Skip to content

Commit f52e957

Browse files
batleforcbatleforc
committed
feat: WIP on bringing OIDC to the talos cluster
1 parent 97c5522 commit f52e957

14 files changed

Lines changed: 138 additions & 29 deletions

‎.compose/authelia/configuration.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ log:
1010
level: 'debug'
1111

1212
totp:
13-
issuer: 'authelia.com'
13+
issuer: 'authelia.k8s.localhost'
1414

1515
identity_validation:
1616
reset_password:
@@ -78,7 +78,7 @@ identity_providers:
7878
jwks:
7979
- key_id: "kube_login"
8080
key: |
81-
{{ secret "/config/private.pem" | nindent 10 }}
81+
{{- secret "/config/private.pem" | nindent 10 }}
8282
8383
8484

‎.compose/compose.authelia.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
services:
22
authelia:
33
image: "authelia/authelia"
4+
networks:
5+
default:
6+
ipv4_address: 10.5.0.16
47
container_name: authelia
58
user: "${PUID}:${PGID}"
69
volumes:
@@ -22,3 +25,4 @@ services:
2225
TZ: "Europe/Paris"
2326
PUID: "${PUID}"
2427
PGID: "${PGID}"
28+
X_AUTHELIA_CONFIG_FILTERS: "template"

‎.compose/compose.otel.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,23 @@ services:
66
- ./tracing/otel-collector-config.yaml:/etc/otel-collector-config.yaml
77
ports:
88
- "4317:4317" # OTLP gRPC receiver
9+
networks:
10+
default:
11+
ipv4_address: 10.5.0.13
912
jaeger:
10-
image: jaegertracing/all-in-one:latest
13+
image: cr.jaegertracing.io/jaegertracing/jaeger:2.11.0
14+
networks:
15+
default:
16+
ipv4_address: 10.5.0.14
1117
ports:
1218
- "6831:6831/udp" # UDP port for Jaeger agent
1319
- "16686:16686" # Web UI
1420
- "14268:14268" # HTTP port for spans
1521
prometheus:
1622
image: prom/prometheus:latest
23+
networks:
24+
default:
25+
ipv4_address: 10.5.0.15
1726
volumes:
1827
- ./tracing/prometheus.yml:/etc/prometheus/prometheus.yml
1928
ports:

‎.compose/compose.redis.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,19 @@ services:
22
redis:
33
image: ghcr.io/dragonflydb/dragonfly
44
container_name: redis
5+
networks:
6+
default:
7+
ipv4_address: 10.5.0.11
58
environment:
69
REDIS_HOST_PASSWORD: "${REDIS_PASSWORD}"
710
DFLY_requirepass: "${REDIS_PASSWORD}"
811
ports:
912
- "6379:6379"
1013
dbgate:
1114
image: dbgate/dbgate
15+
networks:
16+
default:
17+
ipv4_address: 10.5.0.12
1218
restart: always
1319
environment:
1420
CONNECTIONS: redis

‎.compose/compose.traefik.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ services:
22
traefik:
33
image: "traefik"
44
container_name: "traefik"
5+
networks:
6+
default:
7+
ipv4_address: 10.5.0.10
58
volumes:
69
- "./traefik:/etc/traefik"
710
- "/var/run/docker.sock:/var/run/docker.sock"

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ dist
55
tmp
66
out-tsc
77
.tls
8+
.compose/traefik/certs
89

910
# dependencies
1011
node_modules

‎.talos/.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
patch_host.yaml
2+
patch_cert.yaml
3+
patch_cert.yaml.tmp
4+
patch_auth.yaml.tmp

.talos/patch_auth.yaml renamed to .talos/patch_auth.yaml.tpl

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,14 @@
1-
- op: add
2-
path: /cluster/apiServer/extraArgs
3-
value:
4-
authentication-config: /var/lib/apiserver/authentication.yaml
5-
- op: add
6-
path: /cluster/apiServer/extraVolumes
7-
value:
8-
- hostPath: /var/lib/apiserver
9-
mountPath: /var/lib/apiserver
10-
readonly: true
11-
- op: add
12-
path: /machine/files
13-
value:
1+
cluster:
2+
apiServer:
3+
extraArgs:
4+
authentication-config: /var/lib/apiserver/authentication.yaml
5+
extraVolumes:
6+
- hostPath: /var/lib/apiserver
7+
mountPath: /var/lib/apiserver
8+
readonly: true
9+
10+
machine:
11+
files:
1412
- content: |
1513
apiVersion: apiserver.config.k8s.io/v1beta1
1614
kind: AuthenticationConfiguration
@@ -20,6 +18,8 @@
2018
audiences:
2119
- 'kube_login'
2220
audienceMatchPolicy: MatchAny
21+
certificateAuthority: |
22+
CERTIFICATE
2323
claimValidationRules:
2424
- expression: "claims.email_verified == true"
2525
message: "email must be verified"
@@ -37,4 +37,4 @@
3737
message: "groups cannot used reserved system: prefix"
3838
permissions: 0o444
3939
path: /var/lib/apiserver/authentication.yaml
40-
op: create
40+
op: create

‎.talos/patch_host.yaml.tpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
machine:
2+
network:
3+
extraHostEntries:
4+
- ip: TRAEFIK_IP
5+
aliases:
6+
- authelia.k8s.localhost
7+
- traefik.k8s.localhost
8+
- k8s.localhost

‎.taskfile/talos.yaml‎

Lines changed: 67 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,67 @@
1-
version: '3'
1+
version: "3"
22

