mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-21 13:07:13 +02:00
envoy: Initial changes
This commit is contained in:
Travis Groth
parent
8f78497e99
commit
99e788a9b4
107 changed files with 2542 additions and 3322 deletions
|
|
@ -45,12 +45,12 @@ module.exports = {
|
|||
{ text: "Configuration", link: "/configuration/" },
|
||||
{ text: "Recipes", link: "/recipes/" },
|
||||
{ text: "Enterprise", link: "/enterprise/" },
|
||||
|
||||
{
|
||||
text: "v0.8.x", // current tagged version
|
||||
text: "v0.7.x", // current tagged version
|
||||
ariaLabel: "Version menu",
|
||||
items: [
|
||||
{ text: "🚧Dev", link: "https://master.docs.pomerium.io/docs" },
|
||||
{ text: "v0.8.x", link: "https://0-8-0.docs.pomerium.io/docs" },
|
||||
{ text: "v0.7.x", link: "https://0-7-0.docs.pomerium.io/docs" },
|
||||
{ text: "v0.6.x", link: "https://0-6-0.docs.pomerium.io/docs" },
|
||||
{ text: "v0.5.x", link: "https://0-5-0.docs.pomerium.io/docs" },
|
||||
|
|
|
|||
|
|
@ -1,6 +1,5 @@
|
|||
/docs/reference/reference /configuration/
|
||||
/docs/reference/reference.html /configuration/
|
||||
/docs/configuration/ /configuration/
|
||||
|
||||
/community/ /docs/community/
|
||||
/community/index.html /docs/community/
|
||||
|
|
|
|||
|
|
@ -1,34 +0,0 @@
|
|||
---
|
||||
title: Announcing Pomerium 0.8
|
||||
date: 2020-5-11
|
||||
tags:
|
||||
- release
|
||||
- pomerium
|
||||
- announcement
|
||||
author: Bobby DeSimone
|
||||
---
|
||||
|
||||
# Announcing Pomerium 0.8
|
||||
|
||||
We are excited to announce the [0.8 release] of Pomerium which adds support for some of our most requested features including:
|
||||
|
||||
- [**Automatic Certificate Management**] — Pomerium can now be configured to automatically retrieve and renew certificates, adding HTTPS to all Pomerium managed routes. In addition, Pomerium will do [OCSP stapling](https://en.wikipedia.org/wiki/OCSP_stapling) for automatic and custom certificates alike.
|
||||
- [**Advanced Route Matching**] — Operators can now write access policy that supports route matching based on [regex], [prefix], and [path] settings. Pomerium now has the flexibility to support multiple and layered authorization policies across a single managed route.
|
||||
- And finally, this release adds [**Github**](https://github.com/) as a supported identity provider.
|
||||
|
||||
Pomerium had 95 commits from 8 authors across 5 organizations in this release. This release also includes additional new features, general improvements, and bug fixes, a complete list of which can be found in the [changelog].
|
||||
|
||||
As always, we recommend upgrading and testing this release in an isolated environment. If you experience any issues, please report them on the Pomerium GitHub [issue tracker].
|
||||
|
||||
<SimpleNewsletter/>
|
||||
|
||||
[**advanced route matching**]: ../configuration/readme.md#policy
|
||||
[**automatic certificate management**]: ../docs/reference/certificates.md#per-route-automatic-certificates
|
||||
[0.8 release]: https://github.com/pomerium/pomerium/releases/tag/v8.0.0
|
||||
[changelog]: ../docs/CHANGELOG.md
|
||||
[**github**]: ../docs/identity-providers/github.md
|
||||
[issue tracker]: https://github.com/pomerium/pomerium/issues
|
||||
[let's encrypt]: https://letsencrypt.org/
|
||||
[path]: ../configuration/readme.md#path
|
||||
[prefix]: ../configuration/readme.md#prefix
|
||||
[regex]: ../configuration/readme.md#regex
|
||||
|
|
@ -5,6 +5,7 @@ sidebarDepth: 2
|
|||
meta:
|
||||
- name: keywords
|
||||
content: pomerium community help bugs updates features
|
||||
|
||||
description: >-
|
||||
This document describes how you users can stay up to date with pomerium,
|
||||
report issues, get help, and suggest new features.
|
||||
|
|
@ -85,15 +86,15 @@ Customize for your identity provider run `docker-compose up -f nginx.docker-comp
|
|||
|
||||
- Uses Google Kubernetes Engine's built-in ingress to do [HTTPS load balancing]
|
||||
|
||||
<<< @/docs/configuration/examples/helm/helm_gke.sh
|
||||
<<< @/scripts/helm_gke.sh
|
||||
|
||||
### AWS ECS
|
||||
|
||||
- Uses Amazon Elastic Container Service
|
||||
|
||||
<<< @/docs/configuration/examples/helm/helm_aws.sh
|
||||
<<< @/scripts/helm_aws.sh
|
||||
|
||||
### Kubernetes
|
||||
## Kubernetes
|
||||
|
||||
- Uses Google Kubernetes Engine's built-in ingress to do [HTTPS load balancing]
|
||||
- HTTPS (TLS) between client, load balancer, and services
|
||||
|
|
@ -128,43 +129,3 @@ Customize for your identity provider run `docker-compose up -f nginx.docker-comp
|
|||
[helloworld]: https://hub.docker.com/r/tutum/hello-world
|
||||
[httpbin]: https://httpbin.org/
|
||||
[https load balancing]: https://cloud.google.com/kubernetes-engine/docs/concepts/ingress
|
||||
|
||||
## Istio
|
||||
|
||||
[istio]: https://github.com/istio/istio
|
||||
[certmanager]: https://github.com/jetstack/cert-manager
|
||||
[grafana]: https://github.com/grafana/grafana
|
||||
|
||||
- Istio provides mutual TLS via sidecars and to make Istio play well with Pomerium we need to disable TLS on the Pomerium side.
|
||||
- We need to provide Istio with information on how to route requests via Pomerium to their destinations.
|
||||
- The following example shows how to make Grafana's [auth proxy](https://grafana.com/docs/grafana/latest/auth/auth-proxy) work with Pomerium inside of an Istio mesh.
|
||||
|
||||
#### Gateway
|
||||
|
||||
We are using the standard istio-ingressgateway that comes configured with Istio and attach a Gateway to it that deals with a subset of our ingress traffic based on the Host header (in this case `*.yourcompany.com`). This is the Gateway to which we will later attach VirtualServices for more granular routing decisions. Along with the Gateway, because we care about TLS, we are using Certmanager to provision a self-signed certificate (see Certmanager [docs](https://cert-manager.io/docs) for setup instructions).
|
||||
|
||||
<<< @/docs/configuration/examples/kubernetes/istio/gateway.yml
|
||||
|
||||
#### Virtual Services
|
||||
|
||||
Here we are configuring two Virtual Services. One to route from the Gateway to the Authenticate service and one to route from the Gateway to the Pomerium Proxy, which will route the request to Grafana according to the configured Pomerium policy.
|
||||
|
||||
<<< @/docs/configuration/examples/kubernetes/istio/virtual-services.yml
|
||||
|
||||
#### Service Entry
|
||||
|
||||
If you are enforcing mutual TLS in your service mesh you will need to add a ServiceEntry for your identity provider so that Istio knows not to expect a mutual TLS connection with, for example `https://yourcompany.okta.com`.
|
||||
|
||||
<<< @/docs/configuration/examples/kubernetes/istio/service-entry.yml
|
||||
|
||||
#### Pomerium Configuration
|
||||
|
||||
For this example we're using the Pomerium Helm chart with the following `values.yaml` file. Things to note here are the `insecure` flag, where we are disabling TLS in Pomerium in favor of the Istio-provided TLS via sidecars. Also note the `extaEnv` arguments where we are asking Pomerium to extract the email property from the JWT and pass it on to Grafana in a header called `X-Pomerium-Claim-Email`. We need to do this because Grafana does not know how to read the Pomerium JWT but its auth-proxy authentication method can be configured to read user information from headers. The policy document contains a single route that will send all requests with a host header of `https://grafana.yourcompany.com` to the Grafana instance running in the monitoring namespace. We disable ingress because we are using the Istio ingressgateway for ingress traffic and don't need the Pomerium helm chart to create ingress objects for us.
|
||||
|
||||
<<< @/docs/configuration/examples/kubernetes/istio/pomerium-helm-values.yml
|
||||
|
||||
#### Grafana ini
|
||||
|
||||
On the Grafana side we are using the Grafana Helm chart and what follows is the relevant section of the `values.yml` file. The most important thing here is that we need to tell Grafana from which request header to grab the username. In this case that's `X-Pomerium-Claim-Email` because we will be using the user's email (provided by your identity provider) as their username in Grafana. For all the configuration options check out the Grafana documentation about its auth-proxy authentication method.
|
||||
|
||||
<<< @/docs/configuration/examples/kubernetes/istio/grafana.ini.yml
|
||||
|
|
|
|||
|
|
@ -15,12 +15,10 @@ export AUTHENTICATE_SERVICE_URL=https://authenticate.corp.beyondperimeter.com
|
|||
|
||||
# Certificates can be loaded as files or base64 encoded bytes.
|
||||
# See : https://www.pomerium.io/docs/reference/certificates
|
||||
export AUTOCERT=TRUE # Use Let's Encrypt to fetch certs. Port 80/443 must be internet accessible.
