.storage.type "vault") (not .Values.iamServer.storage.vault.endpointUrl) }}
|
|
{{- fail "iamServer.storage.vault.endpointUrl is required when iamServer.storage.type=vault" }}
|
|
{{- end }}
|
|
{{- if and .Values.iamServer.private.enabled (not .Values.iamServer.private.certificate.create) (not .Values.iamServer.private.certificate.existingSecret) }}
|
|
{{- fail "iamServer.private.enabled requires either iamServer.private.certificate.create=true or iamServer.private.certificate.existingSecret" }}
|
|
{{- end }}
|
|
{{- if and .Values.iamServer.private.enabled .Values.iamServer.private.certificate.create (not .Values.iamServer.private.certificate.existingSecret) (not .Values.iamServer.private.certificate.issuerRef.name) }}
|
|
{{- fail "iamServer.private.certificate.issuerRef.name is required when creating the IAM server certificate" }}
|
|
{{- end }}
|
|
{{- if and .Values.iamServer.private.enabled (eq (int .Values.iamServer.private.port) (int .Values.iamServer.port)) }}
|
|
{{- fail "iamServer.private.port must differ from iamServer.port" }}
|
|
{{- end }}
|
|
{{- if and .Values.iamServer.tls.enabled (not .Values.iamServer.tls.secretName) }}
|
|
{{- fail "iamServer.tls.secretName is required when iamServer.tls.enabled=true" }}
|
|
{{- end }}
|
|
{{- if not (or (eq .Values.iamServer.logLevel "silent") (eq .Values.iamServer.logLevel "debug") (eq .Values.iamServer.logLevel "unsafe")) }}
|
|
{{- fail "iamServer.logLevel must be one of silent, debug, or unsafe" }}
|
|
{{- end }}
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "versitygw.iamServerFullname" . }}
|
|
labels:
|
|
{{- include "versitygw.iamServerLabels" . | nindent 4 }}
|
|
{{- with .Values.iamServer.deploymentAnnotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
replicas: {{ .Values.iamServer.replicaCount }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "versitygw.iamServerSelectorLabels" . | nindent 6 }}
|
|
{{- if eq .Values.iamServer.storage.type "internal" }}
|
|
# Avoid overlapping file-store writers and ReadWriteOnce multi-attach errors
|
|
# while a new ReplicaSet replaces the old one.
|
|
strategy:
|
|
type: Recreate
|
|
{{- else }}
|
|
{{- with .Values.iamServer.strategy }}
|
|
strategy:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
{{- if and (not $iamServerAuth.existingSecret) (not .Values.auth.existingSecret) }}
|
|
checksum/credentials: {{ cat .Release.Name .Values.auth.accessKey .Values.auth.secretKey | sha256sum | trunc 12 }}
|
|
{{- end }}
|
|
{{- with .Values.iamServer.podAnnotations }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "versitygw.iamServerSelectorLabels" . | nindent 8 }}
|
|
{{- with .Values.iamServer.podLabels }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
{{- with .Values.image.pullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
serviceAccountName: {{ include "versitygw.serviceAccountName" . }}
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
|
containers:
|
|
- name: iam-server
|
|
image: "{{ .Values.iamServer.image.repository | default .Values.image.repository }}:{{ .Values.iamServer.image.tag | default .Values.image.tag }}"
|
|
imagePullPolicy: {{ .Values.iamServer.image.pullPolicy | default .Values.image.pullPolicy }}
|
|
env:
|
|
- name: VGW_BACKEND
|
|
value: "iam"
|
|
# Root credentials -- sourced from the same Kubernetes Secret as the gateway
|
|
- name: ROOT_ACCESS_KEY_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "versitygw.iamServerCredentialsSecretName" . }}
|
|
key: rootAccessKeyId
|
|
- name: ROOT_SECRET_ACCESS_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "versitygw.iamServerCredentialsSecretName" . }}
