Skip to content

Commit b65ceae

Browse files
bscott-rhbscott-rh
authored
Merge pull request #98461 from wgabor0427/OSDOCS-16038
OSDOCS-16038 created assemblies and modules for egress proxy info
2 parents a103796 + 53668b5 commit b65ceae

8 files changed

+119
-12
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1243,6 +1243,8 @@ Topics:
12431243
File: external-secrets-operator-release-notes
12441244
- Name: Installing the External Secrets Operator
12451245
File: external-secrets-operator-install
1246+
- Name: Configuring the egress proxy
1247+
File: external-secrets-operator-proxy
12461248
- Name: Uninstalling the External Secrets Operator
12471249
File: external-secrets-operator-uninstall
12481250
- Name: External Secrets Operator APIs

‎modules/external-secrets-proxy-security-considerations.adoc‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-proxy.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="external-secrets-proxy-security-considerations_{context}"]
7+
= Security considerations
8+
9+
When using the egress proxy for {external-secrets-operator}, there are some security concerns you should consider:
10+
11+
* `external-secrets` operand fetches the secrets from the configured external providers and stores it in a Kubernetes native Secrets resource. This results in a secret zero problem. It is recommended to secure the secret objects using additional encryption. For more information, see link:https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.9/html/planning_your_deployment/security-considerations_rhodf#data-encryption-options_rhodf[Data encryption options]
12+
13+
* When configuring `SecretStore` and `ClusterSecretStore`, consider using short-term credential-based authorization. This approach enhances security by limiting the window of opportunity for unauthorized access, even if credentials are compromised.
14+
15+
* To enhance the security of the {external-secrets-operator}, it is crucial to implement Role-Based Access Controls (RBACs). These RBACs should define and limit access to the custom resources provided by the {external-secrets-operator-short}.
16+

‎modules/external-secrets-proxy-support.adoc‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-proxy.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-proxy-support_{context}"]
7+
= Configuring the egress proxy for the {external-secrets-operator}
8+
9+
The egress proxy can be configured in the `ExternalSecretsConfig` or the `ExternalSecretsManager` custom resource. The Operator and the operand make use of the {product-title} supported Certificate Authority (CA) bundle for the proxy validations.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
* You have created the `ExternalSecretsConfig` custom resource.
15+
16+
.Procedure
17+
18+
* To set the proxy in the `ExternalSecretsConfig` resource, perform the following steps:
19+
20+
. Edit the `ExternalSecretsConfig` resource by running the following command:
21+
+
22+
[source,terminal]
23+
----
24+
$ oc edit externalsecretsconfigs.operator.openshift.io cluster
25+
----
26+
27+
. Edit the `spec.appConfig.proxy` section to set the proxy values as follows:
28+
+
29+
[source,yaml]
30+
----
31+
apiVersion: operator.openshift.io/v1alpha1
32+
kind: ExternalSecretsConfig
33+
...
34+
spec:
35+
appConfig:
36+
proxy:
37+
httpProxy: <http_proxy> <1>
38+
httpsProxy: <https_proxy> <2>
39+
noProxy: <no_proxy> <3>
40+
----
41+
+
42+
<1> Proxy URL for the http requests.
43+
<2> Proxy URL for the https requests.
44+
<3> Comma-separated list of hostnames and/or CIDRs and/or IPs for which the proxy should not be used.
45+
46+
* To set the proxy in the `ExternalSecretsManager` resource, perform the following steps.
47+
48+
. Edit the `ExternalSecretsManager` resource by running the following command:
49+
+
50+
[source,terminal]
51+
----
52+
$ oc edit externalsecretsmanagers.operator.openshift.io cluster
53+
----
54+
55+
. Edit the `spec.globalConfig.proxy` section to set the proxy values as follows:
56+
+
57+
[source,yaml]
58+
----
59+
apiVersion: operator.openshift.io/v1alpha1
60+
kind: ExternalSecretsManager
61+
...
62+
spec:
63+
globalConfig:
64+
proxy:
65+
httpProxy: <http_proxy> <1>
66+
httpsProxy: <https_proxy> <2>
67+
noProxy: <no_proxy> <3>
68+
----
69+
+
70+
<1> Proxy URL for the http requests.
71+
<2> Proxy URL for the https requests.
72+
<3> Comma-separated list of hostnames and/or CIDRs and/or IPs for which the proxy should not be used.
73+
74+

