mirror of
https://github.com/pomerium/pomerium.git
synced 2025-06-14 16:52:58 +02:00
envoy: Initial changes
This commit is contained in:
Travis Groth
parent
8f78497e99
commit
99e788a9b4
107 changed files with 2542 additions and 3322 deletions
|
|
@ -13,7 +13,7 @@ The following quick-start guide covers how to configure and run Pomerium using t
|
|||
## Prerequisites
|
||||
|
||||
- A configured [identity provider]
|
||||
- [TLS certificates]
|
||||
- A [wild-card TLS certificate]
|
||||
|
||||
## Download
|
||||
|
||||
|
|
@ -52,6 +52,6 @@ Browse to `external-httpbin.your.domain.example`. Connections between you and [h
|
|||
[download]: https://github.com/pomerium/pomerium/releases
|
||||
[environmental configuration variables]: https://12factor.net/config
|
||||
[httpbin]: https://httpbin.org/
|
||||
[identity provider]: ../identity-providers/
|
||||
[identity provider]: ../docs/identity-providers/
|
||||
[make]: https://en.wikipedia.org/wiki/Make_(software)
|
||||
[tls certificates]: ../reference/certificates.md
|
||||
[wild-card tls certificate]: ../reference/certificates.md
|
||||
|
|
|
|||
|
|
@ -73,6 +73,6 @@ Browse to `httpbin.localhost.pomerium.io`. Connections between you and [httpbin]
|
|||
|
||||
[configuration variables]: ../../configuration/readme.md
|
||||
[httpbin]: https://httpbin.org/
|
||||
[identity provider]: ../identity-providers/
|
||||
[identity provider]: ../docs/identity-providers/
|
||||
[make]: https://en.wikipedia.org/wiki/Make_(software)
|
||||
[tls certificates]: ../reference/certificates.md
|
||||
[wild-card tls certificate]: ../reference/certificates.md
|
||||
|
|
|
|||
|
|
@ -17,19 +17,17 @@ This quick-start will show you how to deploy Pomerium with [Helm](https://helm.s
|
|||
- Install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
|
||||
- Install the [Google Cloud SDK](https://cloud.google.com/kubernetes-engine/docs/quickstart)
|
||||
- Install [helm](https://helm.sh/docs/using_helm/)
|
||||
- [TLS certificates]
|
||||
- A [wild-card TLS certificate]
|
||||
|
||||
Though there are [many ways](https://unofficial-kubernetes.readthedocs.io/en/latest/setup/pick-right-solution/) to work with Kubernetes, for the purpose of this guide, we will be using Google's [Kubernetes Engine](https://cloud.google.com/kubernetes-engine/). That said, most of the following steps should be very similar using any other provider.
|
||||
Though there are [many ways](https://kubernetes.io/docs/setup/pick-right-solution/) to work with Kubernetes, for the purpose of this guide, we will be using Google's [Kubernetes Engine](https://cloud.google.com/kubernetes-engine/). That said, most of the following steps should be very similar using any other provider.
|
||||
|
||||
In addition to sharing many of the same features as the Kubernetes quickstart guide, the default helm deployment script also includes a bootstrapped certificate authority enabling mutually authenticated and encrypted communication between services that does not depend on the external LetsEncrypt certificates. Having the external domain certificate de-coupled makes it easier to renew external certificates.
|
||||
|
||||
## Configure
|
||||
|
||||
Download and modify the following helm_gke.sh script and values file to match your [identity provider] and [TLS certificates] settings.
|
||||
Download and modify the following [helm_gke.sh script][./scripts/helm_gke.sh] to match your [identity provider] and [wild-card tls certificate] settings.
|
||||
|
||||
<<<@/docs/configuration/examples/helm/helm_gke.sh
|
||||
|
||||
<<<@/docs/configuration/examples/kubernetes/values.yaml
|
||||
<<<@/scripts/helm_gke.sh
|
||||
|
||||
## Run
|
||||
|
||||
|
|
@ -58,4 +56,4 @@ You can also navigate to the special pomerium endpoint `httpbin.your.domain.exam
|
|||
[identity provider]: ../identity-providers/readme.md
|
||||
[letsencrypt]: https://letsencrypt.org/
|
||||
[script]: https://github.com/pomerium/pomerium/blob/master/scripts/generate_wildcard_cert.sh
|
||||
[tls certificates]: ../reference/certificates.md
|
||||
[wild-card tls certificate]: ../reference/certificates.md
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ This quickstart will cover how to deploy Pomerium with Kubernetes.