|
|
key: rootSecretAccessKey
|
|
- name: VGW_PORT
|
|
value: ":{{ .Values.iamServer.port }}"
|
|
- name: VGW_HEALTH
|
|
value: "/_/health"
|
|
- name: VGW_MAX_CONNECTIONS
|
|
value: {{ .Values.iamServer.maxConnections | quote }}
|
|
- name: VGW_MAX_REQUESTS
|
|
value: {{ .Values.iamServer.maxRequests | quote }}
|
|
{{- if .Values.iamServer.quiet }}
|
|
- name: VGW_QUIET
|
|
value: "true"
|
|
{{- end }}
|
|
{{- if ne .Values.iamServer.logLevel "silent" }}
|
|
- name: VGW_LOG_LEVEL
|
|
value: {{ .Values.iamServer.logLevel | quote }}
|
|
{{- end }}
|
|
{{- if or $iamServerOidc.disableThumbprintAutofetch .Values.iamServer.disableOidcThumbprintAutofetch }}
|
|
- name: VGW_IAM_DISABLE_OIDC_THUMBPRINT_AUTOFETCH
|
|
value: "true"
|
|
{{- end }}
|
|
{{- if $iamServerOidc.allowPrivateEndpoints }}
|
|
- name: VGW_IAM_OIDC_ALLOW_PRIVATE_ENDPOINTS
|
|
value: "true"
|
|
{{- end }}
|
|
{{- if $iamServerOidc.allowInsecureTransport }}
|
|
- name: VGW_IAM_OIDC_ALLOW_INSECURE_TRANSPORT
|
|
value: "true"
|
|
{{- end }}
|
|
{{- if .Values.iamServer.corsAllowOrigin }}
|
|
- name: VGW_CORS_ALLOW_ORIGIN
|
|
value: {{ .Values.iamServer.corsAllowOrigin | quote }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.tls.enabled }}
|
|
- name: VGW_CERT
|
|
value: /certs/tls.crt
|
|
- name: VGW_KEY
|
|
value: /certs/tls.key
|
|
{{- end }}
|
|
# Storage backend
|
|
{{- if eq .Values.iamServer.storage.type "internal" }}
|
|
- name: VGW_IAM_DIR
|
|
value: "/mnt/iam"
|
|
{{- else if eq .Values.iamServer.storage.type "vault" }}
|
|
- name: VGW_IAM_VAULT_ENDPOINT_URL
|
|
value: {{ .Values.iamServer.storage.vault.endpointUrl | quote }}
|
|
{{- if .Values.iamServer.storage.vault.namespace }}
|
|
- name: VGW_IAM_VAULT_NAMESPACE
|
|
value: {{ .Values.iamServer.storage.vault.namespace | quote }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.storage.vault.secretStoragePath }}
|
|
- name: VGW_IAM_VAULT_SECRET_STORAGE_PATH
|
|
value: {{ .Values.iamServer.storage.vault.secretStoragePath | quote }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.storage.vault.secretStorageNamespace }}
|
|
- name: VGW_IAM_VAULT_SECRET_STORAGE_NAMESPACE
|
|
value: {{ .Values.iamServer.storage.vault.secretStorageNamespace | quote }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.storage.vault.authMethod }}
|
|
- name: VGW_IAM_VAULT_AUTH_METHOD
|
|
value: {{ .Values.iamServer.storage.vault.authMethod | quote }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.storage.vault.authNamespace }}
|
|
- name: VGW_IAM_VAULT_AUTH_NAMESPACE
|
|
value: {{ .Values.iamServer.storage.vault.authNamespace | quote }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.storage.vault.mountPath }}
|
|
- name: VGW_IAM_VAULT_MOUNT_PATH
|
|
value: {{ .Values.iamServer.storage.vault.mountPath | quote }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.storage.vault.roleId }}
|
|
- name: VGW_IAM_VAULT_ROLE_ID
|
|
value: {{ .Values.iamServer.storage.vault.roleId | quote }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.storage.vault.existingSecret }}
|
|
- name: VGW_IAM_VAULT_ROLE_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.iamServer.storage.vault.existingSecret }}
|
|
key: roleSecret
|
|
optional: true
|
|
- name: VGW_IAM_VAULT_ROOT_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.iamServer.storage.vault.existingSecret }}
|
|
key: rootToken
|
|
optional: true
|
|
{{- end }}
|
|
{{- if .Values.iamServer.storage.vault.tlsExistingSecret }}
|
|
{{- if not .Values.iamServer.storage.vault.serverCert }}
|
|
- name: VGW_IAM_VAULT_SERVER_CERT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.iamServer.storage.vault.tlsExistingSecret }}
