![Install Dex Using Helm
โ helm repo add dex https://charts.dexidp.io
โ helm install dex dex/dex -f dex-values.yaml
NAME: dex
LAST DEPLOYED: Wed Mar 17 21:06:49 2021
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=dex,app.kubernetes.io/instance=dex" -o
jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT](https://image.slidesharecdn.com/kasten-securingaccesstoyourkubernetesapplications-210401115155/85/Kasten-securing-access-to-your-kubernetes-applications-6-320.jpg)
![Port Forwarding
kubectl --namespace dex port-forward $POD_NAME 8080:$CONTAINER_PORT
Forwarding from 127.0.0.1:8080 -> 5556
Forwarding from [::1]:8080 -> 5556](https://image.slidesharecdn.com/kasten-securingaccesstoyourkubernetesapplications-210401115155/85/Kasten-securing-access-to-your-kubernetes-applications-11-320.jpg)
![Demo
Claims:
{
"iss": "http://127.0.0.1:8080",
"sub": "CgVvbmthchIEbGRhcA",
"aud": "example-app",
"exp": 1616037593,
"iat": 1615951193,
"at_hash": "S9b817ZpFhdA6Ezw-nEEdA",
"email": "onkar",
"email_verified": true,
"groups": [
"K10admins"
],
"name": "onkar",
"preferred_username": "onkar"
}](https://image.slidesharecdn.com/kasten-securingaccesstoyourkubernetesapplications-210401115155/85/Kasten-securing-access-to-your-kubernetes-applications-14-320.jpg)
![Roles and ClusterRoles
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: default
name: example-role
Rules: # multiple rules can be added
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "watch", "list"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "watch", "list"]
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
# "namespace" omitted since ClusterRoles
are not namespaced
name: example-clusterole
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["create", "get"
, "watch", "list"]](https://image.slidesharecdn.com/kasten-securingaccesstoyourkubernetesapplications-210401115155/85/Kasten-securing-access-to-your-kubernetes-applications-17-320.jpg)
![Rules and Resources
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: default
name: example-role
rules:
- apiGroups: ["mygroup.example.com"
]
resources: ["pods"]
resourceNames: ["mypod"]
verbs: ["get", "watch", "list"]
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: default
name: example-role-all
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]](https://image.slidesharecdn.com/kasten-securingaccesstoyourkubernetesapplications-210401115155/85/Kasten-securing-access-to-your-kubernetes-applications-18-320.jpg)
Kasten securing access to your kubernetes applications
- 1. Securing Access to Your Kubernetes Applications Using Dex for Authentication & Role Based Access Control (RBAC) for Authorization
- 2. Deepika Dixit Software Engineer Introductions Onkar Bhat Engineering Manager
- 3. Securing Access to Your K8 Application โ You are the administrator of an IT department who wants to deploy an application in a Kubernetes cluster. โ You want to avoid adopting a new authentication workflow. โ Users in your organization are accustomed to using their existing Active Directory credentials for accessing apps. โ Can you authenticate users against it when they access applications in Kubernetes? Dex can help you! โ Youโve solved the authentication piece of the puzzle. โ Do you have different types of users? โ Cluster administrators โ App administrators โ Read only users โ How do you grant varying levels of access to these users Kubernetes has your RBAC!
