Chapter 10. Zero Trust Workload Identity Manager

Procedure

1. Log in to the OpenShift Container Platform web console.
2. Go to Operators OperatorHub.
3. Enter Zero Trust Workload Identity Manager into the filter box.
4. Select the Zero Trust Workload Identity Manager
5. Select the Zero Trust Workload Identity Manager version from Version drop-down list, and click Install.

6. On the Install Operator page:

   1. Update the Update channel, if necessary. The channel defaults to tech-preview-v0.1, which installs the latest Technology Preview v0.1 release of the Zero Trust Workload Identity Manager.

   2. Choose the Installed Namespace for the Operator. The default Operator namespace is zero-trust-workload-identity-manager.

      If the zero-trust-workload-identity-manager namespace does not exist, it is created for you.

   3. Select an Update approval strategy.

      • The Automatic strategy allows Operator Lifecycle Manager (OLM) to automatically update the Operator when a new version is available.
      • The Manual strategy requires a user with appropriate credentials to approve the Operator update.
   4. Click Install.

Procedure

1. Create a new project named zero-trust-workload-identity-manager by running the following command:

   $ oc new-project zero-trust-workload-identity-manager

   Copy to Clipboard Toggle word wrap

2. Create an OperatorGroup object:

   1. Create a YAML file, for example, operatorGroup.yaml, with the following content:

      Example operatorGroup.yaml

      apiVersion: operators.coreos.com/v1
      kind: OperatorGroup
      metadata:
        name: openshift-zero-trust-workload-identity-manager
        namespace: zero-trust-workload-identity-manager
      spec:
        upgradeStrategy: Default

      Copy to Clipboard Toggle word wrap

   2. Create the OperatorGroup object by running the following command:

      $ oc create -f operatorGroup.yaml

      Copy to Clipboard Toggle word wrap

3. Create a Subscription object:

   1. Create a YAML file, for example, subscription.yaml, that defines the Subscription object:

      Example subscription.yaml

      apiVersion: operators.coreos.com/v1alpha1
      kind: Subscription
      metadata:
        name: openshift-zero-trust-workload-identity-manager
        namespace: zero-trust-workload-identity-manager
      spec:
        channel: tech-preview-v0.1
        name: openshift-zero-trust-workload-identity-manager
        source: redhat-operators
        sourceNamespace: openshift-marketplace
        installPlanApproval: Automatic

      Copy to Clipboard Toggle word wrap

   2. Create the Subscription object by running the following command:

      $ oc create -f subscription.yaml

      Copy to Clipboard Toggle word wrap

Procedure

1. Create a Role to provide the router service account permissions to read the referenced secret by running the following command:

   $ oc create role secret-reader \
     --verb=get,list,watch \
     --resource=secrets \
     --resource-name=$TLS_SECRET_NAME \
     -n zero-trust-workload-identity-manager

   Copy to Clipboard Toggle word wrap

2. Create a RoleBinding resource to bind the router service account with the newly created Role resource by running the following command:

   $ oc create rolebinding secret-reader-binding \
     --role=secret-reader \
     --serviceaccount=openshift-ingress:router \
     -n zero-trust-workload-identity-manager

   Copy to Clipboard Toggle word wrap

3. Configure the SpireOIDCDIscoveryProvider Custom Resource (CR) object to reference the Secret generated in the earlier step by running the following command:

   $ oc patch SpireOIDCDiscoveryProvider cluster --type=merge -p='
   spec:
     externalSecretRef: ${TLS_SECRET_NAME}
   '

   Copy to Clipboard Toggle word wrap

Verification

1. In the SpireOIDCDiscoveryProvider CR, check if the ManageRouteReady condition is set to True by running the following command:

   $ oc wait --for=jsonpath='{.status.conditions[?(@.type=="ManagedRouteReady")].status}'=True SpireOIDCDiscoveryProvider/cluster --timeout=120s

   Copy to Clipboard Toggle word wrap

2. Verify that the OIDC endpoint can be accessed securely through HTTPS by running the following command:

   $ curl https://$JWT_ISSUER_ENDPOINT/.well-known/openid-configuration
   
   {
     "issuer": "https://$JWT_ISSUER_ENDPOINT",
     "jwks_uri": "https://$JWT_ISSUER_ENDPOINT/keys",
     "authorization_endpoint": "",
     "response_types_supported": [
       "id_token"
     ],
     "subject_types_supported": [],
     "id_token_signing_alg_values_supported": [
       "RS256",
       "ES256",
       "ES384"
     ]
   }%

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to Azure by running the following command:

   $ az login

   Copy to Clipboard Toggle word wrap

2. Configure variables for your Azure subscription and tenant by running the following commands:

   $ export SUBSCRIPTION_ID=$(az account list --query "[?isDefault].id" -o tsv) 

   1

   Copy to Clipboard Toggle word wrap

   $ export TENANT_ID=$(az account list --query "[?isDefault].tenantId" -o tsv) 

   1

   Copy to Clipboard Toggle word wrap

   $ export LOCATION=centralus 

   1

   Copy to Clipboard Toggle word wrap

   1

   Your unique subscription identifier.

