Alan McGinlay amcginlay

Okta authentication through the Pomerium Ingress Controller

Okta: Create an App Integration

Head to https://dev-NNNNNNNN-admin.okta.com/admin/apps/active
Click "Create App Integration", leaving ALL as default except the following:
- Sign-in method: "OIDC - OpenID Connect"
- Application Type: "Web Application"
- App integration name: "pomerium-test" (or similar)
- Grant type: select "Refresh Token"
Sign-in redirect URIs: "https://authenticate./oauth2/callback"

Experiment with KinD, csi-driver and TLS Protect Cloud

Create a KinD cluster

k8s_name=kind-$(date +"%y%m%d%H%M")
cat <<EOF | kind create cluster --config -
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
name: ${k8s_name}
nodes:

cert-manager + Vault + TLSPC

The following instructions have been tested using a KinD cluster and uses the Venafi Secrets Engine for HashiCorp Vault

install vault (dev mode)

helm repo add hashicorp https://helm.releases.hashicorp.com
helm -n vault install vault hashicorp/vault --create-namespace \
  --set "server.dev.enabled=true" \
  --set "server.extraArgs=-dev-plugin-dir=/vault/plugins/" \

Enable Secrets Engine PKI in K8s Vault (dev-mode)

Install Vault

helm repo add hashicorp https://helm.releases.hashicorp.com
helm -n vault install vault hashicorp/vault --create-namespace --set "server.dev.enabled=true"

Start session on Vault pod

Smallstep cert-manager issuer with TLSPK

Create KinD cluster, connect to TLSPK and deploy enterprise cert-manager

k8s_name=kind-$(date +"%y%m%d%H%M")
cat <<EOF | kind create cluster --config -
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
name: ${k8s_name}
nodes:

TLSPK Venafi Enhanced Issuer with TLSPC and Vault

Terminology:

TLSPK: TLS Protect for Kubernetes (previously Jetstack Secure or JSS)
TLSPC: TLS Protect Cloud (previously Venafi as a Service or VaaS)
TLSP: TLS Protect Data Centre (previously Venafi Trust Protection Platform or TPP)
VEI: Venafi Enhanced Issuer (not to be confused with the native cert-manager issuer for Venafi)

cert-manager's native Venafi issuer requires Kubernetes secrets to hold Venafi credentials (e.g. API keys). Ideally you wish to eliminate the use of all secrets as these create a potential attack vector.

Adventures in OpenShift (OKD on AWS)

Cloud9 Jumpbox

Create a Cloud9 jumpbox using Step 01-03 here. This box will sufficient AWS privileges, for example, EC2 and Route53.

Inspired by Installing a cluster quickly on AWS

Set base directory

Minimizing the use of jsctl

Minimizing the use of the jsctl CLI gives you more flexibility.

For example:

You get to install whatever version of js-operator you desire
You force yourself to get familiar with the controller's Installation manifest, which jsctl otherwise attempts to abstract away

	---
	apiVersion: cert-manager.io/v1
	kind: Certificate
	metadata:
	name: www081050-jetstack-mcginlay-net
	spec:
	secretName: www081050-jetstack-mcginlay-net-tls
	dnsNames:
	- www081050.jetstack.mcginlay.net
	issuerRef:

	# From https://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-on-linux

	sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80