|
|||
## Prerequisites
|
||||
|
||||
- A configured [identity provider]
|
||||
- [TLS certificates]
|
||||
- A [wild-card TLS certificate]
|
||||
- A [Google Cloud Account](https://console.cloud.google.com/)
|
||||
- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
|
||||
- [Google Cloud SDK](https://cloud.google.com/kubernetes-engine/docs/quickstart)
|
||||
|
|
@ -29,7 +29,7 @@ cd $HOME/pomerium/docs/configuration/examples/kubernetes
|
|||
|
||||
## Configure
|
||||
|
||||
Edit [./kubernetes_gke.sh] making sure to change the identity provider secret value to match your [identity provider] and [TLS certificates] settings.
|
||||
Edit [./kubernetes_gke.sh] making sure to change the identity provider secret value to match your [identity provider] and [wild-card tls certificate] settings.
|
||||
|
||||
<<<@/docs/configuration/examples/kubernetes/kubernetes_gke.sh
|
||||
|
||||
|
|
@ -63,9 +63,9 @@ You can also navigate to the special pomerium endpoint `httpbin.your.domain.exam
|
|||
|
||||
|
||||
|
||||
[./kubernetes_gke.sh]: ../../configuration/examples.md#google-kubernetes-engine
|
||||
[example kubernetes files]: ../../configuration/examples.md#google-kubernetes-engine
|
||||
[./kubernetes_gke.sh]: ../reference/examples#google-kubernetes-engine
|
||||
[example kubernetes files]: ../reference/examples#google-kubernetes-engine
|
||||
[identity provider]: ../identity-providers/readme.md
|
||||
[letsencrypt]: https://letsencrypt.org/
|
||||
[script]: https://github.com/pomerium/pomerium/blob/master/scripts/generate_wildcard_cert.sh
|
||||
[tls certificates]: ../reference/certificates.md
|
||||
[wild-card tls certificate]: ../reference/certificates.md
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ In the following quick-start, we'll create a minimal but complete environment fo
|
|||
|
||||
- A configured [identity provider]
|
||||
- [Docker] and [docker-compose]
|
||||
- [TLS certificates]
|
||||
- A [wild-card TLS certificate]
|
||||
|
||||
## Configure
|
||||
|
||||
|
|
@ -26,26 +26,12 @@ Create a [configuration file] (e.g `config.yaml`) for defining Pomerium's config
|
|||
|
||||
Ensure the `docker-compose.yml` contains the correct path to your `config.yaml`.
|
||||
|
||||
### Autocert Docker-compose
|
||||
Ensure you have set up the requisite DNS and port forwarding in [TLS certificates]
|
||||
### Docker-compose
|
||||
|
||||
Download the following `docker-compose.yml` file and modify it to:
|
||||
|
||||
- generate new secrets
|
||||
- mount your [TLS certificates]
|
||||
- mount your `config.yaml` [configuration file]
|
||||
- Set `autocert_use_staging` to `false` once you have finished testing
|
||||
|
||||
<<< @/docs/configuration/examples/docker/autocert.docker-compose.yml
|
||||
|
||||
Please note that you should use a persistent volume to store certificate data, or you may exhaust your domain quota on Let's Encrypt.
|
||||
|
||||
### Wildcard Docker-compose
|
||||
|
||||
Download the following `docker-compose.yml` file and modify it to:
|
||||
|
||||
- generate new secrets
|
||||
- mount your [TLS certificates]
|
||||
- mount your [wild-card TLS certificate]
|
||||
- mount your `config.yaml` [configuration file]
|
||||
|
||||
<<< @/docs/configuration/examples/docker/basic.docker-compose.yml
|
||||
|
|
@ -72,4 +58,4 @@ You can also navigate to the special pomerium endpoint `httpbin.corp.yourdomain.
