Skip to content

Commit da41ac8

Browse files
stevsmitstevsmit
authored
Merge pull request #103738 from wgabor0427/OSDOCS-17644
OSDOCS-17644 created docs for egress proxy
2 parents 21ad375 + 30c5aa7 commit da41ac8

File tree

5 files changed

+169
-23
lines changed

5 files changed

+169
-23
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1238,6 +1238,8 @@ Topics:
12381238
File: zero-trust-manager-release-notes
12391239
- Name: Installing Zero Trust Workload Identity Manager
12401240
File: zero-trust-manager-install
1241+
- Name: Configuring the egress proxy
1242+
File: zero-trust-manager-proxy
12411243
- Name: Deploying Zero Trust Workload Identity Manager operands
12421244
File: zero-trust-manager-configuration
12431245
- Name: Configuring Zero Trust Workload Identity Manager OIDC Federation

‎modules/zero-trust-manager-enable-metrics-server.adoc‎

Lines changed: 18 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -30,23 +30,23 @@ The SPIRE Server operand exposes metrics by default on port `9402` at the `/metr
3030
apiVersion: monitoring.coreos.com/v1
3131
kind: ServiceMonitor
3232
metadata:
33-
labels:
34-
app.kubernetes.io/name: server
35-
app.kubernetes.io/instance: spire
36-
name: spire-server-metrics
37-
namespace: zero-trust-workload-identity-manager
33+
labels:
34+
app.kubernetes.io/name: server
35+
app.kubernetes.io/instance: spire
36+
name: spire-server-metrics
37+
namespace: zero-trust-workload-identity-manager
3838
spec:
39-
endpoints:
40-
- port: metrics
41-
interval: 30s
42-
path: /metrics
43-
selector:
44-
matchLabels:
45-
app.kubernetes.io/name: server
46-
app.kubernetes.io/instance: spire
47-
namespaceSelector:
48-
matchNames:
49-
- zero-trust-workload-identity-manager
39+
endpoints:
40+
- port: metrics
41+
interval: 30s
42+
path: /metrics
43+
selector:
44+
matchLabels:
45+
app.kubernetes.io/name: server
46+
app.kubernetes.io/instance: spire
47+
namespaceSelector:
48+
matchNames:
49+
- zero-trust-workload-identity-manager
5050
----
5151

5252
.. Create the `ServiceMonitor` CR by running the following command:
@@ -60,15 +60,13 @@ After the `ServiceMonitor` CR is created, the user workload Prometheus instance
6060

6161
.Verification
6262

63-
. In the {product-title} web console, navigate to *Observe* → *Targets*.
64-
63+
. In the {product-title} web console, navigate to *Observe* -> *Targets*.
6564

6665
. In the *Label* filter field, enter the following label to filter the metrics targets:
6766
+
6867
[source,terminal]
6968
----
70-
$ service=spire-server
69+
$ service=zero-trust-workload-identity-manager-metrics-service
7170
----
7271

7372
. Confirm that the *Status* column shows `Up` for the `spire-server-metrics` entry.
74-

