Compare commits
10 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 unkin-agent
|
3fa12e4e5a | ||
|
unkin-agent
|
ba14f85e51 | ||
|
unkin-agent
|
8a00ddb82c | ||
|
unkin-agent
|
d4aed39f6a | ||
|
unkin-agent
|
d6a1279efe | ||
|
unkin-agent
|
55af4b2f16 | ||
|
unkin-agent
|
783a3db0fd | ||
|
unkin-agent
|
84f09f89ff | ||
|
unkin-agent
|
5b07157eeb | ||
|
unkin-agent
|
7aec9a9021 |
@@ -1,4 +1,21 @@
|
||||
---
|
||||
# Path split between the authenticated UI and the unauthenticated machine API.
|
||||
# Longest matching prefix wins, so the two UI rules take precedence over "/".
|
||||
#
|
||||
# AUTHENTICATED (oauth2 Service -> oauth2-proxy -> ui Service):
|
||||
# /oauth2 oauth2-proxy sign_in / start / callback / sign_out
|
||||
# /ui the human-facing SPA
|
||||
#
|
||||
# NOT AUTHENTICATED (artifactapi Service, unchanged):
|
||||
# /api/v1/{remote,local,virtual}/* package proxy reads (yum/dnf, pip, ...)
|
||||
# /api/v2/remotes|virtuals|locals/* management API + the UI's own XHR calls
|
||||
# /api/v2/remotes/{name}/files/* CI publish uploads (PUT) and downloads
|
||||
# /v2/* Docker Registry V2 (containerd, buildah)
|
||||
# /terraform/v1/providers/* Terraform provider registry
|
||||
# /.well-known/terraform.json Terraform service discovery
|
||||
# /health, /version, / probes and the redirect to /ui/
|
||||
# Those clients cannot complete a browser OIDC flow, so they must never be
|
||||
# routed through oauth2-proxy.
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
@@ -22,7 +39,17 @@ spec:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: ui
|
||||
name: oauth2
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /oauth2
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: oauth2
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
|
||||
@@ -12,6 +12,8 @@ resources:
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- namespace.yaml
|
||||
- oauth2-proxy-configmap.yaml
|
||||
- oauth2-proxy-deployment.yaml
|
||||
- redis-deployment.yaml
|
||||
- services.yaml
|
||||
- ui-deployment.yaml
|
||||
|
||||
@@ -0,0 +1,46 @@
|
||||
---
|
||||
# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
|
||||
# from the oauth-credentials Secret).
|
||||
#
|
||||
# SCOPE: this proxy fronts the artifactapi web UI ONLY. The HTTPRoute sends just
|
||||
# /ui and /oauth2 here; every machine surface (/api/v1, /api/v2, /v2 docker
|
||||
# registry, /terraform, /.well-known/terraform.json, /health, /version, /) goes
|
||||
# straight to the api Service and is NOT authenticated. yum/dnf, containerd
|
||||
# registry mirrors, docker/buildah, terraform init and Woodpecker publish steps
|
||||
# cannot complete a browser OIDC flow, so they must never reach this container.
|
||||
# Its only upstream is the ui Service -- there is deliberately no api upstream.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: artifactapi-oauth2-env
|
||||
namespace: artifactapi
|
||||
data:
|
||||
OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
|
||||
OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:44180"
|
||||
OAUTH2_PROXY_PROVIDER: "oidc"
|
||||
# Publicly-trusted Authentik host: the authorize step is a browser redirect,
|
||||
# so the issuer must present a cert every user's browser already trusts (the
|
||||
# k8s host serves an internal-CA cert). Slug from terraform-authentik.
|
||||
OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/artifactapi/"
|
||||
OAUTH2_PROXY_REDIRECT_URL: "https://artifactapi.k8s.syd1.au.unkin.net/oauth2/callback"
|
||||
OAUTH2_PROXY_UPSTREAMS: "http://ui.artifactapi.svc.cluster.local:80/"
|
||||
OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
|
||||
# Populate session.Groups from the Authentik hierarchical ak_groups claim.
|
||||
OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
|
||||
OAUTH2_PROXY_ALLOWED_GROUPS: "akP-artifactapi-admin"
|
||||
OAUTH2_PROXY_PASS_USER_HEADERS: "true"
|
||||
OAUTH2_PROXY_EMAIL_DOMAINS: "*"