‎security/external_secrets_operator/external-secrets-operator-install.adoc‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@ toc::[]
88

99
The {external-secrets-operator} is not installed on the {product-title} by default. Install the {external-secrets-operator-short} by using either the web console or the command-line interface (CLI).
1010

11-
:FeatureName: The {external-secrets-operator}
12-
include::snippets/technology-preview.adoc[leveloffset=+1]
13-
1411
//Limitations of application installation and uninstallation
1512
include::modules/external-secrets-operator-limitations.adoc[leveloffset=+1]
1613

‎security/external_secrets_operator/external-secrets-operator-proxy.adoc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="external-secrets-operator-proxy"]
3+
= About the egress proxy for the {external-secrets-operator}
4+
include::_attributes/common-attributes.adoc[]
5+
:context: external-secrets-operator-proxy
6+
7+
If a cluster-wide egress proxy is configured in {product-title}, Operator Lifecycle Manager (OLM) automatically configures Operators that it manages with the cluster-wide proxy. OLM automatically updates all of the Operator's deployments with the `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY` environment variables.
8+
9+
// Configuring external secrets operator proxy
10+
include::modules/external-secrets-proxy-support.adoc[leveloffset=+1]
11+
12+
[role="_additional-resources"]
13+
[id="external-resources-operator-proxy_additional-resources"]
14+
== Additional resources
15+
16+
* xref:../../operators/admin/olm-configuring-proxy-support.adoc#olm-configuring-proxy-support[Configuring proxy support in Operator Lifecycle Manager]
17+

‎security/external_secrets_operator/external-secrets-operator-release-notes.adoc‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,6 @@ The {external-secrets-operator} is a cluster-wide service that provides lifecycl
1010

1111
These release notes track the development of {external-secrets-operator-short}.
1212

13-
:FeatureName: The {external-secrets-operator}
14-
include::snippets/technology-preview.adoc[leveloffset=+1]
15-
1613
For more information, see xref:../../security/external_secrets_operator/index.adoc#external-secrets-operator-about[{external-secrets-operator-short} overview].
1714

1815
[id="external-secrets-operator-release-notes-0-1-0_{context}"]

‎security/external_secrets_operator/external-secrets-operator-uninstall.adoc‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@ toc::[]
88

99
You can remove the {external-secrets-operator} from {product-title} by uninstalling the Operator and removing its related resources.
1010

11-
:FeatureName: The {external-secrets-operator}
12-
include::snippets/technology-preview.adoc[leveloffset=+1]
13-
1411
// Uninstalling the {external-secrets-operator-short}
1512
include::modules/external-secrets-operator-uninstall-console.adoc[leveloffset=+1]
1613

‎security/external_secrets_operator/index.adoc‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@ toc::[]
88

99
The {external-secrets-operator} operates as a cluster-wide service to deploy and manage the `external-secrets` application. The `external-secrets` application integrates with external secrets management systems and performs secret fetching, refreshing, and provisioning within the cluster.
1010

11-
:FeatureName: The {external-secrets-operator}
12-
include::snippets/technology-preview.adoc[leveloffset=+1]
13-
1411
//About the {external-secrets-operator}
1512
include::modules/external-secrets-about.adoc[leveloffset=+1]
1613

@@ -31,3 +28,13 @@ include::modules/external-secrets-fips-support.adoc[leveloffset=+1]
3128
* xref:../../security/container_security/security-compliance.adoc#security-compliance[Understanding compliance]
3229
* xref:../../installing/overview/installing-fips.adoc#installing-fips-mode_installing-fips[Installing a cluster in FIPS mode]
3330
* xref:../../installing/overview/installing-preparing.adoc#installing-preparing-security[Do you need extra security for your cluster?]
31+
32+
// Product security considerations
33+
include::modules/external-secrets-proxy-security-considerations.adoc[leveloffset=+1]
34+
35+
[role="_additional-resources"]
36+
== Additional resources
37+
38+
* link:https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.19/html/planning_your_deployment/security-considerations_rhodf[Security considerations]
39+
40+
* link:https://external-secrets.io/latest/guides/security-best-practices/[Security Best Practices]

0 commit comments

Comments
 (0)