|
|
key: serverCert
|
|
optional: true
|
|
{{- end }}
|
|
{{- if not .Values.iamServer.storage.vault.clientCert }}
|
|
- name: VGW_IAM_VAULT_CLIENT_CERT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.iamServer.storage.vault.tlsExistingSecret }}
|
|
key: clientCert
|
|
optional: true
|
|
{{- end }}
|
|
{{- if not .Values.iamServer.storage.vault.clientCertKey }}
|
|
- name: VGW_IAM_VAULT_CLIENT_CERT_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.iamServer.storage.vault.tlsExistingSecret }}
|
|
key: clientCertKey
|
|
optional: true
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.storage.vault.serverCert }}
|
|
- name: VGW_IAM_VAULT_SERVER_CERT
|
|
value: |
|
|
{{- .Values.iamServer.storage.vault.serverCert | nindent 16 }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.storage.vault.clientCert }}
|
|
- name: VGW_IAM_VAULT_CLIENT_CERT
|
|
value: |
|
|
{{- .Values.iamServer.storage.vault.clientCert | nindent 16 }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.storage.vault.clientCertKey }}
|
|
- name: VGW_IAM_VAULT_CLIENT_CERT_KEY
|
|
value: |
|
|
{{- .Values.iamServer.storage.vault.clientCertKey | nindent 16 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
# Private mTLS endpoint
|
|
{{- if .Values.iamServer.private.enabled }}
|
|
- name: VGW_IAM_PRIVATE_PORTS
|
|
value: ":{{ .Values.iamServer.private.port }}"
|
|
- name: VGW_IAM_PRIVATE_CERT
|
|
value: /iam-private-certs/tls.crt
|
|
- name: VGW_IAM_PRIVATE_CERT_KEY
|
|
value: /iam-private-certs/tls.key
|
|
- name: VGW_IAM_PRIVATE_CLIENT_CA
|
|
value: /iam-private-certs/ca.crt
|
|
{{- end }}
|
|
ports:
|
|
- name: iam-api
|
|
containerPort: {{ .Values.iamServer.port }}
|
|
protocol: TCP
|
|
{{- if .Values.iamServer.private.enabled }}
|
|
- name: iam-private
|
|
containerPort: {{ .Values.iamServer.private.port }}
|
|
protocol: TCP
|
|
{{- end }}
|
|
readinessProbe:
|
|
httpGet:
|
|
path: "/_/health"
|
|
port: iam-api
|
|
{{- if .Values.iamServer.tls.enabled }}
|
|
scheme: HTTPS
|
|
{{- end }}
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 15
|
|
securityContext:
|
|
{{- toYaml .Values.securityContext | nindent 12 }}
|
|
resources:
|
|
{{- toYaml .Values.iamServer.resources | nindent 12 }}
|
|
terminationMessagePolicy: FallbackToLogsOnError
|
|
volumeMounts:
|
|
{{- if eq .Values.iamServer.storage.type "internal" }}
|
|
- name: data
|
|
mountPath: /mnt/iam
|
|
readOnly: false
|
|
{{- end }}
|
|
{{- if .Values.iamServer.private.enabled }}
|
|
- name: private-certs
|
|
mountPath: /iam-private-certs
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.iamServer.tls.enabled }}
|
|
- name: certificates
|
|
mountPath: /certs
|
|
readOnly: true
|
|
{{- end }}
|
|
volumes:
|
|
{{- if eq .Values.iamServer.storage.type "internal" }}
|
|
- name: data
|
|
{{- if .Values.iamServer.persistence.enabled }}
|
|
persistentVolumeClaim:
|
|
claimName: {{ include "versitygw.iamServerPvcName" . }}
|
|
{{- else }}
|
|
emptyDir: {}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.iamServer.private.enabled }}
|
|
- name: private-certs
|
|
secret:
|
|
secretName: {{ include "versitygw.iamServerPrivateCertSecretName" . }}
|
|
defaultMode: 0440
|
|
{{- end }}
|
|
{{- if .Values.iamServer.tls.enabled }}
|
|
- name: certificates
|
|
secret:
|
|
secretName: {{ .Values.iamServer.tls.secretName }}
|
|
defaultMode: 0440
|
|
{{- end }}
|
|
|
|
{{- with .Values.iamServer.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.iamServer.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.iamServer.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- end }}
|