Chapter 19. Integrating RHACS using short-lived tokens

Procedure

1. Run the following command to enable the IAM OpenID Connect (OIDC) provider for your EKS cluster:

   $ eksctl utils associate-iam-oidc-provider --cluster <cluster_name> --approve

2. Create an IAM role for your EKS cluster.

3. Edit the permission policy of the role and grant the permissions required by the integration. For example:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "ecr:BatchCheckLayerAvailability",
                   "ecr:BatchGetImage",
                   "ecr:DescribeImages",
                   "ecr:DescribeRepositories",
                   "ecr:GetAuthorizationToken",
                   "ecr:GetDownloadUrlForLayer",
                   "ecr:ListImages"
               ],
               "Resource": "arn:aws:iam::<ecr_registry>:role/<role_name>"
           }
       ]
   }

4. Update the trust relationship for the role that you want to assume:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": [
             "arn:aws:iam::<ecr-registry>:role/<role_name>"
           ]
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }

   where:

   <ecr-registry>

   Specifies the <role_name>, which should match with the new role that you have created in the earlier steps.

5. Enter the following command to associate the newly created role with a service account:

   $ oc -n stackrox annotate sa central eks.amazonaws.com/role-arn=arn:aws:iam::67890:role/<role_name>

6. Enter the following command to restart the Central pod and apply the changes:

   $ oc -n stackrox delete pod -l "app in (central,sensor)"

Procedure

1. Follow the instructions at Creating OpenID Connect (OIDC) identity providers to create web identity of the OpenShift Container Platform cluster. Use openshift as the value for Audience.
2. Create an IAM role for the web identity of the OpenShift Container Platform cluster.

3. Edit the permission policy of the role and grant the permissions required by the integration. For example:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "ecr:BatchCheckLayerAvailability",
                   "ecr:BatchGetImage",
                   "ecr:DescribeImages",
                   "ecr:DescribeRepositories",
                   "ecr:GetAuthorizationToken",
                   "ecr:GetDownloadUrlForLayer",
                   "ecr:ListImages"
               ],
               "Resource": "arn:aws:iam::<ecr_registry>:role/<role_name>"
           }
       ]
   }

4. Update the trust relationship for the role that you want to assume:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Federated": "<oidc_provider_arn>"
               },
               "Action": "sts:AssumeRoleWithWebIdentity",
               "Condition": {
                   "StringEquals": {
                       "<oidc_provider_name>:aud": "openshift"
                   }
               }
           }
       ]
   }

5. Set the following RHACS environment variables on the Central or Sensor deployment:

   AWS_ROLE_ARN=<role_arn>
   AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/openshift/serviceaccount/token

Procedure

1. Follow the instructions in the Google Cloud documentation to Use workload identity federation for GKE.

2. Annotate the RHACS service account by running the following command:

   $ oc annotate serviceaccount \
       central \
       --namespace stackrox \
       iam.gke.io/gcp-service-account=<GSA_NAME>@<GSA_PROJECT>.iam.gserviceaccount.com

   Important

   When setting up delegated scanning, use sensor instead of central.

Procedure

1. Follow the instructions at Manage workload identity pools to create a workload identity pool. For example:

   $ gcloud iam workload-identity-pools create rhacs-pool \
       --location="global" \
       --display-name="RHACS workload pool"

2. Follow the instructions at Manage workload identity pool providers to create a workload identity pool provider. For example:

   $ gcloud iam workload-identity-pools providers create-oidc rhacs-provider \
       --location="global" \
       --workload-identity-pool="rhacs-pool" \
       --display-name="RHACS provider" \
       --attribute-mapping="google.subject=assertion.sub" \
       --issuer-uri="https://<oidc_configuration_url>" \
       --allowed-audiences=openshift

3. Connect a Google service account to the workload identity pool. For example:

   $ gcloud iam service-accounts add-iam-policy-binding <GSA_NAME>@<GSA_PROJECT>.iam.gserviceaccount.com \
       --role roles/iam.workloadIdentityUser \
       --member="principal://iam.googleapis.com/projects/<GSA_PROJECT_NUMBER>/locations/global/workloadIdentityPools/rhacs-provider/subject/system:serviceaccount:stackrox:central"

   where:

   <system:serviceaccount:stackrox:central>

   Specifies the subject. For delegated scanning, you must set the subject to system:serviceaccount:stackrox:sensor.

4. Create a service account JSON containing the Security token service (STS) configuration. For example:

   {
     "type": "external_account",
     "audience": "//iam.googleapis.com/projects/<GSA_PROJECT_ID>/locations/global/workloadIdentityPools/rhacs-pool/providers/rhacs-provider",
     "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
     "token_url": "https://sts.googleapis.com/v1/token",
     "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/<GSA_NAME>@<GSA_PROJECT>.iam.gserviceaccount.com:generateAccessToken",
     "credential_source": {
       "file": "/var/run/secrets/openshift/serviceaccount/token",
       "format": {
         "type": "text"
       }
     }
   }

5. Use the service account JSON as a secret to the RHACS namespace:

   apiVersion: v1
   kind: Secret
   metadata:
     name: gcp-cloud-credentials
     namespace: stackrox
   data:
     credentials: <base64_encoded_json>

Procedure

1. Create a trust relationship between the external IdP and a user-assigned managed identity or application in Microsoft Entra ID.

   For more information, see Workload identity federation (Microsoft Azure documentation).

2. Annotate the RHACS service account by running the following command:

   Important

   When setting up the delegated scanning, use sensor instead of central.

   $ oc annotate serviceaccount \
       central \
       --namespace stackrox \
       azure.workload.identity/client-id=<CLIENT_ID>

   where:

   <CLIENT_ID>

   Specifies the client ID of the associated identity.

   Example output

   serviceaccount/central annotated