|
||||
# export AUTOCERT_DIR="./certs" # The path where you want to place your certificates
|
||||
# export CERTIFICATE_FILE="xxxx" # optional, defaults to `./cert.pem`
|
||||
# export CERTIFICATE_KEY_FILE="xxx" # optional, defaults to `./certprivkey.pem`
|
||||
# export CERTIFICATE="xxx" # base64 encoded cert, eg. `base64 -i cert.pem`
|
||||
# export CERTIFICATE_KEY="xxx" # base64 encoded key, eg. `base64 -i privkey.pem`
|
||||
export CERTIFICATE_FILE="$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/fullchain.cer" # optional, defaults to `./cert.pem`
|
||||
export CERTIFICATE_KEY_FILE="$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/*.corp.beyondperimeter.com.key" # optional, defaults to `./certprivkey.pem`
|
||||
# export CERTIFICATE="xxxxxx" # base64 encoded cert, eg. `base64 -i cert.pem`
|
||||
# export CERTIFICATE_KEY="xxxx" # base64 encoded key, eg. `base64 -i privkey.pem`
|
||||
|
||||
# Generate 256 bit random keys e.g. `head -c32 /dev/urandom | base64`
|
||||
export SHARED_SECRET="$(head -c32 /dev/urandom | base64)"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,8 @@
|
|||
#!/bin/bash
|
||||
|
||||
# See : https://www.pomerium.io/docs/reference/certificates
|
||||
export AUTOCERT=TRUE # Use Let's Encrypt to fetch certs. Port 80/443 must be internet accessible.
|
||||
export CERTIFICATE_FILE="$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/fullchain.cer" # optional, defaults to `./cert.pem`
|
||||
export CERTIFICATE_KEY_FILE="$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/*.corp.beyondperimeter.com.key" # optional, defaults to `./certprivkey.pem`
|
||||
|
||||
# 256 bit random keys
|
||||
export SHARED_SECRET="$(head -c32 /dev/urandom | base64)"
|
||||
|
|
|
|||
|
|
@ -4,10 +4,8 @@
|
|||
authenticate_service_url: https://authenticate.localhost.pomerium.io
|
||||
|
||||
# certificate settings: https://www.pomerium.io/docs/reference/certificates.html
|
||||
autocert: true
|
||||
|
||||
# REMOVE FOR PRODUCTION
|
||||
autocert_use_staging: true
|
||||
certificate_file: "./_wildcard.localhost.pomerium.io.pem"
|
||||
certificate_key_file: "./_wildcard.localhost.pomerium.io-key.pem"
|
||||
|
||||
# identity provider settings : https://www.pomerium.io/docs/identity-providers.html
|
||||
idp_provider: google
|
||||
|
|
|
|||
|
|
@ -1,18 +0,0 @@
|
|||
version: "3"
|
||||
services:
|
||||
pomerium:
|
||||
image: pomerium/pomerium:v0.8.0
|
||||
environment:
|
||||
# Generate new secret keys. e.g. `head -c32 /dev/urandom | base64`
|
||||
- COOKIE_SECRET=V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI=
|
||||
volumes:
|
||||
# Use a volume to store ACME certificates
|
||||
- pomerium:/data:rw
|
||||
ports:
|
||||
- 443:443
|
||||
|
||||
# https://httpbin.corp.beyondperimeter.com --> Pomerium --> http://httpbin
|
||||
httpbin:
|
||||
image: kennethreitz/httpbin:latest
|
||||
expose:
|
||||
- 80
|
||||
|
|
@ -1,7 +1,7 @@
|
|||
version: "3"
|
||||
services:
|
||||
pomerium:
|
||||
image: pomerium/pomerium:v0.8.0
|
||||
image: pomerium/pomerium:v0.7.0
|
||||
environment:
|
||||
# Generate new secret keys. e.g. `head -c32 /dev/urandom | base64`
|
||||
- COOKIE_SECRET=V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI=
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ services:
|
|||
- /var/run/docker.sock:/tmp/docker.sock:ro
|
||||
|
||||
pomerium-authenticate:
|
||||
image: pomerium/pomerium:v0.8.0 # or `build: .` to build from source
|
||||
image: pomerium/pomerium:v0.7.0 # or `build: .` to build from source
|
||||
restart: always
|
||||
environment:
|
||||
- SERVICES=authenticate
|
||||
|
|
@ -39,7 +39,7 @@ services:
|
|||
- 443
|
||||
|
||||
pomerium-proxy:
|
||||
image: pomerium/pomerium:v0.8.0 # or `build: .` to build from source
|
||||
image: pomerium/pomerium:v0.7.0 # or `build: .` to build from source
|
||||
restart: always
|
||||
environment:
|
||||
- SERVICES=proxy
|
||||
|
|
@ -61,7 +61,7 @@ services:
|
|||
- 443
|
||||
|
||||
pomerium-authorize:
|
||||
image: pomerium/pomerium:v0.8.0 # or `build: .` to build from source
|
||||
image: pomerium/pomerium:v0.7.0 # or `build: .` to build from source
|
||||
restart: always
|
||||
environment:
|
||||
- SERVICES=authorize
|
||||
|
|
@ -77,7 +77,7 @@ services:
|
|||
- 443
|
||||
|
||||
pomerium-cache:
|
||||
image: pomerium/pomerium:v0.8.0 # or `build: .` to build from source
|
||||
image: pomerium/pomerium:v0.7.0 # or `build: .` to build from source
|
||||
restart: always
|
||||
environment:
|
||||
- SERVICES=cache
|
||||
|
|
|
|||
|
|
@ -1,64 +0,0 @@
|
|||
#!/bin/bash
|
||||
# PRE-REQ:
|
||||
# 1) Install Helm : You should verify the content of this script before running.
|
||||
# curl https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get | bash
|
||||
# 2) Install https://eksctl.io/
|
||||
# For more information see:
|
||||
# - https://eksworkshop.com/helm_root/helm_intro/install/
|
||||
|
||||
echo "=> [AWS] creating cluster"
|
||||
eksctl create cluster --name=pomerium --nodes=1 --region=us-west-2
|
||||
|
||||
echo "=> [AWS] get cluster credentials so we can use kubctl locally"
|
||||
eksctl utils write-kubeconfig --name=pomerium
|
||||
|
||||
echo "=> [AWS] configure Helm access with RBAC"
|
||||
cat <<EOF >.helm-rbac.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: tiller
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: tiller
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: tiller
|
||||
namespace: kube-system
|
||||
EOF
|
||||
|
||||
kubectl apply -f .helm-rbac.yaml
|
||||
# cleanup
|
||||
rm .helm-rbac.yaml
|
||||
|
||||
echo "=> initialize Helm to install Tiller in your cluster"
|
||||
helm init --service-account=tiller
|
||||
helm repo update
|
||||
|
||||
echo "=> install pomerium with helm substituting configuration values as required; be sure to change these"
|
||||
helm install $HOME/charts/stable/pomerium/ \
|
||||
--name pomerium \
|
||||
--set config.sharedSecret=$(head -c32 /dev/urandom | base64) \
|
||||
--set config.cookieSecret=$(head -c32 /dev/urandom | base64) \
|
||||
--set config.cert=$(base64 -i cert.pem) \
|
||||
--set config.key=$(base64 -i privkey.pem) \
|
||||
--set config.policy="$(cat policy.example.yaml | base64)" \
|
||||
--set authenticate.idp.provider="google" \
|
||||
--set authenticate.proxyRootDomains="pomerium.io" \
|
||||
--set authenticate.redirectUrl="https://auth.corp.pomerium.io/oauth2/callback" \
|
||||
--set authenticate.idp.clientID="REPLACE_ME" \
|
||||
--set authenticate.idp.clientSecret="REPLACE_ME" \
|
||||
--set proxy.authenticateServiceUrl="https://auth.corp.pomerium.io" \
|
||||
--set proxy.authorizeServiceUrl="https://access.corp.pomerium.io"
|
||||
|
||||
# When done, clean up by deleting the cluster!
|
||||
#
|
||||
# helm del $(helm ls --all --short) --purge #!!! DELETES ALL YOUR HELM INSTANCES!
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
#!/bin/bash
|
||||
# PRE-REQ: Install Helm : You should verify the content of this script before running.
|
||||
# curl https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get | bash
|
||||
# NOTE! This will create real resources on Google's cloud. Make sure you clean up any unused
|
||||
# resources to avoid being billed. For reference, this tutorial cost me <10 cents for a couple of hours.
|
||||
# NOTE! You must change the identity provider client secret setting, and service account setting!
|
||||
# NOTE! If you are using gsuite, you should also set `authenticate.idp.serviceAccount`, see docs !
|
||||
|
||||
echo "=> [GCE] creating cluster"
|
||||
gcloud container clusters create pomerium --region us-west2 --num-nodes 1
|
||||
|
||||
echo "=> [GCE] get cluster credentials so we can use kubctl locally"
|
||||
gcloud container clusters get-credentials pomerium --region us-west2
|
||||
|
||||
echo "=> add pomerium's helm repo"
|
||||
helm repo add pomerium https://helm.pomerium.io
|
||||
|
||||
echo "=> add bitnami's helm repo"
|
||||
helm repo add bitnami https://charts.bitnami.com/bitnami
|
||||
|
||||
echo "=> install nginx as a sample hello world app"
|
||||
helm upgrade --install nginx bitnami/nginx --set service.type=ClusterIP
|
||||
|
||||
echo "=> update helm"
|
||||
helm repo update
|
||||
|
||||
echo "=> install pomerium with helm"
|
||||
helm install \
|
||||
pomerium \
|
||||
pomerium/pomerium \
|
||||
--set service.type="NodePort" \
|
||||
--set config.sharedSecret=$(head -c32 /dev/urandom | base64) \
|
||||
--set config.cookieSecret=$(head -c32 /dev/urandom | base64) \
|
||||
--set ingress.secret.name="pomerium-tls" \
|
||||
--set ingress.secret.cert=$(base64 -i "$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/fullchain.cer") \
|
||||
--set ingress.secret.key=$(base64 -i "$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/*.corp.beyondperimeter.com.key") \
|
||||
--values docs/configuration/examples/kubernetes/values.yaml
|
||||
|
||||
# When done, clean up by deleting the cluster!
|
||||
# helm del $(helm ls --all --short) --purge # deletes all your helm instances
|
||||
# gcloud container clusters delete pomerium # deletes your cluster
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: internal-gateway
|
||||
namespace: istio-system
|
||||
spec:
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- port:
|
||||
number: 443
|
||||
protocol: HTTPS
|
||||
name: https-default
|
||||
tls:
|
||||
mode: SIMPLE
|
||||
serverCertificate: "sds"
|
||||
privateKey: "sds"
|
||||
credentialName: internal-cert
|
||||
hosts:
|
||||
- *.yourcompany.com
|
||||
---
|
||||
apiVersion: cert-manager.io/v1alpha2
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: internal-cert
|
||||
namespace: istio-system
|
||||
spec:
|
||||
secretName: internal-cert
|
||||
issuerRef:
|
||||
name: self-signed-issuer
|
||||
kind: ClusterIssuer
|
||||
commonName: *.yourcompany.com
|
||||
dnsNames:
|
||||
- *.yourcompany.com
|
||||
---
|
||||
apiVersion: cert-manager.io/v1alpha2
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: self-signed-issuer
|
||||
spec:
|
||||
selfSigned: {}
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
grafana.ini:
|
||||
users:
|
||||
allow_sign_up: false
|
||||
auto_assign_org: true
|
||||
auto_assign_org_role: Editor
|
||||
auth.proxy:
|
||||
enabled: true
|
||||
header_name: X-Pomerium-Claim-Email
|
||||
header_property: username
|
||||
auto_sign_up: true
|
||||
sync_ttl: 60
|
||||
enable_login_token: false
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
config:
|
||||
insecure: true
|
||||
policy:
|
||||
- from: https://grafana.yourcompany.com
|
||||
to: "http://prometheus-grafana.monitoring.svc.cluster.local"
|
||||
timeout: 30s
|
||||
allowed_domains:
|
||||
- yourcompany.com
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
extraEnv:
|
||||
JWT_CLAIMS_HEADERS: email
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: ServiceEntry
|
||||
metadata:
|
||||
name: external-idp
|
||||
namespace: pomerium
|
||||
spec:
|
||||
hosts:
|
||||
- yourcompany.okta.com
|
||||
location: MESH_EXTERNAL
|
||||
ports:
|
||||
- number: 443
|
||||
name: https
|
||||
protocol: TLS
|
||||
resolution: DNS
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: grafana-virtual-service
|
||||
namespace: pomerium
|
||||
spec:
|
||||
gateways:
|
||||
- istio-system/internal-gateway
|
||||
hosts:
|
||||
- grafana.yourcompany.com
|
||||
http:
|
||||
- route:
|
||||
- destination:
|
||||
host: pomerium-proxy
|
||||
---
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: authenticate-virtual-service
|
||||
namespace: pomerium
|
||||
spec:
|
||||
gateways:
|
||||
- istio-system/internal-gateway
|
||||
hosts:
|
||||
- authenticate.yourcompany.com
|
||||
http:
|
||||
- route:
|
||||
- destination:
|
||||
host: pomerium-authenticate
|
||||
---
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
authenticate:
|
||||
idp:
|
||||
provider: "google"
|
||||
clientID: YOUR_CLIENT_ID
|
||||
clientSecret: YOUR_SECRET
|
||||
service:
|
||||
annotations:
|
||||
cloud.google.com/app-protocols: '{"https":"HTTPS"}'
|
||||
|
||||
proxy:
|
||||
service:
|
||||
annotations:
|
||||
cloud.google.com/app-protocols: '{"https":"HTTPS"}'
|
||||
|
||||
service:
|
||||
type: NodePort
|
||||
|
||||
config:
|
||||
rootDomain: corp.beyondperimeter.com
|
||||
policy:
|
||||
- from: https://hello.corp.beyondperimeter.com
|
||||
to: http://nginx.default.svc.cluster.local:80
|
||||
allowed_domains:
|
||||
- gmail.com
|
||||
|
||||
ingress:
|
||||
annotations:
|
||||
kubernetes.io/ingress.allow-http: false
|
||||
|
|
@ -80,7 +80,7 @@ Enabling the debug flag will result in sensitive information being logged!!!
|
|||
|
||||
:::
|
||||
|
||||
By default, JSON encoded logs are produced. Debug enables colored, human-readable logs to be streamed to [standard out](https://en.wikipedia.org/wiki/Standard_streams#Standard_output_(stdout)>>>). In production, it's recommended to be set to `false`.
|
||||
By default, JSON encoded logs are produced. Debug enables colored, human-readable logs to be streamed to [standard out](https://en.wikipedia.org/wiki/Standard_streams#Standard_output_(stdout)>). In production, it's recommended to be set to `false`.
|
||||
|
||||
For example, if `true`
|
||||
|
||||
|
|
@ -127,77 +127,23 @@ Pomerium should _never_ be exposed to the internet without TLS encryption.
|
|||
|
||||
:::
|
||||
|
||||
### Autocert
|
||||
### Certificate
|
||||
|
||||
- Environmental Variable: `AUTOCERT`
|
||||
- Config File Key: `autocert`
|
||||
- Type: `bool`
|
||||
- Optional
|
||||
- Environmental Variable: either `CERTIFICATE` or `CERTIFICATE_FILE`
|
||||
- Config File Key: `certificate` or `certificate_file`
|
||||
- Type: [base64 encoded] `string` or relative file location
|
||||
- Required
|
||||
|
||||
Turning on autocert allows Pomerium to automatically retrieve, manage, and renew public facing TLS certificates from [Let's Encrypt][letsencrypt] for each of your managed pomerium routes as well as for the authenticate service. This setting must be used in conjunction with [Autocert Directory](./#autocert-directory) as Autocert must have a place to persist, and share certificate data between services. Provides [OCSP stapling](https://en.wikipedia.org/wiki/OCSP_stapling).
|
||||
Certificate is the x509 _public-key_ used to establish secure HTTP and gRPC connections.
|
||||
|
||||
This setting can be useful in a situation where you do not have Pomerium behind a TLS terminating ingress or proxy that is already handling your public certificates on your behalf.
|
||||
### Certificate Key
|
||||
|
||||
:::warning
|
||||
|
||||
By using autocert, you agree to the [Let's Encrypt Subscriber Agreement](https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf). There are [_strict_ usage limits](https://letsencrypt.org/docs/rate-limits/) per domain you should be aware of. Consider testing with `autocert_use_staging` first.
|
||||
|
||||
:::
|
||||
|
||||
:::warning
|
||||
|
||||
Autocert requires that ports `80`/`443` be accessible from the internet in order to complete a [TLS-ALPN-01 challenge](https://letsencrypt.org/docs/challenge-types/#tls-alpn-01).
|
||||
|
||||
:::
|
||||
|
||||
### Autocert Directory
|
||||
|
||||
- Environmental Variable: either `AUTOCERT_DIR`
|
||||
- Config File Key: `autocert_dir`
|
||||
- Type: `string` pointing to the path of the directory
|
||||
- Required if using [Autocert](./#autocert) setting
|
||||
- Default:
|
||||
|
||||
- `/data/autocert` in published Pomerium docker images
|
||||
- [$XDG_DATA_HOME](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html)
|
||||
- `$HOME/.local/share/pomerium`
|
||||
|
||||
Autocert directory is path in which autocert will store x509 certificate data.
|
||||
|
||||
### Autocert Use Staging
|
||||
|
||||
- Environmental Variable: `AUTOCERT_USE_STAGING`
|
||||
- Config File Key: `autocert_use_staging`
|
||||
- Type: `bool`
|
||||
- Optional
|
||||
|
||||
Let's Encrypt has strict [usage limits](https://letsencrypt.org/docs/rate-limits/). Enabling this setting allows you to use Let's Encrypt's [staging environment](https://letsencrypt.org/docs/staging-environment/) which has much more lax usage limits.
|
||||
|
||||
### Certificates
|
||||
|
||||
- Config File Key: `certificates` (not yet settable using environmental variables)
|
||||
- Config File Key: `certificate` / `certificate_key`
|
||||
- Config File Key: `certificate_file` / `certificate_key_file`
|
||||
- Environmental Variable: `CERTIFICATE` / `CERTIFICATE_KEY`
|
||||
- Environmental Variable: `CERTIFICATE_FILE` / `CERTIFICATE_KEY_FILE`
|
||||
- Type: array of relative file locations `string`
|
||||
- Environmental Variable: either `CERTIFICATE_KEY` or `CERTIFICATE_KEY_FILE`
|
||||
- Config File Key: `certificate_key` or `certificate_key_file`
|
||||
- Type: [base64 encoded] `string`
|
||||
- Type: certificate relative file location `string`
|
||||
- Required (if insecure not set)
|
||||
- Required
|
||||
|
||||
Certificates are the x509 _public-key_ and _private-key_ used to establish secure HTTP and gRPC connections. Any combination of the above can be used together, and are additive. Use in conjunction with `Autocert` to get OCSP stapling.