- 4. What is Dex ? โ Dex is an identity service that uses OpenID Connect to drive authentication for other apps. โ Dex acts as a portal to other identity providers through โconnectors.โ
- 5. What is a connector? Implements the logic for authenticating against an upstream IDP โ LDAP โ Openshift OAuth โ GitHub โ Google
- 6. Install Dex Using Helm โ helm repo add dex https://charts.dexidp.io โ helm install dex dex/dex -f dex-values.yaml NAME: dex LAST DEPLOYED: Wed Mar 17 21:06:49 2021 NAMESPACE: default STATUS: deployed REVISION: 1 TEST SUITE: None NOTES: 1. Get the application URL by running these commands: export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=dex,app.kubernetes.io/instance=dex" -o jsonpath="{.items[0].metadata.name}") export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") echo "Visit http://127.0.0.1:8080 to use your application" kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
- 8. Dex
- 10. LDAP Connector
- 11. Port Forwarding kubectl --namespace dex port-forward $POD_NAME 8080:$CONTAINER_PORT Forwarding from 127.0.0.1:8080 -> 5556 Forwarding from [::1]:8080 -> 5556
- 12. Install and Run the Example Application โ git clone https://github.com/dexidp/dex.git โ cd dex/examples/example-app โ go build โ ./example-app --issuer http://127.0.0.1:8080 2021/03/16 20:52:02 listening on http://127.0.0.1:5555
- 13. demo
- 14. Demo Claims: { "iss": "http://127.0.0.1:8080", "sub": "CgVvbmthchIEbGRhcA", "aud": "example-app", "exp": 1616037593, "iat": 1615951193, "at_hash": "S9b817ZpFhdA6Ezw-nEEdA", "email": "onkar", "email_verified": true, "groups": [ "K10admins" ], "name": "onkar", "preferred_username": "onkar" }
- 15. What is Kubernetes RBAC? 1. Kubernetes defines RBAC as โRole-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within your organization.โ 2. RBAC is a flexible and powerful method, where you define rules once and use them multiple times. 3. Allows access control over resources not just within a cluster but within the application as well. 4. Defines clearly โwhoโ has access to โwhatโ. 5. Allows for dynamically calculating access as applications change and grow.
- 16. Why do you need RBAC? โ Multi-tenancy is an important concern, especially as clusters and applications mature after the initial hurdles of infrastructure and setup. โ How to restrict users access to just their applications and components within their applications is a crucial administrative decision. โ Users can have their own setup and be unaware of other users in the same cluster/system. โ Allows separation and security between users and applications.
- 17. Roles and ClusterRoles apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: default name: example-role Rules: # multiple rules can be added - apiGroups: [""] resources: ["pods"] verbs: ["get", "watch", "list"] - apiGroups: [""] resources: ["secrets"] verbs: ["get", "watch", "list"] apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: # "namespace" omitted since ClusterRoles are not namespaced name: example-clusterole rules: - apiGroups: [""] resources: ["secrets"] verbs: ["create", "get" , "watch", "list"]
- 18. Rules and Resources apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: default name: example-role rules: - apiGroups: ["mygroup.example.com" ] resources: ["pods"] resourceNames: ["mypod"] verbs: ["get", "watch", "list"] apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: default name: example-role-all rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"]
- 19. Subjects Users subjects: - kind: User name: "alice@example.com" Groups subjects: - kind: Group name: "frontend-admins" Service Account subjects: - kind: ServiceAccount name: default namespace: kube-system
- 20. RoleBindings apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: read-pods namespace: default subjects: # You can specify more than one "subject" - kind: User name: jane # "name" is case sensitive apiGroup: rbac.authorization.k8s.io roleRef: # "roleRef" specifies the binding to a Role / ClusterRole kind: Role #this must be Role or ClusterRole name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to apiGroup: rbac.authorization.k8s.io
- 21. ClusterRoleBindings apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: read-secrets-global subjects: - kind: Group name: manager # Name is case sensitive apiGroup: rbac.authorization.k8s.io - kind: ServiceAccount name: test-sa namespace: default apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: secret-reader apiGroup: rbac.authorization.k8s.io
- 22. How, What, When? Role v/s ClusterRole? โ Use Roles when rules are limited to a certain namespace โ Use ClusterRoles when rules are to be be defined across multiple namespaces and span Resources/APIGroups not limited to a certain namespaces or if runtime namespace is not known in advance RoleBinding v/s ClusterRoleBinding? โ Use RoleBindings to limit subjects to a particular namespace โ Use ClusterRoleBindings to give cluster-wide access to subjects Users v/s Groups? โ Use Users when specific user is known โ Use Groups to give all users belonging to the same group the same access level
- 23. How can I check what access a user has? Kubectl auth can-i โ Kubectl tool to check user access โ Checks roles and bindings across the cluster to verify access โ Allows impersonation as user or group to verify access control across the list of subjects
- 24. demo