‎modules/zero-trust-manager-proxy-support.adoc‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-operator-proxy.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-proxy-support_{context}"]
7+
= Injecting a custom CA certificate for the {zero-trust-full}
8+
9+
[role="_abstract"]
10+
Inject certificate authority (CA) certificates into the {zero-trust-full} to support proxying HTTPS connections. This configuration helps ensure that the Identity Manager can communicate securely when you enable a cluster-wide proxy.
11+
12+
.Prerequisites
13+
14+
* You have access to the cluster as a user with the `cluster-admin` role.
15+
16+
* You have enabled the cluster-wide proxy for {product-title}.
17+
18+
* You have installed {zero-trust-full} 1.0.0 or later.
19+
20+
* You have deployed the SPIRE Server, SPIRE Agent, SPIFFEE CSI Driver, and the SPIRE OIDC Discovery Provider operands in the cluster.
21+
22+
.Procedure
23+
24+
. Create a config map in the `zero-trust-workload-identity-manager` namespace by running the following command:
25+
+
26+
[source,terminal]
27+
----
28+
$ oc create configmap trusted-ca -n zero-trust-workload-identity-manager
29+
----
30+
31+
. Inject the CA bundle that is trusted by {product-title} into the config map by running the following command:
32+
+
33+
[source,terminal]
34+
----
35+
$ oc label cm trusted-ca config.openshift.io/inject-trusted-cabundle=true -n zero-trust-workload-identity-manager
36+
----
37+
38+
. Update the subscription for the {zero-trust-full} to use the config map by running the following command:
39+
+
40+
[source,terminal]
41+
----
42+
$ oc -n zero-trust-workload-identity-manager patch subscription openshift-zero-trust-workload-identity-manager --type='merge' -p '{"spec":{"config":{"env":[{"name":"TRUSTED_CA_BUNDLE_CONFIGMAP","value":"trusted-ca"}]}}}'
43+
----
44+
45+
.Verification
46+
47+
. Verify that the operands have finished rolling out by running the following command:
48+
+
49+
[source,terminal]
50+
----
51+
$ oc rollout status deployment/zero-trust-workload-identity-manager-controller-manager -n zero-trust-workload-identity-manager && \
52+
$ oc rollout status statefulset/spireserver -n zero-trust-workload-identity-manager && \
53+
$ oc rollout status daemonset/spire-agent -n zero-trust-workload-identity-manager && \
54+
$ oc rollout status deployment/spire-spiffe-oidc-discovery-provider -n zero-trust-workload-identity-manager
55+
----
56+
+
57+
.Example output
58+
[source,terminal]
59+
----
60+
deployment "zero-trust-workload-identity-manager-controller-manager" successfully rolled out
61+
statefulset "spire-server" successfully rolled out
62+
daemonset "spire-agent" successfully rolled out
63+
deployment "spire-spiffe-oidc-discovery-provider" successfully rolled out
64+
----
65+
66+
. Verify that the CA bundle was mounted as a volume by running the following command:
67+
+
68+
[source,terminal]
69+
----
70+
$ oc get deployment zero-trust-workload-identity-manager -n zero-trust-workload-identity-manager -o=jsonpath={.spec.template.spec.'containers[0].volumeMounts'}
71+
----
72+
+
73+
[source,terminal]
74+
----
75+
$ oc get statefulset spire-server -n zero-trust-workload-identity-manager -o jsonpath='{.spec.template.spec.containers[*].volumeMounts[?(@.name=="trusted-ca-bundle")]}'
76+
----
77+
+
78+
[source,terminal]
79+
----
80+
$ oc get daemonset spire-agent -n zero-trust-workload-identity-manager -o jsonpath='{.spec.template.spec.containers[*].volumeMounts[?(@.name=="trusted-ca-bundle")]}'
81+
----
82+
+
83+
[source,terminal]
84+
----
85+
$ oc get daemonset spire-spiffe-csi-driver -n zero-trust-workload-identity-manager -o jsonpath='{.spec.template.spec.containers[*].volumeMounts[?(@.name=="trusted-ca-bundle")]}'
86+
----
87+
+
88+
.Example output
89+
[source,terminal]
90+
----
91+
[{{"mountPath":"/etc/pki/ca-trust/extracted/pem","name":"trusted-ca-bundle","readOnly":true}]
92+
----
93+
94+
. Verify that the source of the CA bundle is the `trusted-ca` config map by running the following command:
95+
+
96+
[source,terminal]
97+
----
98+
$ oc get deployment zero-trust-workload-identity-manager -n zero-trust-workload-identity-manager -o=jsonpath={.spec.template.spec.volumes}
99+
----
100+
+
101+
[source,terminal]
102+
----
103+
$ oc get statefulset spire-server -n zero-trust-workload-identity-manager -o=jsonpath='{.spec.template.spec.volumes}' | jq '.[] | select(.name=="trusted-ca-bundle")'
104+
----
105+
+
106+
[source,terminal]
107+
----
108+
$ oc get daemonset spire-agent -n zero-trust-workload-identity-manager -o=jsonpath='{.spec.template.spec.volumes}' | jq '.[] | select(.name=="trusted-ca-bundle")'
109+
----
110+
+
111+
[source,terminal]
112+
----
113+
$ oc get deployment spire-spiffe-oidc-discovery-provider -n zero-trust-workload-identity-manager -o=jsonpath='{.spec.template.spec.volumes}' | jq '.[] | select(.name=="trusted-ca-bundle")'
114+
----
115+
+
116+
.Example output
117+
[source,terminal]
118+
----
119+
{
120+
"configMap": {
121+
"defaultMode": 420,
122+
"items": [
123+
{
124+
"key": "ca-bundle.crt",
125+
"path": "tls-ca-bundle.pem"
126+
}
127+
],
128+
"name": "trusted-ca"
129+
},
130+
"name": "trusted-ca-bundle"
131+
}
132+
----

‎security/zero_trust_workload_identity_manager/zero-trust-manager-configuration.adoc‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,6 @@
22
[id="zero-trust-manager-configuration"]
33
= Deploying Zero Trust Workload Identity Manager operands
44

5-
include::_attributes/common-attributes.adoc[]
6-
:context: zero-trust-manager-configuration
7-
85
toc::[]
96

107
:FeatureName: Zero Trust Workload Identity Manager

‎security/zero_trust_workload_identity_manager/zero-trust-manager-proxy.adoc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="zero-trust-manager-proxy"]
3+
= Configuring the egress proxy for the {zero-trust-full}
4+
include::_attributes/common-attributes.adoc[]
5+
:context: zero-trust-manager-proxy
6+
7+
[role="_abstract"]
8+
Operator Lifecycle Manager (OLM) automatically configures managed Operators with proxy settings when you use a cluster-wide egress proxy. To support proxying HTTPS connections, you can inject certificate authority (CA) certificates into the {zero-trust-full}.
9+
10+
// Injecting a custom CA certificate for the {cert-manager-operator}
11+
include::modules/zero-trust-manager-proxy-support.adoc[leveloffset=+1]
12+
13+
[role="_additional-resources"]
14+
[id="zero-trust-manager-proxy_additional-resources"]
15+
== Additional resources
16+
17+
* xref:../../operators/admin/olm-configuring-proxy-support.adoc#olm-configuring-proxy-support[Configuring proxy support in Operator Lifecycle Manager]

0 commit comments

Comments
 (0)