|
||||
|
||||
For example, if specifying multiple certificates at once:
|
||||
|
||||
```yaml
|
||||
certificates:
|
||||
- cert: "$HOME/.acme.sh/authenticate.example.com_ecc/fullchain.cer"
|
||||
key: "$HOME/.acme.sh/authenticate.example.com_ecc/authenticate.example.com.key"
|
||||
- cert: "$HOME/.acme.sh/httpbin.example.com_ecc/fullchain.cer"
|
||||
key: "$HOME/.acme.sh/httpbin.example.com_ecc/httpbin.example.com.key"
|
||||
- cert: "$HOME/.acme.sh/prometheus.example.com_ecc/fullchain.cer"
|
||||
key: "$HOME/.acme.sh/prometheus.example.com_ecc/prometheus.example.com.key"
|
||||
```
|
||||
Certificate key is the x509 _private-key_ used to establish secure HTTP and gRPC connections.
|
||||
|
||||
### Global Timeouts
|
||||
|
||||
|
|
@ -967,7 +913,7 @@ Note: This setting will replace (not append) the system's trust store for a give
|
|||
- Type: [base64 encoded] `string` or relative file location
|
||||
- Optional
|
||||
|
||||
Pomerium supports client certificates which can be used to enforce [mutually authenticated and encrypted TLS connections](https://en.wikipedia.org/wiki/Mutual_authentication) (mTLS). For more details, see our [mTLS example repository](https://github.com/pomerium/examples/tree/master/mutual-tls) and the [certificate docs](../docs/reference/certificates.md).
|
||||
Pomerium supports client certificates which can be used to enforce [mutually authenticated and encrypted TLS connections](https://en.wikipedia.org/wiki/Mutual_authentication) (mTLS). For more details, see our [mTLS example repository](https://github.com/pomerium/examples/tree/master/mutual-tls) and the [certificate docs](./certificates.md).
|
||||
|
||||
### Set Request Headers
|
||||
|
||||
|
|
@ -1009,17 +955,16 @@ See [ProxyPreserveHost](http://httpd.apache.org/docs/2.0/mod/mod_proxy.html#prox
|
|||
- Type: [base64 encoded] `string`
|
||||
- Optional
|
||||
|
||||
Signing key is the base64 encoded key used to sign outbound requests. For more information see the [signed headers] docs.
|
||||
Signing key is the base64 encoded key used to sign outbound requests. For more information see the [signed headers](./signed-headers.md) docs.
|
||||
|
||||
If no certificate is specified, one will be generated for you and the base64'd public key will be added to the logs.
|
||||
|
||||
[base64 encoded]: https://en.wikipedia.org/wiki/Base64
|
||||
[environmental variables]: https://en.wikipedia.org/wiki/Environment_variable
|
||||
[identity provider]: ../docs/identity-providers/
|
||||
[identity provider]: ./identity-providers.md
|
||||
[json]: https://en.wikipedia.org/wiki/JSON
|
||||
[letsencrypt]: https://letsencrypt.org/
|
||||
[oidc rfc]: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
|
||||
[script]: https://github.com/pomerium/pomerium/blob/master/scripts/generate_wildcard_cert.sh
|
||||
[signed headers]: ./signed-headers.md
|
||||
[toml]: https://en.wikipedia.org/wiki/TOML
|
||||
[yaml]: https://en.wikipedia.org/wiki/YAML
|
||||
|
|
|
|||
|
|
@ -1,36 +1,5 @@
|
|||
# Changelog
|
||||
|
||||
## v0.8.0
|
||||
|
||||
To see a complete list of changes [see the diff](https://github.com/pomerium/pomerium/compare/v0.7.0...v0.8.0).
|
||||
|
||||
### New
|
||||
|
||||
- cryptutil: add automatic certificate management @desimone [GH-644]
|
||||
- implement path-based route matching @calebdoxsey [GH-615]
|
||||
- internal/identity: implement github provider support @Lumexralph [GH-582]
|
||||
- proxy: add configurable JWT claim headers @travisgroth (#596)
|
||||
- proxy: remove extra session unmarshalling @desimone (#592)
|
||||
|
||||
### Changes
|
||||
|
||||
- ci: Switch integration tests from minikube to kind @travisgroth [GH-656]
|
||||
- integration-tests: add CORS test @calebdoxsey [GH-662]
|
||||
- integration-tests: add websocket enabled/disabled test @calebdoxsey [GH-661]
|
||||
- integration-tests: set_request_headers and preserve_host_header options @calebdoxsey [GH-668]
|
||||
- pre-commit: add pre-commit configuration @calebdoxsey [GH-666]
|
||||
- proxy: improve JWT header behavior @travisgroth [GH-642]
|
||||
|
||||
## Fixed
|
||||
|
||||
- authorize: fix authorization check for allowed_domains to only match current route @calebdoxsey [GH-624]
|
||||
- authorize: fix unexpected panic on reload @travisgroth [GH-652]
|
||||
- site: fix site on mobile @desimone [GH-597]
|
||||
|
||||
### Documentation
|
||||
|
||||
- deploy: autocert documentation and defaults @travisgroth [GH-658]
|
||||
|
||||
## v0.7.5
|
||||
|
||||
### Fixed
|
||||
|
|
@ -77,7 +46,7 @@ There were no changes in the v0.7.1 release, but we updated the build process sl
|
|||
|
||||
### New
|
||||
|
||||
- *: remove import path comments @desimone [GH-545]
|
||||
- \*: remove import path comments @desimone [GH-545]
|
||||
- authenticate: make callback path configurable @desimone [GH-493]
|
||||
- authenticate: return 401 for some specific error codes @cuonglm [GH-561]
|
||||
- authorization: log audience claim failure @desimone [GH-553]
|
||||
|
|
@ -162,7 +131,6 @@ There were no changes in the v0.7.1 release, but we updated the build process sl
|
|||
- config: Remove CookieRefresh [GH-428] @u5surf [GH-436]
|
||||
- config: validate that `shared_key` does not contain whitespace @travisgroth [GH-427]
|
||||
- httputil : wrap handlers for additional context @desimone [GH-413]
|
||||
- forward-auth: validate using forwarded uri header @branchmispredictor [GH-600]
|
||||
|
||||
### Fixed
|
||||
|
||||
|
|
|
|||
|
|
@ -5,6 +5,7 @@ sidebarDepth: 0
|
|||
meta:
|
||||
- name: keywords
|
||||
content: pomerium community contributing pr code
|
||||
|
||||
description: >-
|
||||
This document describes how you can find issues to work on, fix/add
|
||||
documentation, and how setup Pomerium for local development.
|
||||
|
|
@ -92,4 +93,4 @@ We use [Netlify](https://www.netlify.com) to build and host our docs. One of nic
|
|||
[httpbin]: https://httpbin.org/
|
||||
[identity provider]: ../identity-providers/readme.md
|
||||
[make]: https://en.wikipedia.org/wiki/Make_(software)
|
||||
[tls certificates]: ../reference/certificates.md
|
||||
[wild-card tls certificate]: ../reference/certificates.md
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ The following quick-start guide covers how to configure and run Pomerium using t
|
|||
## Prerequisites
|
||||
|
||||
- A configured [identity provider]
|
||||
- [TLS certificates]
|
||||
- A [wild-card TLS certificate]
|
||||
|
||||
## Download
|
||||
|
||||
|
|
@ -52,6 +52,6 @@ Browse to `external-httpbin.your.domain.example`. Connections between you and [h
|
|||
[download]: https://github.com/pomerium/pomerium/releases
|
||||
[environmental configuration variables]: https://12factor.net/config
|
||||
[httpbin]: https://httpbin.org/
|
||||
[identity provider]: ../identity-providers/
|
||||
[identity provider]: ../docs/identity-providers/
|
||||
[make]: https://en.wikipedia.org/wiki/Make_(software)
|
||||
[tls certificates]: ../reference/certificates.md
|
||||
[wild-card tls certificate]: ../reference/certificates.md
|
||||
|
|
|
|||
|
|
@ -73,6 +73,6 @@ Browse to `httpbin.localhost.pomerium.io`. Connections between you and [httpbin]
|
|||
|
||||
[configuration variables]: ../../configuration/readme.md
|
||||
[httpbin]: https://httpbin.org/
|
||||
[identity provider]: ../identity-providers/
|
||||
[identity provider]: ../docs/identity-providers/
|
||||
[make]: https://en.wikipedia.org/wiki/Make_(software)
|
||||
[tls certificates]: ../reference/certificates.md
|
||||
[wild-card tls certificate]: ../reference/certificates.md
|
||||
|
|
|
|||
|
|
@ -17,19 +17,17 @@ This quick-start will show you how to deploy Pomerium with [Helm](https://helm.s
|
|||
- Install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
|
||||
- Install the [Google Cloud SDK](https://cloud.google.com/kubernetes-engine/docs/quickstart)
|
||||
- Install [helm](https://helm.sh/docs/using_helm/)
|
||||
- [TLS certificates]
|
||||
- A [wild-card TLS certificate]
|
||||
|
||||
Though there are [many ways](https://unofficial-kubernetes.readthedocs.io/en/latest/setup/pick-right-solution/) to work with Kubernetes, for the purpose of this guide, we will be using Google's [Kubernetes Engine](https://cloud.google.com/kubernetes-engine/). That said, most of the following steps should be very similar using any other provider.