|
||||
# Authentik hardcodes email_verified=false in the id_token; authorization is
|
||||
# enforced via ak_groups, so accepting the unverified email is safe.
|
||||
OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
|
||||
OAUTH2_PROXY_COOKIE_SECURE: "true"
|
||||
OAUTH2_PROXY_COOKIE_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
|
||||
OAUTH2_PROXY_WHITELIST_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
|
||||
OAUTH2_PROXY_REVERSE_PROXY: "true"
|
||||
OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
|
||||
OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
|
||||
# Back-channel discovery/token calls resolve the issuer inside the cluster,
|
||||
# where it is served under the internal unkin.net CA rather than the publicly
|
||||
# trusted cert the browser sees. Trust the bundle the combine-certs init
|
||||
# container assembles, as every other oauth2-proxy in the estate does.
|
||||
OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
|
||||
@@ -0,0 +1,136 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: oauth2
|
||||
namespace: artifactapi
|
||||
annotations:
|
||||
configmap.reloader.stakater.com/auto: "true"
|
||||
secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: oauth2
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: oauth2
|
||||
spec:
|
||||
serviceAccountName: default
|
||||
automountServiceAccountToken: false
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
initContainers:
|
||||
# The Authentik issuer is served behind the internal unkin.net CA;
|
||||
# combine the system roots with it so oauth2-proxy's OIDC HTTP client
|
||||
# trusts the discovery endpoint.
|
||||
- name: combine-certs
|
||||
image: docker.io/library/alpine:3
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
|
||||
volumeMounts:
|
||||
- name: vault-ca-cert
|
||||
mountPath: /custom-ca
|
||||
readOnly: true
|
||||
- name: combined-certs
|
||||
mountPath: /combined-certs
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 64Mi
|
||||
containers:
|
||||
- name: oauth2-proxy
|
||||
image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 4180
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 44180
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: artifactapi-oauth2-env
|
||||
optional: false
|
||||
env:
|
||||
- name: OAUTH2_PROXY_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth-credentials
|
||||
key: client_id
|
||||
- name: OAUTH2_PROXY_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth-credentials
|
||||
key: client_secret
|
||||
- name: OAUTH2_PROXY_COOKIE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth-credentials
|
||||
key: cookie_secret
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
volumeMounts:
|
||||
- name: combined-certs
|
||||
mountPath: /etc/ssl/combined
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
volumes:
|
||||
- name: vault-ca-cert
|
||||
secret:
|
||||
secretName: vault-ca-cert
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- name: combined-certs
|
||||
emptyDir: {}
|
||||
restartPolicy: Always
|
||||
@@ -16,6 +16,26 @@ spec:
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
# Authenticated front door for the web UI only: api-route sends /ui and /oauth2
|
||||
# here, oauth2-proxy authenticates and forwards to the ui Service. Every other
|
||||
# path reaches the api Service above directly and stays unauthenticated.
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: oauth2
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: oauth2
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
|
||||
@@ -32,3 +32,26 @@ spec:
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
---
|
||||
# Authentik OIDC client for the artifactapi UI front door (client_id,
|
||||
# client_secret, cookie_secret). Seeded out of band at
|
||||
# kv/kubernetes/namespace/artifactapi/default/oauth-credentials; the default
|
||||
# k8s auth role already grants the artifactapi/default ServiceAccount read on
|
||||
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so no
|
||||
# terraform-vault change is needed. Consumed by the oauth2 Deployment.
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: oauth-credentials
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: oauth-credentials
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/artifactapi/default/oauth-credentials
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
|
||||
@@ -14,3 +14,17 @@ spec:
|
||||
podMetricsEndpoints:
|
||||
- port: metrics
|
||||
path: /metrics
|
||||
---
|
||||
# Scrape the UI oauth2-proxy (:44180), which exposes sign-in/authz counters.
|
||||
apiVersion: operator.victoriametrics.com/v1beta1
|
||||
kind: VMPodScrape
|
||||
metadata:
|
||||
name: oauth2
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: oauth2
|
||||
podMetricsEndpoints:
|
||||
- port: metrics
|
||||
path: /metrics
|
||||
|
||||
@@ -25,7 +25,7 @@ spec:
|
||||
- name: pdbmux
|
||||
# Image is published by the pdbmux repo's .woodpecker/docker.yaml on
|
||||
# a v* tag. It only exists after that tag is cut (see PR merge gates).
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.2.0
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.4.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
|
||||
@@ -99,6 +99,24 @@ spec:
|
||||
- mountPath: /docker-custom-entrypoint.d/post-startup/additional-ruby-gems.sh
|
||||
name: additional-ruby-gems
|
||||
subPath: additional-ruby-gems.sh
|
||||
- mountPath: /usr/local/bin/certmanager
|
||||
name: cert-helpers
|
||||
subPath: vault-helper
|
||||
- mountPath: /usr/local/bin/sshsignhost
|
||||
name: cert-helpers
|
||||
subPath: vault-helper
|
||||
- mountPath: /opt/certmanager/config.yaml
|
||||
name: cert-helpers
|
||||
subPath: certmanager-config.yaml
|
||||
- mountPath: /opt/sshsignhost/config.yaml
|
||||
name: cert-helpers
|
||||
subPath: sshsignhost-config.yaml
|
||||
- mountPath: /configmaps/auth.conf
|
||||
name: compiler-auth-conf
|
||||
subPath: auth.conf
|
||||
- mountPath: /docker-custom-entrypoint.d/pre-default/10-auth-conf.sh
|
||||
name: compiler-auth-conf-seed
|
||||
subPath: 10-auth-conf.sh
|
||||
initContainers:
|
||||
- name: copy-configmaps
|
||||
image: busybox:1.35
|
||||
@@ -200,6 +218,63 @@ spec:
|
||||
volumeMounts:
|
||||
- mountPath: /opt/bin/
|
||||
name: puppet-shared-bins
|
||||
|
||||
- name: setup-cert-helpers
|
||||
image: git.unkin.net/unkin/almalinux9-base:20260606
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
args:
|
||||
- |
|
||||
set -e
|
||||
CH=/opt/bin/certhelpers
|
||||
PYROOT=$CH/py-el9-1
|
||||
TPL=/etc/puppetlabs/code/environments/develop/site/profiles/templates/helpers
|
||||
mkdir -p "$CH"
|
||||
|
||||
# The helpers are python3 (requests, pyyaml) and openvoxserver ships
|
||||
# no python, so stage a self-contained EL9 tree once per volume.
|
||||
if [ ! -f "$PYROOT/.ready" ]; then
|
||||
echo "Staging python runtime for the cert helpers..."
|
||||
TMP=$CH/.py-el9-1.$$
|
||||
rm -rf "$TMP"
|
||||
dnf -y --installroot="$TMP" --releasever=9 --nodocs \
|
||||
--setopt=install_weak_deps=0 --disablerepo=unkin install \
|
||||
python3 python3-requests python3-pyyaml python3-six
|
||||
rm -rf "$TMP/var/cache" "$TMP/var/lib/dnf" "$TMP/var/lib/rpm" \
|
||||
"$TMP/usr/share/locale"
|
||||
# Both hardcode EL absolute paths that only exist inside the tree.
|
||||
SP=$TMP/usr/lib/python3.9/site-packages
|
||||
ln -sfn ../../six.py "$SP/urllib3/packages/six.py"
|
||||
sed -i "s|'/etc/pki/tls/certs/ca-bundle.crt'|'$PYROOT/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem'|" \
|
||||
"$SP/requests/certs.py"
|
||||
touch "$TMP/.ready"
|
||||
mv -T "$TMP" "$PYROOT" || rm -rf "$TMP"