   1

   The ID for your Azure Active Directory instance.

   1

   The Azure region where your resource is created.

3. Define resource variable names by running the following commands:

   $ export NAME=ztwim 

   1

   Copy to Clipboard Toggle word wrap

   $ export RESOURCE_GROUP="${NAME}-rg" 

   1

   Copy to Clipboard Toggle word wrap

   $ export STORAGE_ACCOUNT="${NAME}storage" 

   1

   Copy to Clipboard Toggle word wrap

   $ export STORAGE_CONTAINER="${NAME}storagecontainer" 

   1

   Copy to Clipboard Toggle word wrap

   $ export USER_ASSIGNED_IDENTITY_NAME="${NAME}-identity" 

   1

   Copy to Clipboard Toggle word wrap

   1

   A base name for all resources.

   1

   The name of the resource group.

   1

   The name for the storage account.

   1

   The name for the storage container.

   1

   The name for a managed identity.

4. Create the resource group by running the following command:

   $ az group create \
     --name "${RESOURCE_GROUP}" \
     --location "${LOCATION}"

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a new storage account that is used to store content by running the following command:

   $ az storage account create \
     --name ${STORAGE_ACCOUNT} \
     --resource-group ${RESOURCE_GROUP} \
     --location ${LOCATION} \
     --encryption-services blob

   Copy to Clipboard Toggle word wrap

2. Obtain the storage ID for the newly created storage account by running the following command:

   $ export STORAGE_ACCOUNT_ID=$(az storage account show -n ${STORAGE_ACCOUNT} -g ${RESOURCE_GROUP} --query id --out tsv)

   Copy to Clipboard Toggle word wrap

3. Create a storage container inside the newly created storage account to provide a location to support the storage of blobs by running the following command:

   $ az storage container create \
     --account-name ${STORAGE_ACCOUNT} \
     --name ${STORAGE_CONTAINER} \
     --auth-mode login

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a new User Managed Identity and then obtain the Client ID of the related Service Principal associated with the User Managed Identity by running the following command:

   $ az identity create \
     --name ${USER_ASSIGNED_IDENTITY_NAME} \
     --resource-group ${RESOURCE_GROUP}
   
   $ export IDENTITY_CLIENT_ID=$(az identity show --resource-group "${RESOURCE_GROUP}" --name "${USER_ASSIGNED_IDENTITY_NAME}" --query 'clientId' -otsv)

   Copy to Clipboard Toggle word wrap

2. Retrieve the CLIENT_ID of an Azure user-assigned managed identity and save it as an environment variable by running the following command:

   $ export IDENTITY_CLIENT_ID=$(az identity show --resource-group "${RESOURCE_GROUP}" --name "${USER_ASSIGNED_IDENTITY_NAME}" --query 'clientId' -otsv)

   Copy to Clipboard Toggle word wrap

3. Associate a role with the Service Principal associated with the User Managed Identity by running the following command:

   $ az role assignment create \
     --role "Storage Blob Data Contributor" \
     --assignee "${IDENTITY_CLIENT_ID}" \
     --scope ${STORAGE_ACCOUNT_ID}

   Copy to Clipboard Toggle word wrap

1. Set the application name and namespace by running the following commands:

   $ export APP_NAME=workload-app

   Copy to Clipboard Toggle word wrap

   $ export APP_NAMESPACE=demo

   Copy to Clipboard Toggle word wrap

2. Create the namespace by running the following command:

   $ oc create namespace $APP_NAMESPACE

   Copy to Clipboard Toggle word wrap

3. Create the application Secret by running the following command:

   $ oc apply -f - << EOF
   apiVersion: v1
   kind: Secret
   metadata:
     name: $APP_NAME
     namespace: $APP_NAMESPACE
   stringData:
     AAD_AUTHORITY: https://login.microsoftonline.com/
     AZURE_AUDIENCE: "api://AzureADTokenExchange"
     AZURE_TENANT_ID: "${TENANT_ID}"
     AZURE_CLIENT_ID: "${IDENTITY_CLIENT_ID}"
     BLOB_STORE_ACCOUNT: "${STORAGE_ACCOUNT}"
     BLOB_STORE_CONTAINER: "${STORAGE_CONTAINER}"
   EOF

   Copy to Clipboard Toggle word wrap

Procedure

1. To deploy the application, copy the entire command block provided and paste it directly into your terminal. Press Enter.

