sudermanjr

openpgp4fpr:E1D41017481B1ED9E3B77AF59C9CAE7EC2133DB7

sudermanjr

KIAM Implementation Notes

Roles and IAM

Masters already have assume-role (presumably), so we just need to create the roles. Module found here works quite well: uswitch/kiam#25 (comment)

Certs

For some reason kiam-server expects the certs to be valid for IP 127.0.0.1 as well as for the name of the service. I generated the certs using the instructions in the kiam repo, and it worked. Cert-manager doesn’t do IPs as well as DNS names yet, but it’s on the way in v0.7: https://github.com/jetstack/cert-manager/pull/1128/files

sudermanjr

          Git Actions:                CI System Actions:

   +-------------------------+       +-----------------+
+--► Create a Feature Branch |   +---► Build Container |
|  +------------+------------+   |   +--------+--------+
|               |                |            |
|               |                |            |
|      +--------▼--------+       |    +-------▼--------+
|  +---► Push the Branch +-------+    | Push Container |
|  |   +--------+--------+            +-------+--------+

sudermanjr

Andrew Suderman

Andrew Suderman has had a lifelong obsession with technology that currently fuels his passion for Kubernetes. He enjoys designing and building new systems that make life easier for developers. Currently he pursues that passion at ReactiveOps, where he maintains dozens of clusters and works on internal tooling.

In his spare time he enjoys off-roading, camping, quadcopters, motorcycles, and far too many other hobbies to afford.

sudermanjr

apiVersion: apps/v1
kind: Deployment
metadata:
  name: utilities
  labels:
    app: utilities
spec:
  replicas: 1
  selector:
    matchLabels:

sudermanjr

spec:
  fileAssets:
    - name: auditPolicyFile
      path: /srv/kubernetes/audit.yaml
      roles:
      - Master
      content: |
        apiVersion: audit.k8s.io/v1beta1
        kind: Policy
        rules:

sudermanjr

        resources:
          limits:
            cpu: 100m
            memory: 64Mi
          requests:
            cpu: 100m
            memory: 64Mi

sudermanjr

nginx-ingress:
  values-strings:
    controller:
      extraArgs:
        default-ssl-certificate: "infra/wildcard"

sudermanjr

apiVersion: rbacmanager.reactiveops.io/v1beta1
kind: RBACDefinition
metadata:
  name: rbac-manager-definition
  namespace: kube-system
rbacBindings:
  - name: admins
    subjects:
      - kind: ServiceAccount
        name: ci

sudermanjr

helm install --namespace kube-system --name rbac-manager stable/rbac-manager