|
||||
fi
|
||||
|
||||
# Render from the puppet-prod ERB templates on the code volume so this
|
||||
# repo never carries a second copy of the scripts.
|
||||
for n in certmanager sshsignhost; do
|
||||
sed -e "s|<%= @venv_path %>|$PYROOT/usr|g" \
|
||||
-e "s|<%= @config_path %>|/opt/$n/config.yaml|g" \
|
||||
"$TPL/$n.erb" > "$CH/.$n.$$"
|
||||
chmod 0755 "$CH/.$n.$$"
|
||||
mv "$CH/.$n.$$" "$CH/$n"
|
||||
done
|
||||
echo "Cert helpers setup completed"
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- mountPath: /opt/bin/
|
||||
name: puppet-shared-bins
|
||||
- mountPath: /etc/puppetlabs/code/
|
||||
name: puppet-code-volume
|
||||
readOnly: true
|
||||
securityContext:
|
||||
fsGroup: 999
|
||||
seccompProfile:
|
||||
@@ -234,5 +309,25 @@ spec:
|
||||
configMap:
|
||||
name: additional-ruby-gems
|
||||
defaultMode: 0755
|
||||
- name: cert-helpers
|
||||
configMap:
|
||||
name: cert-helpers
|
||||
items:
|
||||
- key: vault-helper
|
||||
path: vault-helper
|
||||
mode: 0755
|
||||
- key: certmanager-config.yaml
|
||||
path: certmanager-config.yaml
|
||||
mode: 0444
|
||||
- key: sshsignhost-config.yaml
|
||||
path: sshsignhost-config.yaml
|
||||
mode: 0444
|
||||
- name: compiler-auth-conf
|
||||
configMap:
|
||||
name: compiler-auth.conf
|
||||
- name: compiler-auth-conf-seed
|
||||
configMap:
|
||||
name: compiler-auth-conf-seed
|
||||
defaultMode: 0755
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
|
||||
@@ -54,8 +54,25 @@ configMapGenerator:
|
||||
- resources/compiler/puppetdb.conf
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: compiler-auth.conf
|
||||
files:
|
||||
- resources/compiler/auth.conf
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: compiler-auth-conf-seed
|
||||
files:
|
||||
- resources/compiler/10-auth-conf.sh
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: additional-ruby-gems
|
||||
files:
|
||||
- resources/additional-ruby-gems.sh
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: cert-helpers
|
||||
files:
|
||||
- resources/cert-helpers/vault-helper
|
||||
- resources/cert-helpers/certmanager-config.yaml
|
||||
- resources/cert-helpers/sshsignhost-config.yaml
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
---
|
||||
# profiles::helpers::certmanager::vault_config, with kubernetes auth: the
|
||||
# certmanager approle is CIDR-bound to the legacy VM masters.
|
||||
vault:
|
||||
addr: 'https://vault.service.consul:8200'
|
||||
auth_method: 'kubernetes'
|
||||
k8s_mount: 'k8s/au/syd1'
|
||||
k8s_role: 'puppet_certmanager'
|
||||
jwt_path: '/var/run/secrets/kubernetes.io/serviceaccount/token'
|
||||
mount_point: 'pki_int'
|
||||
role_name: 'servers_default'
|
||||
output_path: '/tmp/certmanager'
|
||||
@@ -0,0 +1,11 @@
|
||||
---
|
||||
# profiles::helpers::sshsignhost::vault_config, with kubernetes auth.
|
||||
vault:
|
||||
addr: 'https://vault.service.consul:8200'
|
||||
auth_method: 'kubernetes'
|
||||
k8s_mount: 'k8s/au/syd1'
|
||||
k8s_role: 'puppet_sshsigner'
|
||||
jwt_path: '/var/run/secrets/kubernetes.io/serviceaccount/token'
|
||||
mount_point: 'ssh-host-signer'
|
||||
role_name: 'hostrole'
|
||||
output_path: '/tmp/sshsignhost'
|
||||
+11
@@ -0,0 +1,11 @@
|
||||
#!/bin/sh
|
||||
# Runs the certmanager/sshsignhost helper matching the name it is invoked as.
|
||||
# The openvoxserver image has no python, so the EL9 tree staged on the shared
|
||||
# bins volume is started through its own dynamic loader.
|
||||
set -eu
|
||||
|
||||
PYROOT=/opt/bin/certhelpers/py-el9-1
|
||||
|
||||
exec "${PYROOT}/lib64/ld-linux-x86-64.so.2" \
|
||||
--library-path "${PYROOT}/lib64:${PYROOT}/usr/lib64" \
|
||||
"${PYROOT}/usr/bin/python3.9" "/opt/bin/certhelpers/${0##*/}" "$@"
|
||||
+14
@@ -0,0 +1,14 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
SRC=/configmaps/auth.conf
|
||||
DST=/etc/puppetlabs/puppetserver/conf.d/auth.conf
|
||||
|
||||
# Copied rather than mounted: the entrypoint chowns conf.d and rewrites auth.conf,
|
||||
# both of which fail on a read-only configmap mount and abort container startup.
|
||||
if [ ! -s "$SRC" ]; then
|
||||
echo "FATAL: $SRC missing or empty; refusing to start on the image default auth.conf" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cp "$SRC" "$DST"
|
||||
@@ -0,0 +1,320 @@
|
||||
# Copied into conf.d at startup by 10-auth-conf.sh; the entrypoint then appends the
|
||||
# admin API cache rule and re-renders the result, so the running file is not byte-identical.
|
||||
authorization: {
|
||||
version: 1
|
||||
rules: [
|
||||
{
|
||||
# Allow nodes to retrieve their own catalog
|
||||
match-request: {
|
||||
path: "^/puppet/v3/catalog/([^/]+)$"
|
||||
type: regex
|
||||
method: [get, post]
|
||||
}
|
||||
allow: "$1"
|
||||
sort-order: 500
|
||||
name: "puppetlabs v3 catalog from agents"
|
||||
},
|
||||
{
|
||||
# Allow catalog-diff to retrieve catalogs on behalf of others.
|
||||
# sort-order 400 must stay lower than the puppetlabs deny that follows: rules
|
||||
# sort by [sort-order, name] and the first match wins.
|
||||
match-request: {
|
||||
path: "^/puppet/v4/catalog/?$"
|
||||
type: regex
|
||||
method: post
|
||||
}
|
||||
allow: "catalog-diff.main.unkin.net"
|
||||
sort-order: 400
|
||||
name: "unkin v4 catalog for catalog-diff"
|
||||
},
|
||||
{
|
||||
# Allow services to retrieve catalogs on behalf of others
|
||||
match-request: {
|
||||
path: "^/puppet/v4/catalog/?$"
|
||||
type: regex
|
||||
method: post
|
||||
}
|
||||
deny: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs v4 catalog for services"
|
||||
},
|
||||
{
|
||||
# Allow nodes to retrieve the certificate they requested earlier
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate/"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow-unauthenticated: true
|
||||
sort-order: 500
|
||||
name: "puppetlabs certificate"
|
||||
},
|
||||
{
|
||||
# Allow all nodes to access the certificate revocation list
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate_revocation_list/ca"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow-unauthenticated: true
|
||||
sort-order: 500
|
||||
name: "puppetlabs crl"
|
||||
},
|
||||
{
|
||||
# Allow nodes to request a new certificate
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate_request"
|
||||
type: path
|
||||
method: [get, put]
|
||||
}
|
||||
allow-unauthenticated: true
|
||||
sort-order: 500
|
||||
name: "puppetlabs csr"
|
||||
},
|
||||
{
|
||||
# Allow nodes to renew their certificate
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate_renewal"
|
||||
type: path
|
||||
method: post
|
||||
}
|
||||
# this endpoint should never be unauthenticated, as it requires the cert to be provided.
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs certificate renewal"
|
||||
},
|
||||
{
|
||||
# Allow the CA CLI to access the certificate_status endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate_status"
|
||||
type: path
|
||||
method: [get, put, delete]
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs cert status"
|
||||
},
|
||||
{
|
||||
match-request: {
|
||||
path: "^/puppet-ca/v1/certificate_revocation_list$"
|
||||
type: regex
|
||||
method: put
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs CRL update"
|
||||
},
|
||||
{
|
||||
# Allow the CA CLI to access the certificate_statuses endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/certificate_statuses"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs cert statuses"
|
||||
},
|
||||
{
|
||||
# Allow authenticated access to the CA expirations endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/expirations"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs CA cert and CRL expirations"
|
||||
},
|
||||
{
|
||||
# Allow the CA CLI to access the certificate clean endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/clean"
|
||||
type: path
|
||||
method: put
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs cert clean"
|
||||
},
|
||||
{
|
||||
# Allow the CA CLI to access the certificate sign endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/sign"
|
||||
type: path
|
||||
method: post
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs cert sign"
|
||||
},
|
||||
{
|
||||
# Allow the CA CLI to access the certificate sign all endpoint
|
||||
match-request: {
|
||||
path: "/puppet-ca/v1/sign/all"
|
||||
type: path
|
||||
method: post
|
||||
}
|
||||
allow: {
|
||||
extensions: {
|
||||
pp_cli_auth: "true"
|
||||
}
|
||||
}
|
||||
sort-order: 500
|
||||
name: "puppetlabs cert sign all"
|
||||
},
|
||||
{
|
||||
# Allow unauthenticated access to the status service endpoint
|
||||
match-request: {
|
||||
path: "/status/v1/services"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow-unauthenticated: true
|
||||
sort-order: 500
|
||||
name: "puppetlabs status service - full"
|
||||
},
|
||||
{
|
||||
match-request: {
|
||||
path: "/status/v1/simple"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow-unauthenticated: true
|
||||
sort-order: 500
|
||||
name: "puppetlabs status service - simple"
|
||||
},
|
||||
{
|
||||
match-request: {
|
||||
path: "/puppet/v3/environments"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs environments"