33
tasks:
44
up:
55
desc: "Start Talos cluster"
6+
vars:
7+
TRAEFIK_IP:
8+
sh: task talos:get-traefik-ip
9+
cmds:
10+
- cp .talos/patch_host.yaml.tpl .talos/patch_host.yaml && sed -i 's/TRAEFIK_IP/{{ .TRAEFIK_IP }}/g' .talos/patch_host.yaml
11+
- task talos:up:cert
12+
- talosctl cluster create --workers 1 --config-patch-control-plane @.talos/patch_auth.yaml --config-patch @.talos/patch_host.yaml
13+
- task talos:kubeconfig
14+
- task talos:crd
15+
- task talos:k -- apply -f ./deploy/exemple/min-local-talos.crd.yaml
16+
- task talos:create-kubeconfig-proxy
17+
- task talos:create-kubeconfig-oidc
18+
up:cert:
619
cmds:
7-
- talosctl cluster create --workers 1 --config-patch-control-plane @.talos/patch_auth.yaml
20+
- cp .talos/patch_auth.yaml.tpl .talos/patch_auth.yaml
21+
- |
22+
awk '/CERTIFICATE/ {
23+
while ((getline line < ".compose/traefik/certs/cert.pem") > 0) {
24+
print " " line
25+
}
26+
close(".compose/traefik/certs/cert.pem")
27+
next
28+
}
29+
{ print }' .talos/patch_auth.yaml > .talos/patch_auth.yaml.tmp
30+
- mv .talos/patch_auth.yaml.tmp .talos/patch_auth.yaml
831
down:
932
desc: "Destroy Talos cluster"
1033
cmds:
1134
- talosctl cluster destroy
1235
kubeconfig:
1336
desc: "Get kubeconfig for Talos cluster"
1437
cmds:
38+
- rm -f kubeconfig.local.yaml
1539
- talosctl kubeconfig 'kubeconfig.local.yaml' -n 10.5.0.2
1640
dashboard:
1741
desc: "Open Talos dashboard"
1842
cmds:
1943
- talosctl dashboard -n 10.5.0.2
2044
k:
2145
desc: "Shortcut for kubectl"
46+
silent: true
2247
env:
2348
KUBECONFIG: kubeconfig.local.yaml
2449
cmds:
2550
- kubectl {{ .CLI_ARGS }}
51+
k-proxy:
52+
desc: "Shortcut for kubectl using ProxyauthK8s"
53+
silent: true
54+
env:
55+
KUBECONFIG: kubeconfig.local-proxy.yaml
56+
cmds:
57+
- kubectl {{ .CLI_ARGS }}
58+
k-oidc:
59+
desc: "Shortcut for kubectl using OIDC"
60+
silent: true
61+
env:
62+
KUBECONFIG: kubeconfig.local-oidc.yaml
63+
cmds:
64+
- kubectl {{ .CLI_ARGS }}
2665
k9s:
2766
desc: "Shortcut for k9s"
2867
env:
@@ -36,12 +75,30 @@ tasks:
3675
cmds:
3776
- kubectl apply -f ./deploy/crds.yaml
3877
create-kubeconfig-oidc:
78+
desc: "Create kubeconfig to use with OIDC and ProxyauthK8s"
79+
silent: true
80+
vars:
81+
server_url: "https://localhost:5437/clusters/default/local"
82+
cmds:
83+
- cp kubeconfig-template.oidc.yaml kubeconfig.local-oidc.yaml
84+
- yq e -i '.clusters[0].cluster.server = "{{ .server_url }}"' kubeconfig.local-oidc.yaml
85+
create-kubeconfig-proxy:
86+
desc: "Create kubeconfig to use with ProxyauthK8s"
87+
silent: true
3988
vars:
40-
server_url:
41-
sh: cat kubeconfig.local.yaml | yq .clusters[0].cluster.server
42-
server_ca:
43-
sh: cat kubeconfig.local.yaml | yq .clusters[0].cluster."certificate-authority-data"
44-
cmds:
45-
- cp kubeconfig-template.oidc.yaml kubeconfig.local-oidc.yaml
46-
- yq e -i '.clusters[0].cluster.server = "{{ .server_url }}"' kubeconfig.local-oidc.yaml
47-
- yq e -i '.clusters[0].cluster."certificate-authority-data" = "{{ .server_ca }}"' kubeconfig.local-oidc.yaml
89+
server_url: "https://localhost:5437/clusters/default/local"
90+
token:
91+
sh: task talos:k -- create token default
92+
cmds:
93+
- cp kubeconfig.local.yaml kubeconfig.local-proxy.yaml
94+
- yq e -i '.clusters[0].cluster.server = "{{ .server_url }}"' kubeconfig.local-proxy.yaml
95+
- yq e -i 'del(.clusters[0].cluster."certificate-authority-data")' kubeconfig.local-proxy.yaml
96+
- yq e -i '.users[0].user.token = "{{ .token }}"' kubeconfig.local-proxy.yaml
97+
- yq e -i 'del(.users[0].user."client-certificate-data")' kubeconfig.local-proxy.yaml
98+
- yq e -i 'del(.users[0].user."client-key-data")' kubeconfig.local-proxy.yaml
99+
get-traefik-ip:
100+
desc: "Get Traefik Docker IP"
101+
silent: true
102+
cmds:
103+
- docker inspect traefik | jq -r '.[0].NetworkSettings.Networks["talos-default"].IPAddress'
104+
# https://docs.siderolabs.com/talos/v1.6/reference/configuration/v1alpha1/config#extrahostentries%5B%5D

0 commit comments

Comments
 (0)