Skip to content

Commit 3f70377

Browse files
wgabor0427Shubha Narayanan
wgabor0427
authored and
Shubha Narayanan
committed
Install uninstall overview
1 parent bbe3ff8 commit 3f70377

14 files changed

+449
-6
lines changed

‎_attributes/common-attributes.adoc‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -384,8 +384,7 @@ endif::openshift-origin[]
384384
:ai-first: artificial intelligence (AI)
385385
//RHEL AI attribute listed with RHEL family
386386
//zero trust workload identity manager
387-
:zero-trust-full: Zero Trust Workload Identity Manager for Red{nbsp}Hat OpenShift
388-
:zero-trust-short: Zero Trust Workload Identity Manager
387+
:zero-trust-full: Zero Trust Workload Identity Manager
389388
:spiffe-full: Secure Production Identity Framework for Everyone (SPIFFE)
390389
:svid-full: SPIFFE Verifiable Identity Document (SVID)
391390
:spire-full: SPIFFE Runtime Environment

‎_topic_maps/_topic_map.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1266,12 +1266,16 @@ Topics:
12661266
- Name: Disaster recovery considerations
12671267
File: nbde-disaster-recovery-considerations
12681268
Distros: openshift-enterprise,openshift-origin
1269-
- Name: zero trust workload identity manager for Red Hat OpenShift
1269+
- Name: Zero Trust Workload Identity Manager
12701270
Dir: zero_trust_workload_identity_manager
12711271
Distros: openshift-enterprise
12721272
Topics:
1273-
- Name: zero trust workload identity manager for Red Hat OpenShift overview
1273+
- Name: Zero Trust Workload Identity Manager overview
12741274
File: zero-trust-manager-overview
1275+
- Name: Installing Zero Trust Workload Identity Manager
1276+
File: zero-trust-manager-install
1277+
- Name: Uninstalling Zero Trust Workload Identity Manager
1278+
File: zero-trust-manager-uninstall
12751279
---
12761280
Name: Authentication and authorization
12771281
Dir: authentication

‎modules/zero-trust-manager-about-agent.adoc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-overview.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="zero-trust-manager-about-agent_{context}"]
7+
= SPIRE agent
8+
9+
The SPIRE Agent is responsible for workload attestation, ensuring that workloads receive a verified identity when requesting authentication through the SPIFFE Workload API. It accomplishes this by using configured workload attestor plugins. In Kubernetes environments, the Kubernetes workload attestor plugin is used.
10+
11+
SPIRE and the SPIRE agent perform node attestation via node plugins. The plugins are used to verify the identity of the node on which the agent is running. For more information, see link:https://spiffe.io/docs/latest/spire-about/spire-concepts/#all-about-the-agent[About the SPIRE Agent].
12+

‎modules/zero-trust-manager-about-attestation.adoc‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-overview.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="zero-trust-manager-about-attestation_{context}"]
7+
= Attestation
8+
9+
10+
Attestation is the process by which the identity of nodes and workloads are verified before SPIFFE IDs and SVIDs are issued. The SPIRE server gathers attributes of both the workload and node that the SPIRE Agent runs on, and then compares them to a set of selectors defined when the workload was registered. If the comparison is successful, the entities are provided with credentials. This ensures that only legitimate and expected entities within the trust domain receive cryptographic identities. The two main types of attestation in SPIFFE/SPIRE are:
11+
12+
* Node attestation: verifies the identity of a machine or a node on a system, before a SPIRE agent running on that node can be trusted to request identities for workloads.
13+
* Workload attestation: verifies the identity of an application or service running on an attested node before the SPIRE agent on that node can provide it with a SPIFFE ID and SVID.
14+
15+
For more information, see link:https://spiffe.io/docs/latest/spire-about/spire-concepts/#attestation[Attestation].

‎modules/zero-trust-manager-about-spiffe.adoc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-overview.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="zero-trust-manager-about-spiffe_{context}"]
7+
= SPIFFE
8+
9+
10+
{spiffe-full} provides a standardized way to establish trust between software workloads in distributed systems. SPIFFE assigns unique IDs called SPIFFE IDs. These IDs are Uniform Resource Identifiers (URI) that include a trust domain and a workload identifier.
11+
12+
The SPIFFE IDs are contained in the {svid-full}. SVIDs are used by workloads to verify their identity to other workloads so that the workloads can communicate with each other. The two main SVID formats are:
13+
14+
* X.509-SVIDs: X.509 certificates where the SPIFFE ID is embedded in the Subject Alternative Name (SAN) field.
15+
* JWT-SVIDs: JSON Web Tokens (JWTs) where the SPIFFE ID is included as the `sub` claim.
16+
17+
For more information, see link:https://spiffe.io/docs/latest/spiffe-about/overview/[SPIFFE Overview].

