This is an optional step.
This page lists the elaborated steps on how to configure an OPA policy agent in the target environment or enable the deployment firewall in the target clusters. To know in detail about OPA, refer OPA overview . Refer OPA Installation for the steps on how to install OPA.
Follow the steps given below to configure OPA in the target environment.
Generation of Ca Cert:
The first step involves generating the Ca Cert.
To generate the Ca Cert, use the command given below:
Copy openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -sha256 -key ca.key -days 100000 -out ca.crt -
subj "/CN=admission_ca"
Generate the TLS key and certificate as shown below:
Copy cat >server.conf <<EOF
[ req ]
prompt = no
req_extensions = v3_ext
distinguished_name = dn
[ dn ]
CN = opa.opa.svc
[ v3_ext ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
subjectAltName = DNS:opa.opa.svc,DNS:opa.opa.svc.cluster,DNS:opa.opa.svc.cluster.local
EOF
Run the below commands to generate the server.key and server.conf
Copy openssl genrsa -out server.key 2048
openssl req -new -key server.key -sha256 -out server.csr -extensions v3_ext -config server.conf
openssl x509 -req -in server.csr -sha256 -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -
days 100000 -extensions v3_ext -extfile server.conf
Creation of Namespace:
Create a namespace using the command given below:
Copy kuberctl create ns opa
Creation of Secret File:
Create the secret file using the command given below:
Copy kubectl create secret tls opa-server --cert=server.crt
--key=server.key --namespace opa
Config Creation
Create the Configmap using the commands given below:
Copy apiVersion: v1
data:
config.yaml: |
services:
- name: my-bundle-service
url:
https://opa-gate-poc.oes.opsmx.org
# Update the SSD OPA URL
- name: decision-controller
url:
https://opa-gate-poc.oes.opsmx.org
# Update the SSD OPA URL
bundles:
mybundle:
service: my-bundle-service
resource: /api/v1/bundle.tar.gz
decision_logs:
console: true
partition_name: api/v1/deploymentFirewallDecisionLogs
service: decision-controller
reporting:
min_delay_seconds: 20
max_delay_seconds: 50
kind: ConfigMap
metadata:
name: opa-config
namespace: opa
After updating the OPA SSD Url apply the above configmap using the command given below:
Copy kubectl apply -f config.yaml -n opa
OPA deploy yaml:
Follow the commands given below to create the OPA deploy yaml.
Copy ---
kind: Service
apiVersion: v1
metadata:
name: opa
namespace: opa
spec:
selector:
app: opa
ports:
- name: https
protocol: TCP
port: 443
targetPort: 8443
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: opa
name: opa
namespace: opa
spec:
progressDeadlineSeconds: 600
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: opa
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
labels:
app: opa
name: opa
spec:
containers:
- args:
- run
- --server
- --tls-cert-file=/certs/tls.crt
- --tls-private-key-file=/certs/tls.key
- --config-file=/config/config.yaml
- --log-level=debug
- --log-format=json-pretty
- --addr=0.0.0.0:8443
- --addr=http://127.0.0.1:8181
image: openpolicyagent/opa:0.55.0
imagePullPolicy: IfNotPresent
name: opa
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /certs
name: opa-server
readOnly: true
- mountPath: /config
name: opa-config
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
terminationGracePeriodSeconds: 30
volumes:
- name: opa-server
secret:
defaultMode: 420
secretName: opa-server
- configMap:
defaultMode: 420
name: opa-config
name: opa-config
After creating the file, apply the above yaml file into the cluster.
Creation of Validation Webhook:
Update the above generated ca cert in the below yaml file and apply the file in the cluster.
Copy kind: ValidatingWebhookConfiguration
apiVersion: admissionregistration.k8s.io/v1
metadata:
name: opa-validating-webhook
webhooks:
- name: validating-webhook.openpolicyagent.org
namespaceSelector:
matchExpressions:
- key: openpolicyagent.org/webhook
operator: NotIn
values:
- ignore
rules:
- operations: ["CREATE", "UPDATE"]
apiGroups: ["*"]
apiVersions: ["v1"]
resources: ["pods"]
clientConfig:
caBundle: $(cat ca.crt | base64 | tr -d '\n')
service:
namespace: opa
name: opa
admissionReviewVersions: ["v1"]
sideEffects: None
The Validating Webhook requests users to update and create/update pods only.
Copy kubectl label ns kube-system openpolicyagent.org/webhook=ignore
kubectl label ns opa openpolicyagent.org/webhook=ignore
NOTE : The above steps will be automated/included in the helm chart in the next cycle.
Last updated 2 months ago