|
||||
},
|
||||
{
|
||||
# Allow nodes to access all file_bucket_files. Note that access for
|
||||
# the 'delete' method is forbidden by Puppet regardless of the
|
||||
# configuration of this rule.
|
||||
match-request: {
|
||||
path: "/puppet/v3/file_bucket_file"
|
||||
type: path
|
||||
method: [get, head, post, put]
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs file bucket file"
|
||||
},
|
||||
{
|
||||
# Allow nodes to access all file_content. Note that access for the
|
||||
# 'delete' method is forbidden by Puppet regardless of the
|
||||
# configuration of this rule.
|
||||
match-request: {
|
||||
path: "/puppet/v3/file_content"
|
||||
type: path
|
||||
method: [get, post]
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs file content"
|
||||
},
|
||||
{
|
||||
# Allow nodes to access all file_metadata. Note that access for the
|
||||
# 'delete' method is forbidden by Puppet regardless of the
|
||||
# configuration of this rule.
|
||||
match-request: {
|
||||
path: "/puppet/v3/file_metadata"
|
||||
type: path
|
||||
method: [get, post]
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs file metadata"
|
||||
},
|
||||
{
|
||||
# Allow nodes to retrieve only their own node definition
|
||||
match-request: {
|
||||
path: "^/puppet/v3/node/([^/]+)$"
|
||||
type: regex
|
||||
method: get
|
||||
}
|
||||
allow: "$1"
|
||||
sort-order: 500
|
||||
name: "puppetlabs node"
|
||||
},
|
||||
{
|
||||
# Allow nodes to store only their own reports
|
||||
match-request: {
|
||||
path: "^/puppet/v3/report/([^/]+)$"
|
||||
type: regex
|
||||
method: put
|
||||
}
|
||||
allow: "$1"
|
||||
sort-order: 500
|
||||
name: "puppetlabs report"
|
||||
},
|
||||
{
|
||||
# Allow nodes to update their own facts
|
||||
match-request: {
|
||||
path: "^/puppet/v3/facts/([^/]+)$"
|
||||
type: regex
|
||||
method: put
|
||||
}
|
||||
allow: "$1"
|
||||
sort-order: 500
|
||||
name: "puppetlabs facts"
|
||||
},
|
||||
{
|
||||
match-request: {
|
||||
path: "/puppet/v3/static_file_content"
|
||||
type: path
|
||||
method: get
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppetlabs static file content"
|
||||
},
|
||||
{
|
||||
match-request: {
|
||||
path: "/puppet/v3/tasks"
|
||||
type: path
|
||||
}
|
||||
allow: "*"
|
||||
sort-order: 500
|
||||
name: "puppet tasks information"
|
||||
},
|
||||
{
|
||||
# Deny everything else. This ACL is not strictly
|
||||
# necessary, but illustrates the default policy
|
||||
match-request: {
|
||||
path: "/"
|
||||
type: path
|
||||
}
|
||||
deny: "*"
|
||||
sort-order: 999
|
||||
name: "puppetlabs deny all"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -4,7 +4,7 @@ agent:
|
||||
WOODPECKER_MAX_WORKFLOWS: "8"
|
||||
WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
|
||||
WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
|
||||
WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
|
||||
WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 20Gi
|
||||
WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
|
||||
# Required from woodpecker 3.16.0 (GHSA-qf34-295c-26v8): step-level
|
||||
# serviceAccountName is gated behind this agent flag (default false).
|
||||
|
||||
Reference in New Issue
Block a user