|
||||
Though there are [many ways](https://kubernetes.io/docs/setup/pick-right-solution/) to work with Kubernetes, for the purpose of this guide, we will be using Google's [Kubernetes Engine](https://cloud.google.com/kubernetes-engine/). That said, most of the following steps should be very similar using any other provider.
|
||||
|
||||
In addition to sharing many of the same features as the Kubernetes quickstart guide, the default helm deployment script also includes a bootstrapped certificate authority enabling mutually authenticated and encrypted communication between services that does not depend on the external LetsEncrypt certificates. Having the external domain certificate de-coupled makes it easier to renew external certificates.
|
||||
|
||||
## Configure
|
||||
|
||||
Download and modify the following helm_gke.sh script and values file to match your [identity provider] and [TLS certificates] settings.
|
||||
Download and modify the following [helm_gke.sh script][./scripts/helm_gke.sh] to match your [identity provider] and [wild-card tls certificate] settings.
|
||||
|
||||
<<<@/docs/configuration/examples/helm/helm_gke.sh
|
||||
|
||||
<<<@/docs/configuration/examples/kubernetes/values.yaml
|
||||
<<<@/scripts/helm_gke.sh
|
||||
|
||||
## Run
|
||||
|
||||
|
|
@ -58,4 +56,4 @@ You can also navigate to the special pomerium endpoint `httpbin.your.domain.exam
|
|||
[identity provider]: ../identity-providers/readme.md
|
||||
[letsencrypt]: https://letsencrypt.org/
|
||||
[script]: https://github.com/pomerium/pomerium/blob/master/scripts/generate_wildcard_cert.sh
|
||||
[tls certificates]: ../reference/certificates.md
|
||||
[wild-card tls certificate]: ../reference/certificates.md
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ This quickstart will cover how to deploy Pomerium with Kubernetes.
|
|||
## Prerequisites
|
||||
|
||||
- A configured [identity provider]
|
||||
- [TLS certificates]
|
||||
- A [wild-card TLS certificate]
|
||||
- A [Google Cloud Account](https://console.cloud.google.com/)
|
||||
- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
|
||||
- [Google Cloud SDK](https://cloud.google.com/kubernetes-engine/docs/quickstart)
|
||||
|
|
@ -29,7 +29,7 @@ cd $HOME/pomerium/docs/configuration/examples/kubernetes
|
|||
|
||||
## Configure
|
||||
|
||||
Edit [./kubernetes_gke.sh] making sure to change the identity provider secret value to match your [identity provider] and [TLS certificates] settings.
|
||||
Edit [./kubernetes_gke.sh] making sure to change the identity provider secret value to match your [identity provider] and [wild-card tls certificate] settings.
|
||||
|
||||
<<<@/docs/configuration/examples/kubernetes/kubernetes_gke.sh
|
||||
|
||||
|
|
@ -63,9 +63,9 @@ You can also navigate to the special pomerium endpoint `httpbin.your.domain.exam
|
|||
|
||||
|
||||
|
||||
[./kubernetes_gke.sh]: ../../configuration/examples.md#google-kubernetes-engine
|
||||
[example kubernetes files]: ../../configuration/examples.md#google-kubernetes-engine
|
||||
[./kubernetes_gke.sh]: ../reference/examples#google-kubernetes-engine
|
||||
[example kubernetes files]: ../reference/examples#google-kubernetes-engine
|
||||
[identity provider]: ../identity-providers/readme.md
|
||||
[letsencrypt]: https://letsencrypt.org/
|
||||
[script]: https://github.com/pomerium/pomerium/blob/master/scripts/generate_wildcard_cert.sh
|
||||
[tls certificates]: ../reference/certificates.md
|
||||
[wild-card tls certificate]: ../reference/certificates.md
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ In the following quick-start, we'll create a minimal but complete environment fo
|
|||
|
||||
- A configured [identity provider]
|
||||
- [Docker] and [docker-compose]
|
||||
- [TLS certificates]
|
||||
- A [wild-card TLS certificate]
|
||||
|
||||
## Configure
|
||||
|
||||
|
|
@ -26,26 +26,12 @@ Create a [configuration file] (e.g `config.yaml`) for defining Pomerium's config
|
|||
|
||||
Ensure the `docker-compose.yml` contains the correct path to your `config.yaml`.
|
||||
|
||||
### Autocert Docker-compose
|
||||
Ensure you have set up the requisite DNS and port forwarding in [TLS certificates]
|
||||
### Docker-compose
|
||||
|
||||
Download the following `docker-compose.yml` file and modify it to:
|
||||
|
||||
- generate new secrets
|
||||
- mount your [TLS certificates]
|
||||
- mount your `config.yaml` [configuration file]
|
||||
- Set `autocert_use_staging` to `false` once you have finished testing
|
||||
|
||||
<<< @/docs/configuration/examples/docker/autocert.docker-compose.yml
|
||||
|
||||
Please note that you should use a persistent volume to store certificate data, or you may exhaust your domain quota on Let's Encrypt.
|
||||
|
||||
### Wildcard Docker-compose
|
||||
|
||||
Download the following `docker-compose.yml` file and modify it to:
|
||||
|
||||
- generate new secrets
|
||||
- mount your [TLS certificates]
|
||||
- mount your [wild-card TLS certificate]
|
||||
- mount your `config.yaml` [configuration file]
|
||||
|
||||
<<< @/docs/configuration/examples/docker/basic.docker-compose.yml
|
||||
|
|
@ -72,4 +58,4 @@ You can also navigate to the special pomerium endpoint `httpbin.corp.yourdomain.
|
|||
[docker-compose]: https://docs.docker.com/compose/install/
|
||||
[httpbin]: https://httpbin.org/
|
||||
[identity provider]: ../identity-providers/readme.md
|
||||
[tls certificates]: ../reference/certificates.md
|
||||
[wild-card tls certificate]: ../reference/certificates.md
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ Pomerium is lightweight, can easily handle hundreds of concurrent requests, and
|
|||
- A [docker-capable] synology product
|
||||
- A [Google Cloud Account](https://console.cloud.google.com/)
|
||||
- A configured Google OAuth2 [identity provider]
|
||||
- [TLS certificates][certificate documentation]
|
||||
- A [wild-card TLS certificate][certificate documentation]
|
||||
|
||||
Though any supported [identity provider] would work, this guide uses google.
|
||||
|
||||
|
|
@ -46,17 +46,17 @@ Click **Create**.
|
|||
|
||||
Set the following **Reverse Proxy Rules**.
|
||||
|
||||
Field | Description
|
||||
-------------------- | -----------
|
||||
Description | pomerium
|
||||
Source Protocol | HTTPS
|
||||
Source Hostname | *
|
||||
Destination Port | 8443
|
||||
HTTP/2 | Enabled
|
||||
HSTS | Enabled
|
||||
Destination Protocol | HTTP
|
||||
Destination Hostname | localhost
|
||||
Destination Port | 32443
|
||||
| Field | Description |
|
||||
| -------------------- | ----------- |
|
||||
| Description | pomerium |
|
||||
| Source Protocol | HTTPS |
|
||||
| Source Hostname | \* |
|
||||
| Destination Port | 8443 |
|
||||
| HTTP/2 | Enabled |
|
||||
| HSTS | Enabled |
|
||||
| Destination Protocol | HTTP |
|
||||
| Destination Hostname | localhost |
|
||||
| Destination Port | 32443 |
|
||||
|
||||
|
||||
|
||||
|
|
@ -76,9 +76,9 @@ Once the certificate is showing on the list of certificates screen we need to te
|
|||
|
||||
**Click configure**
|
||||
|
||||
Services | Certificate
|
||||
-------- | -------------------
|
||||
*:8443 | `*.int.nas.example`
|
||||
| Services | Certificate |
|
||||
| -------- | ------------------- |
|
||||
| \*:8443 | `*.int.nas.example` |
|
||||
|
||||
|
||||
|
||||
|
|
@ -170,15 +170,15 @@ These are the minimum set of configuration settings to get Pomerium running in t
|
|||
|
||||
Go to **Environment** tab.
|
||||
|
||||
Field | Value
|
||||
------------------------ | ---------------------------------------------------------------
|
||||
POLICY | output of `base64 -i policy.yaml`
|
||||
INSECURE_SERVER | `TRUE`, internal routing within docker will not be encrypted.
|
||||
IDP_CLIENT_SECRET | Values from setting up your [identity provider]
|
||||
IDP_CLIENT_ID | Values from setting up your [identity provider]
|
||||
IDP_PROVIDER | Values from setting up your [identity provider] (e.g. `google`)
|
||||
COOKIE_SECRET | output of `head -c32 /dev/urandom | base64`
|
||||
AUTHENTICATE_SERVICE_URL | `https://authenticate.int.nas.example`
|
||||
| Field | Value |
|
||||
| ------------------------ | --------------------------------------------------------------- |
|
||||
| POLICY | output of `base64 -i policy.yaml` |
|
||||
| INSECURE_SERVER | `TRUE`, internal routing within docker will not be encrypted. |
|
||||
| IDP_CLIENT_SECRET | Values from setting up your [identity provider] |
|
||||
| IDP_CLIENT_ID | Values from setting up your [identity provider] |
|
||||
| IDP_PROVIDER | Values from setting up your [identity provider] (e.g. `google`) |
|
||||
| COOKIE_SECRET | output of `head -c32 /dev/urandom | base64` |
|
||||
| AUTHENTICATE_SERVICE_URL | `https://authenticate.int.nas.example` |
|
||||
|
||||
For a detailed explanation, and additional options, please refer to the [configuration variable docs]. Also note, though not covered in this guide, settings can be made via a mounted configuration file.
|
||||
|
||||
|
|
|
|||
|
|
@ -8,9 +8,7 @@ meta:
|
|||
|
||||
# Certificates
|
||||
|
||||
[Certificates](https://en.wikipedia.org/wiki/X.509) and [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) play a vital role in [zero-trust][principles] networks, and in Pomerium.
|
||||
|
||||
This document covers a few options in how to generate and set up TLS certificates suitable for working with pomerium.
|
||||
[Certificates](https://en.wikipedia.org/wiki/X.509) and [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) play a vital role in [zero-trust][principles] networks, and in Pomerium. This document covers how to generate and set up wild-card certificates suitable for working with pomerium.
|
||||
|
||||
This guide uses the following tools and resources:
|
||||
|
||||
|
|
@ -18,7 +16,13 @@ This guide uses the following tools and resources:
|
|||
- [Google Domains](https://domains.google.com/) registrar will be used to set up our wildcard domain and certificate validation. But any registrar would do and some providers support [automatic renewal](https://github.com/Neilpang/acme.sh/wiki/dnsapi).
|
||||
- [acme.sh](https://github.com/Neilpang/acme.sh) will be used to retrieve the wild-card domain certificate. Any [LetsEncrypt client](https://letsencrypt.org/docs/client-options/) that supports wildcard domains would work.
|
||||
|
||||
It should be noted that there are countless ways of building and managing [public-key infrastructure](https://en.wikipedia.org/wiki/Public_key_infrastructure). And although we hope this guide serves as a helpful baseline for generating and securing pomerium with certificates, these instructions should be modified to meet your own organization's tools, needs, and constraints. In a production environment you will likely be using your corporate load balancer, or a key management system to manage your certificate authority infrastructure.
|
||||
It should be noted that there are countless ways of building and managing [public-key infrastructure](https://en.wikipedia.org/wiki/Public_key_infrastructure). And although we hope this guide serves as a helpful baseline for generating and securing pomerium with certificates, these instructions should be modified to meet your own organization's tools, needs, and constraints.
|
||||
|
||||
::: warning
|
||||
|
||||
LetsEncrypt certificates must be renewed [every 90 days](https://letsencrypt.org/2015/11/09/why-90-days.html).
|
||||
|
||||
:::
|
||||
|
||||
## Why
|
||||
|
||||
|
|
@ -28,43 +32,40 @@ Since one of Pomerium's core [principles] is to treat internal and external traf
|
|||
- Pomerium's services **regardless** of if the network is "trusted"
|
||||
- Pomerium and the destination application
|
||||
|
||||
## Setting up DNS
|
||||
## How
|
||||
|
||||
First, you'll want to set a [CNAME](https://en.wikipedia.org/wiki/CNAME_record) record for wild-card domain name you will be using with Pomerium.
|
||||
|
||||
|
||||
|
||||
## Certificates
|
||||
|
||||
### Per-route automatic certificates
|
||||
|
||||
Pomerium itself can be used to retrieve, manage, and renew certificates certificates for free using Let's Encrypt, the only requirement is that Pomerium is able to receive public traffic on ports `80`/`443`. This is probably the easiest option.
|
||||
|
||||
```yaml
|
||||
autocert: true
|
||||
```
|
||||
|
||||
See the [Autocert] and [Autocert Directory] settings for more details.
|
||||
|
||||
### Self-signed wildcard certificate
|
||||
|
||||
In production, we'd use a public certificate authority such as LetsEncrypt. But for a local proof of concept or for development, we can use [mkcert](https://mkcert.dev/) to make locally trusted development certificates with any names you'd like. The easiest, is probably to use `*.localhost.pomerium.io` which we've already pre-configured to point back to localhost.
|
||||
|
||||
```bash
|
||||
# Install mkcert.
|
||||
go get -u github.com/FiloSottile/mkcert
|
||||
# Bootstrap mkcert's root certificate into your operating system's trust store.
|
||||
mkcert -install
|
||||
# Create your wildcard domain.
|
||||
# *.localhost.pomerium.io is helper domain we've hard-coded to route to localhost
|
||||
mkcert "*.localhost.pomerium.io"
|
||||
```
|
||||
|
||||
### Manual DNS Let's Encrypt wildcard certificate
|
||||
|
||||
Once you've setup your wildcard domain, we can use acme.sh to create a certificate-signing request with LetsEncrypt.
|
||||
|
||||
<<< @/docs/docs/reference/sh/generate_wildcard_cert.sh
|
||||
```bash
|
||||
# Requires acme.sh @ https://github.com/Neilpang/acme.sh
|
||||
# Install (after reviewing, obviously) by running :
|
||||
# $ curl https://get.acme.sh | sh
|
||||
$HOME/.acme.sh/acme.sh \
|
||||
--issue \
|
||||
-k ec-256 \
|
||||
-d '*.corp.example.com' \
|
||||
--dns \
|
||||
--yes-I-know-dns-manual-mode-enough-go-ahead-please
|
||||
|
||||
Creating domain key
|
||||
The domain key is here: $HOME/.acme.sh/*.corp.example.com_ecc/*.corp.example.com.key
|
||||
Single domain='*.corp.example.com'
|
||||
Getting domain auth token for each domain
|
||||
Getting webroot for domain='*.corp.example.com'
|
||||
Add the following TXT record:
|
||||
Domain: '_acme-challenge.corp.example.com'
|
||||
TXT value: 'Yz0B1Uf2xjyUI7Cr9-k96P2PQnw3RIK32dMViuvT58s'
|
||||
Please be aware that you prepend _acme-challenge. before your domain
|
||||
so the resulting subdomain will be: _acme-challenge.corp.example.com
|
||||
Please add the TXT records to the domains, and re-run with --renew.
|
||||
Please check log file for more details: $HOME/.acme.sh/acme.sh.log
|
||||
Removing DNS records.
|
||||
Not Found domain api file:
|
||||
```
|
||||
|
||||
LetsEncrypt will respond with the corresponding `TXT` record needed to verify our domain.
|
||||
|
||||
|
|
@ -72,12 +73,40 @@ LetsEncrypt will respond with the corresponding `TXT` record needed to verify ou
|
|||
|
||||
It may take a few minutes for the DNS records to propagate. Once it does, you can run the following command to complete the certificate request process.
|
||||
|
||||
```bash
|
||||
# Complete the certificate request now that we have validated our domain
|
||||
$HOME/.acme.sh/acme.sh \
|
||||
--renew \
|
||||
--ecc \
|
||||
-k ec-256 \
|
||||
-d '*.corp.example.com' \
|
||||
--dns \
|
||||
--yes-I-know-dns-manual-mode-enough-go-ahead-please
|
||||
|
||||
Renew: '*.corp.example.com'
|
||||
Single domain='*.corp.example.com'
|
||||
Getting domain auth token for each domain
|
||||
Verifying: *.corp.example.com
|
||||
Success
|
||||
Verify finished, start to sign.
|
||||
Cert success.
|
||||
-----BEGIN CERTIFICATE-----
|
||||
.... snip...
|
||||
-----END CERTIFICATE-----
|
||||
Your cert is in $HOME/.acme.sh/*.corp.example.com_ecc/*.corp.example.com.cer
|
||||
Your cert key is in $HOME/.acme.sh/*.corp.example.com_ecc/*.corp.example.com.key
|
||||
The intermediate CA cert is in $HOME/.acme.sh/*.corp.example.com_ecc/ca.cer
|
||||
And the full chain certs is there: $HOME/.acme.sh/*.corp.example.com_ecc/fullchain.cer
|
||||
```
|
||||
|
||||
Here's how the above certificates signed by LetsEncrypt correspond to their respective Pomerium configuration settings:
|
||||
|
||||
Pomerium Config | Certificate file
|
||||
------------------------------ | --------------------------------------------------------------
|
||||
[CERTIFICATE] | `$HOME/.acme.sh/*.corp.example.com_ecc/fullchain.cer`
|
||||
[CERTIFICATE_KEY][certificate] | `$HOME/.acme.sh/*.corp.example.com_ecc/*.corp.example.com.key`
|
||||
| Pomerium Config | Certificate file |
|
||||
| --------------------------- | -------------------------------------------------------------- |
|
||||
| [CERTIFICATE] | `$HOME/.acme.sh/*.corp.example.com_ecc/fullchain.cer` |
|
||||
| [CERTIFICATE_KEY] | `$HOME/.acme.sh/*.corp.example.com_ecc/*.corp.example.com.key` |
|
||||
| [CERTIFICATE_AUTHORITY] | `$HOME/.acme.sh/*.corp.example.com_ecc/ca.cer` |
|
||||
| [OVERRIDE_CERTIFICATE_NAME] | `*.corp.example.com` |
|
||||
|
||||
Your end users will see a valid certificate for all domains delegated by Pomerium.
|
||||
|
||||
|
|
@ -85,12 +114,6 @@ Your end users will see a valid certificate for all domains delegated by Pomeriu
|
|||
|
||||
|
||||
|
||||
::: warning
|
||||
|
||||
LetsEncrypt certificates must be renewed [every 90 days](https://letsencrypt.org/2015/11/09/why-90-days.html).
|
||||
|
||||
:::
|
||||
|
||||
## Resources
|
||||
|
||||
Certificates, TLS, and Public Key Cryptography is a vast subject we cannot adequately cover here so if you are new to or just need a brush up, the following resources may be helpful:
|
||||
|
|
@ -100,11 +123,9 @@ Certificates, TLS, and Public Key Cryptography is a vast subject we cannot adequ
|
|||
- [Use TLS](https://smallstep.com/blog/use-tls.html) covers why TLS should be used everywhere; not just for securing typical internet traffic but for securing service communication in both "trusted" and adversarial situations.
|
||||
- [Everything you should know about certificates and PKI but are too afraid to ask](https://smallstep.com/blog/everything-pki.html)
|
||||
|
||||
[autocert]: ../../configuration/readme.md#autocert
|
||||
[autocert directory]: ../../configuration/readme.md#autocert-directory
|
||||
[certificate]: ../../configuration/readme.md#certificates
|
||||
[certificate]: ../../configuration/readme.md#certificate
|
||||
[certificate_authority]: ../../configuration/readme.md#certificate-authority
|
||||
[certificate_key]: ../../configuration/readme.md#certificates
|
||||
[certificate_key]: ../../configuration/readme.md#certificate-key
|
||||
[override_certificate_name]: ../../configuration/readme.md#override-certificate-name
|
||||
[principles]: ../#why
|
||||
[zero-trust]: ../#why
|
||||
[principles]: ../docs/#why
|
||||
[zero-trust]: ../docs/#why
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
---
|
||||
title: Getting the user's identity
|
||||
description: This article describes how to to get a user's identity with Pomerium.
|
||||
description: >-
|
||||
This article describes how to to get a user's identity with Pomerium.
|
||||
---
|
||||
|
||||
# Getting the user's identity
|
||||
|
|
@ -18,19 +19,19 @@ To secure your app with signed headers, you'll need the following:
|
|||
|
||||
A JWT attesting to the authorization of a given request is added to the downstream HTTP request header `x-pomerium-jwt-assertion`. You should verify that the JWT contains at least the following claims:
|
||||
|
||||
[JWT] | description
|
||||
:------: | ------------------------------------------------------------------------------------------------------
|
||||
`exp` | Expiration time in seconds since the UNIX epoch. Allow 1 minute for skew.
|
||||
`iat` | Issued-at time in seconds since the UNIX epoch. Allow 1 minute for skew.
|
||||
`aud` | The client's final domain e.g. `httpbin.corp.example.com`.
|
||||
`iss` | Issuer must be the URL of your authentication domain e.g. `authenticate.corp.example`.
|
||||
`sub` | Subject is the user's id. Can be used instead of the `x-pomerium-authenticated-user-id` header.
|
||||
`email` | Email is the user's email. Can be used instead of the `x-pomerium-authenticated-user-email` header.
|
||||
`groups` | Groups is the user's groups. Can be used instead of the `x-pomerium-authenticated-user-groups` header.
|
||||
| [JWT] | description |
|
||||
| :------: | ------------------------------------------------------------------------------------------------------ |
|
||||
| `exp` | Expiration time in seconds since the UNIX epoch. Allow 1 minute for skew. |
|
||||
| `iat` | Issued-at time in seconds since the UNIX epoch. Allow 1 minute for skew. |
|
||||
| `aud` | The client's final domain e.g. `httpbin.corp.example.com`. |
|
||||
| `iss` | Issuer must be the URL of your authentication domain e.g. `authenticate.corp.example`. |
|
||||
| `sub` | Subject is the user's id. Can be used instead of the `x-pomerium-authenticated-user-id` header. |
|
||||
| `email` | Email is the user's email. Can be used instead of the `x-pomerium-authenticated-user-email` header. |
|
||||
| `groups` | Groups is the user's groups. Can be used instead of the `x-pomerium-authenticated-user-groups` header. |
|
||||
|
||||
### Manual verification
|
||||
|
||||
Though you will very likely be verifying signed-headers programmatically in your application's middleware, and using a third-party JWT library, if you are new to JWT it may be helpful to show what manual verification looks like.
|
||||
Though you will very likely be verifying signed-headers programmatically in your application's middleware, and using a third-party JWT library, if you are new to JWT it may be helpful to show what manual verification looks like. The following guide assumes you are using the provided [docker-compose.yml] as a base and [httpbin]. Httpbin gives us a convenient way of inspecting client headers.
|
||||
|
||||
1. Provide pomerium with a base64 encoded Elliptic Curve ([NIST P-256] aka [secp256r1] aka prime256v1) Private Key. In production, you'd likely want to get these from your KMS.
|
||||
|
||||
|
|
@ -48,17 +49,17 @@ Copy the base64 encoded value of your private key to `pomerium-proxy`'s environm
|
|||
SIGNING_KEY=ZxqyyIPPX0oWrrOwsxXgl0hHnTx3mBVhQ2kvW1YB4MM=
|
||||
```
|
||||
|
||||
1. Reload `pomerium-proxy`. Navigate to httpbin (by default, `https://httpbin.corp.${YOUR-DOMAIN}.com`), and login as usual. Click **request inspection**. Select `/headers'. Click **try it out** and then **execute**. You should see something like the following.
|
||||
2. Reload `pomerium-proxy`. Navigate to httpbin (by default, `https://httpbin.corp.${YOUR-DOMAIN}.com`), and login as usual. Click **request inspection**. Select `/headers'. Click **try it out** and then **execute**. You should see something like the following.
|
||||
|
||||
|
||||
|
||||
1. `X-Pomerium-Jwt-Assertion` is the signature value. It's less scary than it looks and basically just a compressed, json blob as described above. Navigate to [jwt.io] which provides a helpful GUI to manually verify JWT values.
|
||||
3. `X-Pomerium-Jwt-Assertion` is the signature value. It's less scary than it looks and basically just a compressed, json blob as described above. Navigate to [jwt.io] which provides a helpful GUI to manually verify JWT values.
|
||||
|
||||
2. Paste the value of `X-Pomerium-Jwt-Assertion` header token into the `Encoded` form. You should notice that the decoded values look much more familiar.
|
||||
4. Paste the value of `X-Pomerium-Jwt-Assertion` header token into the `Encoded` form. You should notice that the decoded values look much more familiar.
|
||||
|
||||
|
||||
|
||||
1. Finally, we want to cryptographically verify the validity of the token. To do this, we will need the signer's public key. You can simply copy and past the output of `cat ec_public.pem`.
|
||||
5. Finally, we want to cryptographically verify the validity of the token. To do this, we will need the signer's public key. You can simply copy and past the output of `cat ec_public.pem`.
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,24 +0,0 @@
|
|||
#!/bin/bash
|
||||
# acme.sh : https://github.com/Neilpang/acme.sh
|
||||
# curl https://get.acme.sh | sh
|
||||
# NOTA BENE:
|
||||
# if you use a DNS service that supports API access, you may be able to automate
|
||||
# this process. See https://github.com/Neilpang/acme.sh/wiki/dnsapi
|
||||
|
||||
echo "=> first generate a certificate signing request!"
|
||||
$HOME/.acme.sh/acme.sh \
|
||||
--issue \
|
||||
-k ec-256 \
|
||||
-d '*.corp.example.com' \
|
||||
--dns \
|
||||
--yes-I-know-dns-manual-mode-enough-go-ahead-please
|
||||
|
||||
read -p "press anykey once you've updated your TXT entries"
|
||||
|
||||
$HOME/.acme.sh/acme.sh \
|
||||
--renew \
|
||||
--ecc \
|
||||
-k ec-256 \
|
||||
-d '*.corp.example.com' \
|
||||
--dns \
|
||||
--yes-I-know-dns-manual-mode-enough-go-ahead-please
|
||||
|
|
@ -5,7 +5,7 @@ description: >-
|
|||
for Pomerium. Please read it carefully.
|
||||
---
|
||||
|
||||
# Since 0.7.0
|
||||
# Since 0.8.0
|
||||
|
||||
## Breaking
|
||||
|
||||
|
|
@ -17,7 +17,6 @@ Although it's unlikely anyone ever used it, prior to 0.8.0 the policy configurat
|
|||
policy:
|
||||
- from: "https://example.com/some/path"
|
||||
```
|
||||
|
||||
The proxy and authorization server would simply ignore the path and route/authorize based on the host name.
|
||||
|
||||
With the introduction of `prefix`, `path` and `regex` fields to the policy route configuration, we decided not to support using a path in the `from` url, since the behavior was somewhat ambiguous and better handled by the explicit fields.
|
||||
|
|
|
|||
|
|
@ -1,40 +0,0 @@
|
|||
# Backend Engineer
|
||||
|
||||
Job Posted: May 12, 2020 9:59 AM Languages: Go Location: Remote US/CA
|
||||
|
||||
# Backend Engineer
|
||||
|
||||
Hi there! We're looking for a Backend Software Engineer to join the team!
|
||||
|
||||
## Responsibilities:
|
||||
|
||||
- Write robust, maintainable code
|
||||
- Work with product and design to iterate on customer needs
|
||||
- Review code and participate in group discussions
|
||||
|
||||
## Qualifications:
|
||||
|
||||
- 3+ years experience building web applications at scale
|
||||
- Go (Golang)
|
||||
- Experience with relational databases
|
||||
- Knowledge of standard methodologies: monitoring, alerting, metrics
|
||||
- Strong written communication and collaboration skills
|
||||
- Experience with AWS, GCP, or Azure environments
|
||||
|
||||
## Preferred Qualifications:
|
||||
|
||||
- Remote work experience
|
||||
- Experience with OAuth2, OIDC, SAML, and other IAM technologies
|
||||
- Experience building gRPC and REST based services
|
||||
- Familiarity with Kubernetes, Helm, and other Cloud Native applications
|
||||
|
||||
## About Pomerium:
|
||||
|
||||
Pomerium helps companies manage and secure internal access. We
|
||||
|
||||
- are a fast growing, well funded, venture backed startup.
|
||||
- are a fully remote team. While prior experience working remotely isn't required, we are looking for team members who perform well given a high level of independence and autonomy.
|
||||
- offer competitive salaries
|
||||
- are committed to building a team that represents a variety of backgrounds, perspectives, and skills. We believe the more inclusive we are, the better our company will be.
|
||||
|
||||
Check out our [github](https://github.com/pomerium/pomerium) and [site](http://www.pomerium.com/) to learn more about us!
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
# Frontend Engineer
|
||||
|
||||
Job Posted: May 12, 2020 10:04 AM Languages: Javascript, React Location: Remote US/CA
|
||||
|
||||
Hi there! We're looking for a Frontend Software Engineer to join the team.
|
||||
|
||||
## Responsibilities:
|
||||
|
||||
- Write robust, maintainable code
|
||||
- Work with product and design to iterate on customer needs
|
||||
- Review code and participate in group discussions
|
||||
|
||||
## Qualifications:
|
||||
|
||||
- 3+ years experience building web applications at scale
|
||||
- 3+ years of javascript, css, typescript, or other
|
||||
- React, React Native, or similar framework experience
|
||||
- Experience with relational databases
|
||||
- Knowledge of standard methodologies: monitoring, alerting, metrics
|
||||
- Strong written communication and collaboration skills
|
||||
- Experience with AWS, GCP, or Azure environments
|
||||
|
||||
## Preferred Qualifications:
|
||||
|
||||
- Remote work experience
|
||||
- Experience with OAuth2, OIDC, SAML, and other IAM technologies
|
||||
- Familiarity with Kubernetes, Helm, and other Cloud Native applications
|
||||
|
||||
## About Pomerium:
|
||||
|
||||
Pomerium helps companies manage and secure internal access. We
|
||||
|
||||
- are a fast growing, well funded, venture backed startup.
|
||||
- are a fully remote team. While prior experience working remotely isn't required, we are looking for team members who perform well given a high level of independence and autonomy.
|
||||
- offer competitive salaries
|
||||
- are committed to building a team that represents a variety of backgrounds, perspectives, and skills. We believe the more inclusive we are, the better our company will be
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
# Careers at Pomerium
|
||||
|
||||
## Help us build the future secure application access
|
||||
|
||||
Pomerium builds identity and access management infrastructure for the internet. We're helping small startups and the world's biggest companies improve their security posture, facilitate distributed remote work, and scale their efforts globally. And we'd like your help.
|
||||
|
||||
Interested in joining our all-remote team? Check out some of our open positions.
|
||||
|
||||
# Open Positions
|
||||
|
||||
- [Frontend Engineer](./Frontend-Engineer.md)
|
||||
- [Backend Engineer](./Backend-Engineer.md)
|
||||
|
|
@ -218,7 +218,7 @@ Pomerium is an identity-aware access proxy that can used to serve as an identity
|
|||
|
||||
### Configure
|
||||
|
||||
Before installing, we will configure Pomerium's configuration settings in `values.yaml`. Other than the typical configuration settings covered in the quick-start guides, we will add a few settings that will make working with Kubernetes Dashboard easier.
|
||||
Before installing, we will configure Pomerium's configuration settings in `config.yaml`. Other than the typical configuration settings covered in the quick-start guides, we will add a few settings that will make working with Kubernetes Dashboard easier.
|
||||
|
||||
We can retrieve the token to add to our proxied policy's authorization header as follows.
|
||||
|
||||
|
|
@ -245,43 +245,33 @@ token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.......
|
|||
The above token then needs to be assigned to our route configuration and policy.
|
||||
|
||||
```yaml
|
||||
# values.yaml
|
||||
authenticate:
|
||||
idp:
|
||||
provider: "google"
|
||||
clientID: YOUR_CLIENT_ID
|
||||
clientSecret: YOUR_SECRET
|
||||
# config.yaml
|
||||
forward_auth_url: https://forwardauth.domain.example
|
||||
|
||||
forwardAuth:
|
||||
enabled: true
|
||||
policy:
|
||||
# this route is directly proxied by pomerium & injects the authorization header
|
||||
- from: https://dashboard-proxied.domain.example
|
||||
to: https://helm-dashboard-kubernetes-dashboard
|
||||
allowed_users:
|
||||
- user@domain.example
|
||||
tls_skip_verify: true # dashboard uses self-signed certificates in its default configuration
|
||||
set_request_headers:
|
||||
Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.....
|
||||
|
||||
config:
|
||||
sharedSecret: YOUR_SHARED_SECRET
|
||||
cookieSecret: YOUR_COOKIE_SECRET
|
||||
rootDomain: domain.example
|
||||
|
||||
policy:
|
||||
# this route is directly proxied by pomerium & injects the authorization header
|
||||
- from: https://dashboard-proxied.domain.example
|
||||
to: https://helm-dashboard-kubernetes-dashboard
|
||||
allowed_users:
|
||||
- user@domain.example
|
||||
tls_skip_verify: true # dashboard uses self-signed certificates in its default configuration
|
||||
set_request_headers:
|
||||
Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.....
|
||||
|
||||
# this route is indirectly checked for access using forward-auth
|
||||
- from: https://dashboard-forwardauth.domain.example
|
||||
to: https://helm-dashboard-kubernetes-dashboard
|
||||
allowed_users:
|
||||
- user@domain.example
|
||||
ingress:
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "nginx"
|
||||
cert-manager.io/issuer: "letsencrypt-prod" # see `le.issuer.yaml`
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
secretName: pomerium-ingress-tls
|
||||
# this route is indirectly checked for access using forward-auth
|
||||
- from: https://dashboard-forwardauth.domain.example
|
||||
to: https://helm-dashboard-kubernetes-dashboard
|
||||
allowed_users:
|
||||
- user@domain.example
|
||||
```
|
||||
|
||||
We then add our configuration to Kubernetes as a [ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/).
|
||||
|
||||
```bash
|
||||
# add our pomerium policy to kubernetes as a configmap
|
||||
$ kubectl create configmap config --from-file="config.yaml"="config.yaml"
|
||||
```
|
||||
|
||||
### Install
|
||||
|
||||
Finally, we get to install Pomerium! 🎉 Once again, we will use Helm to deploy Pomerium.
|
||||
|
|
@ -289,14 +279,24 @@ Finally, we get to install Pomerium! 🎉 Once again, we will use Helm to deploy
|
|||
```bash
|
||||
helm install \
|
||||
"helm-pomerium" \
|
||||
pomerium/pomerium \
|
||||
--values values.yaml
|
||||
stable/pomerium \
|
||||
--set config.rootDomain="domain.example" \
|
||||
--set config.existingConfig="config" \
|
||||
--set authenticate.idp.provider="google" \
|
||||
--set authenticate.idp.clientID="YOUR_CLIENT_ID" \
|
||||
--set authenticate.idp.clientSecret="YOUR_SECRET"
|
||||
```
|
||||
|
||||
## Putting it all together
|
||||
|
||||
Now we just need to tell external traffic how to route everything by deploying the following ingresses.
|
||||
|
||||
```sh
|
||||
$kubectl apply -f docs/recipes/yml/pomerium.ingress.yaml
|
||||
```
|
||||
|
||||
<<< @/docs/recipes/yml/pomerium.ingress.yaml
|
||||
|
||||
```sh
|
||||
$kubectl apply -f docs/recipes/yml/dashboard-forwardauth.ingress.yaml
|
||||
```
|
||||
|
|
|
|||
33
docs/recipes/yml/pomerium.ingress.yaml
Normal file
33
docs/recipes/yml/pomerium.ingress.yaml
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
# pomerium.ingress.yaml
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: pomerium-authenticate
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "nginx"
|
||||
cert-manager.io/issuer: "letsencrypt-prod" # see `le.issuer.yaml`
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- authenticate.domain.example
|
||||
secretName: pomerium-authenticate-external-tls
|
||||
- hosts:
|
||||
- forwardauth.domain.example
|
||||
secretName: pomerium-forwardauth-external-tls
|
||||
|
||||
rules:
|
||||
- host: authenticate.domain.example
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
backend:
|
||||
serviceName: helm-pomerium-authenticate
|
||||
servicePort: https
|
||||
- host: forwardauth.domain.example
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
backend:
|
||||
serviceName: helm-pomerium-proxy
|
||||
servicePort: https
|
||||
Loading…
Add table
Add a link
Reference in a new issue