-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
BACK-2077, BACK-2335: add
abac inbound mode and simplify charts (#175)
* Add `inbound abac-encrypt` and `outbound abac-decrypt` modes * Only include secrets, and config values if they will wind up in a chart * Pull the CAs back into the base chart so that they can be referenced by both ABAC charts
- Loading branch information
Showing
27 changed files
with
511 additions
and
108 deletions.
There are no files selected for viewing
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| {{- if .Values.gatewayModes.inboundAbacEncrypt.enabled }} | ||
| kind: ConfigMap | ||
| apiVersion: v1 | ||
| metadata: | ||
| labels: | ||
| app: gateway | ||
| name: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| data: | ||
| GATEWAY_MODE: "abac-encrypt" | ||
| GATEWAY_TOPOLOGY: "inbound" | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| {{- if .Values.gatewayModes.outboundAbacDecrypt.enabled }} | ||
| kind: ConfigMap | ||
| apiVersion: v1 | ||
| metadata: | ||
| labels: | ||
| app: gateway | ||
| name: {{ .Chart.Name }}-{{ .Values.gatewayModes.outboundAbacDecrypt.name }} | ||
| data: | ||
| GATEWAY_MODE: "abac-decrypt" | ||
| GATEWAY_TOPOLOGY: "outbound" | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| {{- if .Values.gatewayModes.inboundAbacEncrypt.enabled }} | ||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| name: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| labels: | ||
| {{- include "gateway.labels" . | nindent 4 }} | ||
| app.kubernetes.io/name: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| app.kubernetes.io/instance: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| {{- with .Values.service.annotations }} | ||
| annotations: | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| spec: | ||
| type: {{ .Values.service.type }} | ||
| {{- if .Values.service.loadBalancerIP }} | ||
| loadBalancerIP: {{ .Values.service.loadBalancerIP }} | ||
| {{- end }} | ||
| ports: | ||
| - port: {{ .Values.gatewayModes.inboundAbacEncrypt.port }} | ||
| targetPort: {{ .Values.service.port }} | ||
| protocol: TCP | ||
| selector: | ||
| app.kubernetes.io/name: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| app.kubernetes.io/instance: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| {{- if .Values.gatewayModes.outboundAbacDecrypt.enabled }} | ||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| name: {{ .Chart.Name }}-{{ .Values.gatewayModes.outboundAbacDecrypt.name }} | ||
| labels: | ||
| {{- include "gateway.labels" . | nindent 4 }} | ||
| app.kubernetes.io/name: {{ .Chart.Name }}-{{ .Values.gatewayModes.outboundAbacDecrypt.name }} | ||
| app.kubernetes.io/instance: {{ .Chart.Name }}-{{ .Values.gatewayModes.outboundAbacDecrypt.name }} | ||
| {{- with .Values.service.annotations }} | ||
| annotations: | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| spec: | ||
| type: {{ .Values.service.type }} | ||
| {{- if .Values.service.loadBalancerIP }} | ||
| loadBalancerIP: {{ .Values.service.loadBalancerIP }} | ||
| {{- end }} | ||
| ports: | ||
| - port: {{ .Values.gatewayModes.outboundAbacDecrypt.port }} | ||
| targetPort: {{ .Values.service.port }} | ||
| protocol: TCP | ||
| selector: | ||
| app.kubernetes.io/name: {{ .Chart.Name }}-{{ .Values.gatewayModes.outboundAbacDecrypt.name }} | ||
| app.kubernetes.io/instance: {{ .Chart.Name }}-{{ .Values.gatewayModes.outboundAbacDecrypt.name }} | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,159 @@ | ||
| {{- if .Values.gatewayModes.inboundAbacEncrypt.enabled }} | ||
| apiVersion: apps/v1 | ||
| kind: StatefulSet | ||
| metadata: | ||
| name: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| labels: | ||
| {{- include "gateway.labels" . | nindent 4 }} | ||
| app.kubernetes.io/name: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| app.kubernetes.io/instance: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| spec: | ||
| selector: | ||
| matchLabels: | ||
| app.kubernetes.io/name: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| app.kubernetes.io/instance: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| serviceName: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| replicas: {{ .Values.replicas }} | ||
| volumeClaimTemplates: | ||
| - metadata: | ||
| name: postfix-dir | ||
| spec: | ||
| accessModes: ["ReadWriteOnce"] | ||
| storageClassName: {{ .Values.persistentVolumes.storageClassName }} | ||
| resources: | ||
| requests: | ||
| storage: {{ .Values.persistentVolumes.volumeSize }} | ||
| template: | ||
| metadata: | ||
| {{- with .Values.podAnnotations }} | ||
| annotations: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| labels: | ||