‎modules/zero-trust-manager-about-spire.adoc‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-overview.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="zero-trust-manager-about-spire_{context}"]
7+
= SPIRE server
8+
9+
10+
A SPIRE server is responsible for managing and issuing SPIFFE identities within a trust domain. It stores registration entries (selectors that determine under what conditions a SPIFFE ID should be issued) and signing keys. The SPIRE server works in conjunction with the SPIRE agent to perform node attestion via node plugins. For more information, see link:https://spiffe.io/docs/latest/spire-about/spire-concepts/#all-about-the-server[About the SPIRE server].

‎modules/zero-trust-manager-how-it-works.adoc‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-overview.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="zero-trust-manager-how-it-works_{context}"]
7+
== {zero-trust-full} workflow
8+
9+
10+
The following is a high-level workflow of the {zero-trust-full} within the Red{nbsp}Hat OpenShift cluster.
11+
12+
. The SPIRE, SPIRE agent, SPIFFE CSI Driver, and the SPIRE OIDC Discovery Provider operands are deployed and managed by {zero-trust-full} via associated Customer Resource Definitions (CRDs).
13+
14+
. Watches are then registered for relevant Kubernetes resources and the necessary SPIRE CRDs are applied to the cluster.
15+
16+
. The CR for the ZeroTrustWorkloadIdentityManager resource named `cluster` is deployed and managed by a controller.
17+
18+
. To deploy the SPIRE server, SPIRE agent, SPIFFE CSI Driver, and SPIRE OIDC Discovery Provider, you need to create a custom resource of a each certain type and name it `cluster`. The custom resource types are as follows:
19+
20+
* SPIRE server - `SpireServer`
21+
22+
* SPIRE agent - `SpireAgent`
23+
24+
* SPIFFE CSI Driver - `SpiffeCSIDriver`
25+
26+
* SPIRE OIDC discovery provider - `SpireOIDCDiscoveryProvider`
27+
28+
. When a node starts, the SPIRE agent initializes, and connects to the SPIRE server.
29+
30+
. The agent begins the node attestation process. The agent collects information on the node's identity such as label name and namespace. The agent securely provides the information it gathered through the attestation to the SPIRE server.
31+
32+
. The SPIRE server then evaluates this information against its configured attestation policies and registration entries. If successful, the server generates an agent SVID and the Trust Bundle (CA Certificate) and securely sends this back to the agent.
33+
34+
. A workload starts on the node and needs a secure identity. The workload connects to the agent's Workload API and requests a SVID.
35+
36+
. The agent receives the request and begins a workload attestation to gather information about the workload.
37+
38+
. After the agent gathers the information, the information is sent to the SPIRE server and the server checks its configured registration entries.
39+
40+
. The agent receives the workload SVID and Trust Bundle and passes it on to the workload. The workload can now present their SVIDs to other SPIFFE-aware devices to communicate with them.
41+
42+
43+
[role="_additional-resources"]
44+
.Additional resources
45+
* link:https://spiffe.io/docs/latest/deploying/registering/[Registering workloads]
46+
47+
* link:https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/[SPIFFE Concepts]
48+
49+
* link:https://spiffe.io/docs/latest/spire-about/use-cases/[SPIRE Use Cases]

