Enable Deployment Firewall in Target Clusters

This page lists the elaborated steps on how to configure an OPA policy agent in the target environment or enable the deployment firewall in the target clusters. To know in detail about OPA, refer OPA overview. Refer OPA Installation for the steps on how to install OPA.

Follow the steps given below to configure OPA in the target environment.

Generation of Ca Cert:

The first step involves generating the Ca Cert.

1. To generate the Ca Cert, use the command given below:

openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -sha256 -key ca.key -days 100000 -out ca.crt -
subj "/CN=admission_ca"

2. Generate the TLS key and certificate as shown below:

cat >server.conf <<EOF

[ req ]
prompt = no
req_extensions = v3_ext
distinguished_name = dn

[ dn ]
CN = opa.opa.svc

[ v3_ext ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
subjectAltName = DNS:opa.opa.svc,DNS:opa.opa.svc.cluster,DNS:opa.opa.svc.cluster.local
EOF

2. Run the below commands to generate the server.key and server.conf

openssl genrsa -out server.key 2048
openssl req -new -key server.key -sha256 -out server.csr -extensions v3_ext -config server.conf
openssl x509 -req -in server.csr -sha256 -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -
days 100000 -extensions v3_ext -extfile server.conf

Creation of Namespace:

Create a namespace using the command given below:

kuberctl create ns opa

Creation of Secret File:

Create the secret file using the command given below:

kubectl create secret tls opa-server --cert=server.crt 
--key=server.key --namespace opa

Config Creation

Create the Configmap using the commands given below:

apiVersion: v1
data:
  config.yaml: |
    services:
      - name: my-bundle-service
        url: 
https://opa-gate-poc.oes.opsmx.org
  # Update the SSD OPA URL
      - name: decision-controller
        url: 
https://opa-gate-poc.oes.opsmx.org
  # Update the SSD OPA URL

    bundles:
      mybundle:
        service: my-bundle-service
        resource: /api/v1/bundle.tar.gz

    decision_logs:
      console: true
      partition_name: api/v1/deploymentFirewallDecisionLogs
      service: decision-controller

      reporting:
        min_delay_seconds: 20
        max_delay_seconds: 50
kind: ConfigMap
metadata:
  name: opa-config
  namespace: opa

After updating the OPA SSD Url apply the above configmap using the command given below:

kubectl apply -f config.yaml -n opa

OPA deploy yaml:

Follow the commands given below to create the OPA deploy yaml.

---
kind: Service
apiVersion: v1
metadata:
  name: opa
  namespace: opa
spec:
  selector:
    app: opa
  ports:
  - name: https
    protocol: TCP
    port: 443
    targetPort: 8443
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: opa
  name: opa
  namespace: opa
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: opa
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: opa
      name: opa
    spec:
      containers:
      - args:
        - run
        - --server
        - --tls-cert-file=/certs/tls.crt
        - --tls-private-key-file=/certs/tls.key
        - --config-file=/config/config.yaml
        - --log-level=debug
        - --log-format=json-pretty
        - --addr=0.0.0.0:8443
        - --addr=http://127.0.0.1:8181
        image: openpolicyagent/opa:0.55.0
        imagePullPolicy: IfNotPresent
        name: opa
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /certs
          name: opa-server
          readOnly: true
        - mountPath: /config
          name: opa-config
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
      volumes:
      - name: opa-server
        secret:
          defaultMode: 420
          secretName: opa-server
      - configMap:
          defaultMode: 420
        name: opa-config
        name: opa-config

After creating the file, apply the above yaml file into the cluster.

Creation of Validation Webhook:

Update the above generated ca cert in the below yaml file and apply the file in the cluster.

kind: ValidatingWebhookConfiguration
apiVersion: admissionregistration.k8s.io/v1
metadata:
  name: opa-validating-webhook
webhooks:
  - name: validating-webhook.openpolicyagent.org
    namespaceSelector:
      matchExpressions:
      - key: openpolicyagent.org/webhook
        operator: NotIn
        values:
        - ignore
    rules:
      - operations: ["CREATE", "UPDATE"]
        apiGroups: ["*"]
        apiVersions: ["v1"]
        resources: ["pods"]
    clientConfig:
      caBundle: $(cat ca.crt | base64 | tr -d '\n')
      service:
        namespace: opa
        name: opa
    admissionReviewVersions: ["v1"]
    sideEffects: None

The Validating Webhook requests users to update and create/update pods only.

kubectl label ns kube-system openpolicyagent.org/webhook=ignore

kubectl label ns opa openpolicyagent.org/webhook=ignore

NOTE: The above steps will be automated/included in the helm chart in the next cycle.