   $ oc apply -f - << EOF
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: $APP_NAME
     namespace: $APP_NAMESPACE
   ---
   kind: Deployment
   apiVersion: apps/v1
   metadata:
     name: $APP_NAME
     namespace: $APP_NAMESPACE
   spec:
     selector:
       matchLabels:
         app: $APP_NAME
     template:
       metadata:
         labels:
           app: $APP_NAME
           deployment: $APP_NAME
       spec:
         serviceAccountName: $APP_NAME
         containers:
           - name: $APP_NAME
             image: "registry.redhat.io/ubi9/python-311:latest"
             command:
               - /bin/bash
               - "-c"
               - |
                 #!/bin/bash
                 pip install spiffe azure-cli
   
                 cat << EOF > /opt/app-root/src/get-spiffe-token.py
                 #!/opt/app-root/bin/python
                 from spiffe import JwtSource
                 import argparse
                 parser = argparse.ArgumentParser(description='Retrieve SPIFFE Token.')
                 parser.add_argument("-a", "--audience", help="The audience to include in the token", required=True)
                 args = parser.parse_args()
                 with JwtSource() as source:
                   jwt_svid = source.fetch_svid(audience={args.audience})
                   print(jwt_svid.token)
                 EOF
   
                 chmod +x /opt/app-root/src/get-spiffe-token.py
                 while true; do sleep 10; done
             envFrom:
             - secretRef:
                 name: $APP_NAME
             env:
               - name: SPIFFE_ENDPOINT_SOCKET
                 value: unix:///run/spire/sockets/spire-agent.sock
             securityContext:
               allowPrivilegeEscalation: false
               capabilities:
                 drop:
                   - ALL
               readOnlyRootFilesystem: false
               runAsNonRoot: true
               seccompProfile:
                 type: RuntimeDefault
             ports:
               - containerPort: 8080
                 protocol: TCP
             volumeMounts:
               - name: spiffe-workload-api
                 mountPath: /run/spire/sockets
                 readOnly: true
         volumes:
           - name: spiffe-workload-api
             csi:
               driver: csi.spiffe.io
               readOnly: true
   EOF

   Copy to Clipboard Toggle word wrap

Verification

1. Ensure that the workload-app pod is running successfully by running the following command:

   $ oc get pods -n $APP_NAMESPACE

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                             READY     STATUS      RESTARTS      AGE
   workload-app-5f8b9d685b-abcde    1/1       Running     0             60s

   Copy to Clipboard Toggle word wrap

2. Retrieve the SPIFFE JWT Token (SVID-JWT):

   1. Get the pod name dynamically by running the following command:

      $ POD_NAME=$(oc get pods -n $APP_NAMESPACE -l app=$APP_NAME -o jsonpath='{.items[0].metadata.name}')

      Copy to Clipboard Toggle word wrap

   2. Run the script inside the pod by running the following command:

      $ oc exec -it $POD_NAME -n $APP_NAMESPACE -- \
        /opt/app-root/src/get-spiffe-token.py -a "api://AzureADTokenExchange"

      Copy to Clipboard Toggle word wrap

Procedure

1. Retrieve a JWT token from the SPIFFE Workload API by running the following command:

   $ oc rsh -n $APP_NAMESPACE deployment/$APP_NAME

   Copy to Clipboard Toggle word wrap

2. Create and export an environment variable named TOKEN by running the following command:

   $ export TOKEN=$(/opt/app-root/src/get-spiffe-token.py --audience=$AZURE_AUDIENCE)

   Copy to Clipboard Toggle word wrap

3. Log in to Azure CLI included within the pod by running the following command:

   $ az login --service-principal \
     -t ${AZURE_TENANT_ID} \
     -u ${AZURE_CLIENT_ID} \
     --federated-token ${TOKEN}

   Copy to Clipboard Toggle word wrap

4. Create a new file with the application workload pod and upload the file to the Blob Storage by running the following command:

   $ echo “Hello from OpenShift” > openshift-spire-federated-identities.txt

   Copy to Clipboard Toggle word wrap

5. Upload a file to the Azure Blog Storage by running the following command:

   $ az storage blob upload \
     --account-name ${BLOB_STORE_ACCOUNT} \
     --container-name ${BLOB_STORE_CONTAINER} \
     --name openshift-spire-federated-identities.txt \
     --file openshift-spire-federated-identities.txt \
     --auth-mode login

   Copy to Clipboard Toggle word wrap

Procedure

1. Create the vault-helm-value.yaml file.

   global:
     enabled: true
     openshift: true 

   1

   
     tlsDisable: true 

   2

   
   injector:
     enabled: false
   server:
     ui:
       enabled: true
     image:
       repository: docker.io/hashicorp/vault
       tag: "1.19.0"
     dataStorage:
       enabled: true 

   3

   
       size: 1Gi
     standalone:
       enabled: true 

   4

   
       config: |
         listener "tcp" {
           tls_disable = 1 

   5

   
           address = "[::]:8200"
           cluster_address = "[::]:8201"
         }
         storage "file" {
           path = "/vault/data"
         }
     extraEnvironmentVars: {}

   Copy to Clipboard Toggle word wrap

   1

   Optimizes the deployment for OpenShift-specific security contexts.

   2

   Disables TLS for Kubernetes objects created by the chart.

   3

   Creates a 1Gi persistent volume to store Vault data.

   4

   Deploys a single Vault pod.

   5

   Tells the Vault server to not use TLS.

2. Run the helm install command:

   $ helm install vault hashicorp/vault \
     --create-namespace -n vault \
     --values ./vault-helm-value.yaml

   Copy to Clipboard Toggle word wrap

3. Expose the Vault service by running the following command:

   $ oc expose service vault -n vault

   Copy to Clipboard Toggle word wrap

4. Set the VAULT_ADDR environment variable to retrieve the hostname from the new route and then export it by running the following command:

   $ export VAULT_ADDR="http://$(oc get route vault -n vault -o jsonpath='{.spec.host}')"

   Copy to Clipboard Toggle word wrap
   Note

   http:// is prepended because TLS is disabled.

1. Initialize and unseal Vault
2. Enable the key-value (KV) secrets engine and store a test secret
3. Configure JSON Web Token (JWT) authentication with SPIRE
4. Deploy a demonstration application
5. Authenticate and retrieve the secret

Procedure

1. Open a remote shell into the vault pod by running the following command:

   $ oc rsh -n vault statefulset/vault

   Copy to Clipboard Toggle word wrap

2. Initialize Vault to get your unseal key and root token by running the following command:

   $ vault operator init -key-shares=1 -key-threshold=1 -format=json

   Copy to Clipboard Toggle word wrap

3. Export the unseal key and root token you received from the earlier command by running the following commands:

   $ export UNSEAL_KEY=<Your-Unseal-Key>

   Copy to Clipboard Toggle word wrap

   $ export ROOT_TOKEN=<Your-Root-Token>

   Copy to Clipboard Toggle word wrap

4. Unseal Vault using your unseal key by running the following command:

   $ vault operator unseal -format=json $UNSEAL_KEY

   Copy to Clipboard Toggle word wrap
5. Exit the pod by entering exit.

Procedure

1. Open another shell session in the Vault pod by running the following command:

   $ oc rsh -n vault statefulset/vault

   Copy to Clipboard Toggle word wrap

2. Export your root token again within this new session and log in by running the following command:

   $ export ROOT_TOKEN=<Your-Root-Token>

   Copy to Clipboard Toggle word wrap

   $ vault login "${ROOT_TOKEN}"

   Copy to Clipboard Toggle word wrap

3. Enable the KV secrets engine at the secret/ path and create a test secret by running the following commands:

   $ export NAME=ztwim

   Copy to Clipboard Toggle word wrap

   $ vault secrets enable -path=secret kv

   Copy to Clipboard Toggle word wrap

   $ vault kv put secret/$NAME version=v0.1.0

   Copy to Clipboard Toggle word wrap

Procedure

1. On your local machine, retrieve the SPIRE Certificate Authority (CA) bundle and save it to a file by running the following command:

   $ oc get cm -n zero-trust-workload-identity-manager spire-bundle -o jsonpath='{ .data.bundle\.crt }' > oidc_provider_ca.pem

   Copy to Clipboard Toggle word wrap

2. Back in the Vault pod shell, create a temporary file and paste the contents of oidc_provider_ca.pem into it by running the following command:

   $ cat << EOF > /tmp/oidc_provider_ca.pem
   -----BEGIN CERTIFICATE-----
   <Paste-Your-Certificate-Content-Here>
   -----END CERTIFICATE-----
   EOF

