amcginlay

Enable Secrets Engine PKI in K8s Vault (dev-mode)

Install Vault

helm repo add hashicorp https://helm.releases.hashicorp.com
helm -n vault install vault hashicorp/vault --create-namespace --set "server.dev.enabled=true"

Start session on Vault pod

amcginlay

cert-manager + Vault + TLSPC

The following instructions have been tested using a KinD cluster and uses the Venafi Secrets Engine for HashiCorp Vault

install vault (dev mode)

helm repo add hashicorp https://helm.releases.hashicorp.com
helm -n vault install vault hashicorp/vault --create-namespace \
  --set "server.dev.enabled=true" \
  --set "server.extraArgs=-dev-plugin-dir=/vault/plugins/" \

amcginlay

Experiment with KinD, csi-driver and TLS Protect Cloud

Create a KinD cluster

k8s_name=kind-$(date +"%y%m%d%H%M")
cat <<EOF | kind create cluster --config -
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
name: ${k8s_name}
nodes:

amcginlay

Okta authentication through the Pomerium Ingress Controller

Okta: Create an App Integration

• Head to https://dev-NNNNNNNN-admin.okta.com/admin/apps/active
• Click "Create App Integration", leaving ALL as default except the following:
  • Sign-in method: "OIDC - OpenID Connect"
  • Application Type: "Web Application"
  • App integration name: "pomerium-test" (or similar)
  • Grant type: select "Refresh Token"
• Sign-in redirect URIs: "https://authenticate./oauth2/callback"

amcginlay

# From https://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-on-linux

sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80

amcginlay

---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: www081050-jetstack-mcginlay-net
spec:
  secretName: www081050-jetstack-mcginlay-net-tls
  dnsNames:
    - www081050.jetstack.mcginlay.net
  issuerRef:

amcginlay

---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: self-signed
spec:
  selfSigned: {}

amcginlay

---
apiVersion: policy.cert-manager.io/v1alpha1
kind: CertificateRequestPolicy
metadata:
  name: accept-all
spec:
  allowed:
    dnsNames:
      values:
      - "*"

amcginlay

Adding clusters to TLS Protect For Kubernetes (TLSPK)

TLSPK Auth

jsctl auth login
jsctl config set organization <ORG_NAME>    # e.g. gallant-wright
jsctl registry auth output 2>&1 > /dev/null # force an image pull secret to be created as necessary

Create a new cluster (KinD)

amcginlay

kubectl -n demos apply -f - << EOF
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: demo-cert-tls
spec:
  dnsNames:
  - demo-cert.jetstack.mcginlay.net
  issuerRef:
    group: cert-manager.io