| app.kubernetes.io/name: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| app.kubernetes.io/instance: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| spec: | ||
| {{- with .Values.imagePullSecrets }} | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| serviceAccountName: {{ include "gateway.serviceAccountName" . }} | ||
| securityContext: | ||
| {{- toYaml .Values.podSecurityContext | nindent 8 }} | ||
| initContainers: | ||
| - name: cert-generator | ||
| image: alpine:latest | ||
| # todo move this into a bash script? or remove apk add bash from the below line | ||
| command: ['sh', '-c', "apk update && apk upgrade && apk add bash openssl && openssl genrsa -out /etc/postfix/tls/{{ .Values.standardConfig.gatewayHostname }}/client.key 2048 && openssl req -new -key /etc/postfix/tls/{{ .Values.standardConfig.gatewayHostname }}/client.key -x509 -subj /CN={{ .Values.standardConfig.gatewayHostname }} -days 3650 -out /etc/postfix/tls/{{ .Values.standardConfig.gatewayHostname }}/client.pem"] | ||
| volumeMounts: | ||
| - name: cert-dir | ||
| mountPath: /etc/postfix/tls/{{ .Values.standardConfig.gatewayHostname }} | ||
| containers: | ||
| - name: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} # Gateway Container | ||
| securityContext: | ||
| {{- toYaml .Values.securityContext | nindent 12 }} | ||
| image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" | ||
| imagePullPolicy: {{ .Values.image.pullPolicy }} | ||
| volumeMounts: | ||
| - name: cert-dir | ||
| mountPath: /etc/postfix/tls/{{ .Values.standardConfig.gatewayHostname }} | ||
| {{- if eq .Values.additionalConfig.dkimSigning.enabled true }} | ||
| - name: dkim-dir | ||
| mountPath: /etc/opendkim/keys | ||
| {{- end }} | ||
| {{- if .Values.additionalConfig.abac.extraCas }} | ||
| - name: abac-cas | ||
| mountPath: /etc/virtru-gateway/abac-cas | ||
| readOnly: true | ||
| {{- end }} | ||
| - name: postfix-dir | ||
| mountPath: /var/spool/postfix | ||
| ports: | ||
| - containerPort: {{ .Values.service.port }} | ||
| protocol: TCP | ||
| envFrom: | ||
| - configMapRef: | ||
| name: {{ .Chart.Name }}-{{ .Values.gatewayModes.inboundAbacEncrypt.name }} | ||
| - configMapRef: | ||
| name: {{ .Chart.Name }}-base-configs | ||
| env: | ||
| - name: GATEWAY_AMPLITUDE_API_KEY | ||
| valueFrom: | ||
| secretKeyRef: | ||
| key: gateway-amplitude-api-key | ||
| name: {{ .Release.Name }}-secrets | ||
| {{- if eq .Values.additionalConfig.saslAuth.smtpDownstream.enabled true }} | ||
| - name: GATEWAY_SMTP_SASL_ACCOUNTS | ||
| valueFrom: | ||
| secretKeyRef: | ||
| key: gateway-sasl-auth-downstream | ||
| name: {{ .Release.Name }}-secrets | ||
| {{- end }} | ||
| {{- if eq .Values.additionalConfig.saslAuth.smtpdUpstream.enabled true }} | ||
| - name: GATEWAY_SMTPD_SASL_ACCOUNTS | ||
| valueFrom: | ||
| secretKeyRef: | ||
| key: gateway-sasl-auth-upstream | ||
| name: {{ .Release.Name }}-secrets | ||
| {{- end }} | ||
| {{- if eq .Values.standardConfig.headers.xHeaderAuthEnabled true }} | ||
| - name: GATEWAY_XHEADER_AUTH_SECRET | ||
| valueFrom: | ||
| secretKeyRef: | ||
| key: gateway-xheader-auth-secret | ||
| name: {{ .Release.Name }}-secrets | ||
| {{- end }} | ||
| - name: GATEWAY_ABAC_OIDC_CLIENT_SECRET | ||
| valueFrom: | ||
| secretKeyRef: | ||
| key: gateway-abac-oidc-client-secret | ||
| name: {{ .Release.Name }}-secrets | ||
| readinessProbe: | ||
| tcpSocket: | ||
| port: 25 | ||
| initialDelaySeconds: 30 | ||
| periodSeconds: 5 | ||
| successThreshold: 1 | ||
| failureThreshold: 3 | ||
| timeoutSeconds: 20 | ||
| livenessProbe: | ||
| tcpSocket: | ||
| port: 25 | ||
| initialDelaySeconds: 60 | ||
| periodSeconds: 5 | ||
| successThreshold: 1 | ||
| failureThreshold: 2 | ||
| timeoutSeconds: 60 | ||
| resources: | ||
| {{- toYaml .Values.resources | nindent 12 }} | ||
| volumes: | ||
| {{- if .Values.additionalConfig.abac.extraCas }} | ||
| - name: abac-cas | ||
| configMap: | ||
| name: {{ .Chart.Name }}-base-configs | ||
| items: | ||
| {{- range $index, $unused := .Values.additionalConfig.abac.extraCas }} | ||
| - key: ABAC_CA_{{ $index }} | ||
| path: abac-ca-{{ $index }}.crt | ||
| {{- end }} | ||
| {{- end }} | ||
| - name: cert-dir | ||
| emptyDir: {} | ||
| {{- if eq .Values.additionalConfig.dkimSigning.enabled true }} | ||
| - name: dkim-dir | ||
| secret: | ||
| defaultMode: 420 | ||
| secretName: {{ .Release.Name }}-dkim-secrets | ||
| {{- end }} | ||
| {{- with .Values.nodeSelector }} | ||
| nodeSelector: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| {{- with .Values.affinity }} | ||
| affinity: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| {{- with .Values.tolerations }} | ||
| tolerations: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| {{- end }} |
Oops, something went wrong.