   Copy to Clipboard Toggle word wrap

3. Set up the necessary environment variables for the JWT configuration by running the following commands:

   $ export APP_DOMAIN=<Your-App-Domain>

   Copy to Clipboard Toggle word wrap

   $ export JWT_ISSUER_ENDPOINT="oidc-discovery.$APP_DOMAIN"

   Copy to Clipboard Toggle word wrap

   $ export OIDC_URL="https://$JWT_ISSUER_ENDPOINT"

   Copy to Clipboard Toggle word wrap

   $ export OIDC_CA_PEM="$(cat /tmp/oidc_provider_ca.pem)"

   Copy to Clipboard Toggle word wrap

4. Crate a new environment variable by running the following command:

   $ export ROLE="${NAME}-role"

   Copy to Clipboard Toggle word wrap

5. Enable the JWT authentication method by running the following command:

   $ vault auth enable jwt

   Copy to Clipboard Toggle word wrap

6. Configure you ODIC authentication method by running the following command:

   $ vault write auth/jwt/config \
     oidc_discovery_url=$OIDC_URL \
     oidc_discovery_ca_pem="$OIDC_CA_PEM" \
     default_role=$ROLE

   Copy to Clipboard Toggle word wrap

7. Create a policy named ztwim-policy by running the following command:

   $ export POLICY="${NAME}-policy"

   Copy to Clipboard Toggle word wrap

8. Grant read access to the secret you created earlier by running the following command:

   $ vault policy write $POLICY -<<EOF
   path "secret/$NAME" {
       capabilities = ["read"]
   }
   EOF

   Copy to Clipboard Toggle word wrap

9. Create the following environment variables by running the following commands:

   $ export APP_NAME=client

   Copy to Clipboard Toggle word wrap

   $ export APP_NAMESPACE=demo

   Copy to Clipboard Toggle word wrap

   $ export AUDIENCE=$APP_NAME

   Copy to Clipboard Toggle word wrap

10. Create a JWT role that binds the policy to workload with a specific SPIFFE ID by running the following command:

    $ vault write auth/jwt/role/$ROLE -<<EOF
    {
      "role_type": "jwt",
      "user_claim": "sub",
      "bound_audiences": "$AUDIENCE",
      "bound_claims_type": "glob",
      "bound_claims": {
        "sub": "spiffe://$APP_DOMAIN/ns/$APP_NAMESPACE/sa/$APP_NAME"
      },
      "token_ttl": "24h",
      "token_policies": "$POLICY"
    }
    EOF

    Copy to Clipboard Toggle word wrap

Procedure

1. On your local machine, set the environment variables for your application by running the following commands:

   $ export APP_NAME=client

   Copy to Clipboard Toggle word wrap

   $ export APP_NAMESPACE=demo

   Copy to Clipboard Toggle word wrap

   $ export AUDIENCE=$APP_NAME

   Copy to Clipboard Toggle word wrap

2. Apply the Kubernetes manifest to create the namespace, service account, and deployment for the demo app by running the following command. This deployment mounts the SPIFFE CSI driver socket.

   $ oc apply -f - <<EOF
   # ... (paste the full YAML from your provided code here) ...
   EOF

   Copy to Clipboard Toggle word wrap

Procedure

1. Fetch a JWT-SVID by running the following command inside the running client pod:

   $ oc -n $APP_NAMESPACE exec -it $(oc get pod -o=jsonpath='{.items[*].metadata.name}' -l app=$APP_NAME -n $APP_NAMESPACE) \
     -- /opt/spire/bin/spire-agent api fetch jwt \
     -socketPath /run/spire/sockets/spire-agent.sock \
     -audience $AUDIENCE

   Copy to Clipboard Toggle word wrap

2. Copy the token from the output and export it as an environment variable on your local machine by running the following command:

   $ export IDENTITY_TOKEN=<Your-JWT-Token>

   Copy to Clipboard Toggle word wrap

3. Crate a new environment variable by running the following command:

   $ export ROLE="${NAME}-role"

   Copy to Clipboard Toggle word wrap

4. Use curl to send the JWT token to the Vault login endpoint to get a Vault client token by running the following command:

   $ VAULT_TOKEN=$(curl -s --request POST --data '{ "jwt": "'"${IDENTITY_TOKEN}"'", "role": "'"${ROLE}"'"}' "${VAULT_ADDR}"/v1/auth/jwt/login | jq -r '.auth.client_token')

   Copy to Clipboard Toggle word wrap