‎modules/zero-trust-manager-install-cli.adoc‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-install.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-install-cli_{context}"]
7+
= Installing the {zero-trust-full} by using the CLI
8+
9+
.Prerequisites
10+
11+
* You have access to the cluster with `cluster-admin` privileges.
12+
13+
.Procedure
14+
15+
. Create a new project named `zero-trust-workload-identity-manager` by running the following command:
16+
+
17+
[source, terminal]
18+
----
19+
$ oc new-project zero-trust-workload-identity-manager
20+
----
21+
22+
. Create an `OperatorGroup` object:
23+
24+
.. Create a YAML file, for example, `operatorGroup.yaml`, with the following content:
25+
+
26+
.Example `operatorGroup.yaml`
27+
+
28+
[source, yaml]
29+
----
30+
apiVersion: operators.coreos.com/v1
31+
kind: OperatorGroup
32+
metadata:
33+
name: openshift-zero-trust-workload-identity-manager
34+
namespace: zero-trust-workload-identity-manager
35+
spec:
36+
upgradeStrategy: Default
37+
----
38+
39+
.. Create the `OperatorGroup` object by running the following command:
40+
+
41+
[source, terminal]
42+
----
43+
$ oc create -f operatorGroup.yaml
44+
----
45+
46+
. Create a `Subscription` object:
47+
48+
.. Create a YAML file, for example, `subscription.yaml`, that defines the `Subscription` object:
49+
+
50+
.Example `subscription.yaml`
51+
+
52+
[source, yaml]
53+
----
54+
apiVersion: operators.coreos.com/v1alpha1
55+
kind: Subscription
56+
metadata:
57+
name: openshift-zero-trust-workload-identity-manager
58+
namespace: zero-trust-workload-identity-manager
59+
spec:
60+
channel: tech-preview-v0.1
61+
name: openshift-zero-trust-workload-identity-manager
62+
source: redhat-operators
63+
sourceNamespace: openshift-marketplace
64+
installPlanApproval: Automatic
65+
----
66+
67+
.. Create the `Subscription` object by running the following command:
68+
+
69+
[source, terminal]
70+
----
71+
$ oc create -f subscription.yaml
72+
----
73+
74+
.Verification
75+
76+
. Verify that the OLM subscription is created by running the following command:
77+
+
78+
[source, terminal]
79+
----
80+
$ oc get subscription -n zero-trust-workload-identity-manager
81+
----
82+
+
83+
.Example output
84+
[source, terminal]
85+
----
86+
NAME PACKAGE SOURCE CHANNEL
87+
openshift-zero-trust-workload-identity-manager zero-trust-workload-identity-manager redhat-operators tech-preview-v0.1
88+
----
89+
90+
. Verify whether the Operator is successfully installed by running the following command:
91+
+
92+
[source, terminal]
93+
----
94+
$ oc get csv -n zero-trust-workload-identity-manager
95+
----
96+
+
97+
.Example output
98+
[source, terminal]
99+
----
100+
NAME DISPLAY VERSION PHASE
101+
zero-trust-workload-identity-manager.v0.1.0 Zero Trust Workload Identity Manager 0.1.0 Succeeded
102+
----
103+
104+
. Verify that the {zero-trust-full} controller manager is ready by running the following command:
105+
+
106+
[source, terminal]
107+
----
108+
$ oc get deployment -l name=zero-trust-workload-identity-manager -n zero-trust-workload-identity-manager
109+
----
110+
+
111+
.Example output
112+
[source, terminal]
113+
----
114+
NAME READY UP-TO-DATE AVAILABLE AGE
115+
zero-trust-workload-identity-manager-controller-manager 1/1 1 1 43m
116+
----

‎modules/zero-trust-manager-install-console.adoc‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zer-trust-manager-install.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-install-console_{context}"]
7+
= Installing the {zero-trust-full} by using the web console
8+
9+
You can use the web console to install the {zero-trust-full}.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* You have access to the {product-title} web console.
15+
16+
.Procedure
17+
18+
. Log in to the {product-title} web console.
19+
20+
. Go to *Operators* -> *OperatorHub*.
21+
22+
. Enter *{zero-trust-full}* into the filter box.
23+
24+
. Select the *{zero-trust-full}*
25+
26+
. Select the {zero-trust-full} version from *Version* drop-down list, and click *Install*.
27+
28+
. On the *Install Operator* page:
29+
.. Update the *Update channel*, if necessary. The channel defaults to *tech-preview-v0.1*, which installs the latest Technology Preview v0.1 release of the {zero-trust-full}.
30+
.. Choose the *Installed Namespace* for the Operator. The default Operator namespace is `zero-trust-workload-identity-manager`.
31+
+
32+
If the `zero-trust-workload-identity-manager` namespace does not exist, it is created for you.
33+
34+
.. Select an *Update approval* strategy.
35+
+
36+
* The *Automatic* strategy allows Operator Lifecycle Manager (OLM) to automatically update the Operator when a new version is available.
37+
+
38+
* The *Manual* strategy requires a user with appropriate credentials to approve the Operator update.
39+
40+
.. Click *Install*.
41+
42+
.Verification
43+
44+
. Navigate to *Operators* -> *Installed Operators*.
45+
. Verify that *{zero-trust-full}* is listed with a *Status* of *Succeeded* in the `zero-trust-workload-identity-manager` namespace.
46+
. Verify that {zero-trust-full} controller manager deployment is ready and available by running the following command:
47+
+
48+
[source,terminal]
49+
----
50+
$ oc get deployment -l name=zero-trust-workload-identity-manager -n zero-trust-workload-identity-manager
51+
----
52+
+
53+
.Example output
54+
[source,terminal]
55+
----
56+
NAME READY UP-TO-DATE AVAILABLE AGE
57+
zero-trust-workload-identity-manager-controller-manager-6c4djb 1/1 1 1 43m
58+
----

‎modules/zero-trust-manager-uninstall-console.adoc‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zero-trust-manager-uninstall.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-uninstall-console_{context}"]
7+
= Uninstalling the {zero-trust-full}
8+
9+
You can uninstall the {zero-trust-full} by using the web console.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* You have access to the {product-title} web console.
15+
* The {zero-trust-full} is installed.
16+
17+
.Procedure
18+
19+
. Log in to the {product-title} web console.
20+
. Uninstall the {zero-trust-full}.
21+
.. Go to *Operators* -> *Installed Operators*.
22+
.. Click the *Options* menu next to the *{zero-trust-full}* entry, and then click *Uninstall Operator*.
23+
.. In the confirmation dialog, click *Uninstall*.

0 commit comments

Comments
 (0)