Previously, we worked with advanced OpenShift resources, such as ImageStreams, ConfigMaps, and templates. Those resources allow you to simplify OpenShift resource management and the application delivery process.
In this chapter, we will introduce you to the realm of security in OpenShift. Any business' success depends on many factors, one of which is the company's ability to implement different security strategies for different users, departments, and applications. OpenShift is an enterprise-ready application platform that supports multiple security features, making it possible to integrate it into any corporate security landscape.
For this section, we will have to make use of Vagrant to demonstrate the difference between these methods, as we will require two VMs: one for single-node OpenShift cluster, and the other for the FreeIPA server. Use the following Vagrantfile to spin up an environment:
$ cat Vagrantfile
$lab_idm = <<SCRIPT
cat <<EOF >> /etc/hosts
172.24.0.11 openshift.example.com openshift
172.24.0.12 idm.example.com idm
EOF
sed -i '/^127.0.0.1.*idm.*$/d' /etc/hosts
yum -y update
yum -y install ipa-server
systemctl restart dbus
ipa-server-install -r IDM.EXAMPLE.COM -n idm.example.com -p idmsecret -a idmsecret --unattended
echo idmsecret | kinit admin
echo supersecret | ipa user-add alice --first Alice --last Springs --password
SCRIPT
$lab_openshift = <<SCRIPT
cat <<EOF >> /etc/hosts
172.24.0.12 idm.example.com idm
EOF
yum -y update
yum install -y epel-release git docker
yum install -y ansible
systemctl start docker
systemctl enable docker
git clone -b release-3.9 https://github.com/openshift/openshift-ansible /root/openshift-ansible
ssh-keygen -f /root/.ssh/id_rsa -N ''
cp /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys
ssh-keyscan 172.24.0.11 >> .ssh/known_hosts
cp .ssh/known_hosts /root/.ssh/known_hosts
ssh-copy-id -i /root/.ssh/id_rsa [email protected]
reboot
SCRIPT
Vagrant.configure(2) do |config|
config.vm.define "openshift" do |conf|
conf.vm.box = "centos/7"
conf.vm.hostname = 'openshift.example.com'
conf.vm.network "private_network", ip: "172.24.0.11"
conf.vm.provider "virtualbox" do |v|
v.memory = 4096
v.cpus = 2
end
conf.vm.provision "shell", inline: $lab_openshift
end
config.vm.define "idm" do |conf|
conf.vm.box = "centos/7"
conf.vm.hostname = 'idm.example.com'
conf.vm.network "private_network", ip: "172.24.0.12"
conf.vm.provider "virtualbox" do |v|
v.memory = 2048
v.cpus = 1
end
conf.vm.provision "shell", inline: $lab_idm
end
end
The preceding file may seem complicated compared to the one from the Chapter 6, OpenShift Installation, but all it does is automates the steps, performed in that chapter manually, because the purpose of this chapter is to discuss security while building on the knowledge you gained up to this point. Also, it sets up FreeIPA server on another VM and creates a user that will be used later in this chapter.
The command systemctl restart dbus is necessary to prevent installation of FreeIPA from failing during restart of certification manager.
We used the same simple password for both the directory manager and IPA admin for simplicity, but in a production setup, make sure that you use complex and unique passwords!
Run vagrant up and wait until it finishes all the work. It may take up to 30 mins depending on your internet connectivity and compute resources:
$ vagrant up
Bringing machine 'openshift' up with 'virtualbox' provider...
Bringing machine 'idm' up with 'virtualbox' provider...
...
<output omitted>
...
Once it's done, open SSH session into the openshift VM and become root:
$ vagrant ssh openshift
[vagrant@openshift ~]$ sudo -i
[root@openshift ~]#
Do not be alarmed by some of the output in red produced by the command above. Many CentOS commands, like yum, send warning, errors, and even other information alike to the standard error, which all gets interpreted as errors by Vagrant.
Then use the following Ansible inventory file to install OpenShift on the openshift VM. If you went through the Chapter 6, OpenShift Installation, you will notice that this is the same file with added openshift_master_identity_providers variable:
# cat /etc/ansible/hosts
...
<output omitted>
...
[masters]
172.24.0.11
[nodes]
172.24.0.11 openshift_node_labels="{'region': 'infra', 'zone': 'default'}" openshift_schedulable=true
[etcd]
172.24.0.11
[OSEv3:vars]
openshift_deployment_type=origin
openshift_disable_check=memory_availability,disk_availability
openshift_ip=172.24.0.11
ansible_service_broker_install=false
openshift_master_cluster_hostname=172.24.0.11
openshift_master_cluster_public_hostname=172.24.0.11
openshift_hostname=172.24.0.11
openshift_public_hostname=172.24.0.11
openshift_master_identity_providers=[{'name': 'LDAP', 'challenge': 'true', 'login': 'true', 'kind': 'LDAPPasswordIdentityProvider', 'mappingMethod': 'claim', 'attributes': {'id': ['dn'], 'email': ['mail'], 'name': ['cn'], 'preferredUsername': ['uid']}, 'insecure': 'true', 'bindDN': 'uid=admin,cn=users,cn=accounts,dc=idm,dc=example,dc=com', 'bindPassword': 'idmsecret', 'url': 'ldap://idm.example.com/cn=users,cn=accounts,dc=idm,dc=example,dc=com?uid'}, {'name': 'PASSWORD_FILE', 'challenge': 'true', 'login': 'true', 'kind': 'HTPasswdPasswordIdentityProvider', 'mappingMethod': 'claim', 'filename': '/etc/origin/master/.users'}]
[OSEv3:children]
masters
nodes
etcd
Even though openshift_schedulab...