|
|||
[docker-compose]: https://docs.docker.com/compose/install/
|
||||
[httpbin]: https://httpbin.org/
|
||||
[identity provider]: ../identity-providers/readme.md
|
||||
[tls certificates]: ../reference/certificates.md
|
||||
[wild-card tls certificate]: ../reference/certificates.md
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ Pomerium is lightweight, can easily handle hundreds of concurrent requests, and
|
|||
- A [docker-capable] synology product
|
||||
- A [Google Cloud Account](https://console.cloud.google.com/)
|
||||
- A configured Google OAuth2 [identity provider]
|
||||
- [TLS certificates][certificate documentation]
|
||||
- A [wild-card TLS certificate][certificate documentation]
|
||||
|
||||
Though any supported [identity provider] would work, this guide uses google.
|
||||
|
||||
|
|
@ -46,17 +46,17 @@ Click **Create**.
|
|||
|
||||
Set the following **Reverse Proxy Rules**.
|
||||
|
||||
Field | Description
|
||||
-------------------- | -----------
|
||||
Description | pomerium
|
||||
Source Protocol | HTTPS
|
||||
Source Hostname | *
|
||||
Destination Port | 8443
|
||||
HTTP/2 | Enabled
|
||||
HSTS | Enabled
|
||||
Destination Protocol | HTTP
|
||||
Destination Hostname | localhost
|
||||
Destination Port | 32443
|
||||
| Field | Description |
|
||||
| -------------------- | ----------- |
|
||||
| Description | pomerium |
|
||||
| Source Protocol | HTTPS |
|
||||
| Source Hostname | \* |
|
||||
| Destination Port | 8443 |
|
||||
| HTTP/2 | Enabled |
|
||||
| HSTS | Enabled |
|
||||
| Destination Protocol | HTTP |
|
||||
| Destination Hostname | localhost |
|
||||
| Destination Port | 32443 |
|
||||
|
||||
|
||||
|
||||
|
|
@ -76,9 +76,9 @@ Once the certificate is showing on the list of certificates screen we need to te
|
|||
|
||||
**Click configure**
|
||||
|
||||
Services | Certificate
|
||||
-------- | -------------------
|
||||
*:8443 | `*.int.nas.example`
|
||||
| Services | Certificate |
|
||||
| -------- | ------------------- |
|
||||
| \*:8443 | `*.int.nas.example` |
|
||||
|
||||
|
||||
|
||||
|
|
@ -170,15 +170,15 @@ These are the minimum set of configuration settings to get Pomerium running in t
|
|||
|
||||
Go to **Environment** tab.
|
||||
|
||||
Field | Value
|
||||
------------------------ | ---------------------------------------------------------------
|
||||
POLICY | output of `base64 -i policy.yaml`
|
||||
INSECURE_SERVER | `TRUE`, internal routing within docker will not be encrypted.
|
||||
IDP_CLIENT_SECRET | Values from setting up your [identity provider]
|
||||
IDP_CLIENT_ID | Values from setting up your [identity provider]
|
||||
IDP_PROVIDER | Values from setting up your [identity provider] (e.g. `google`)
|
||||
COOKIE_SECRET | output of `head -c32 /dev/urandom | base64`
|
||||
AUTHENTICATE_SERVICE_URL | `https://authenticate.int.nas.example`
|
||||
| Field | Value |
|
||||
| ------------------------ | --------------------------------------------------------------- |
|
||||
| POLICY | output of `base64 -i policy.yaml` |
|
||||
| INSECURE_SERVER | `TRUE`, internal routing within docker will not be encrypted. |
|
||||
| IDP_CLIENT_SECRET | Values from setting up your [identity provider] |
|
||||
| IDP_CLIENT_ID | Values from setting up your [identity provider] |
|
||||
| IDP_PROVIDER | Values from setting up your [identity provider] (e.g. `google`) |
|
||||
| COOKIE_SECRET | output of `head -c32 /dev/urandom | base64` |
|
||||
| AUTHENTICATE_SERVICE_URL | `https://authenticate.int.nas.example` |
|
||||
|
||||
For a detailed explanation, and additional options, please refer to the [configuration variable docs]. Also note, though not covered in this guide, settings can be made via a mounted configuration file.
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue