Skip to content

Commit 632ca0a

Browse files
flavioflavio
authored
Merge pull request #556 from kubewarden/mtls
Cover mTLS
2 parents 50bd224 + 0a8bcfb commit 632ca0a

File tree

6 files changed

+422
-0
lines changed

6 files changed

+422
-0
lines changed

‎docs/howtos/argocd-installation.md

+6
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,12 @@ spec:
9494
namespace: kubewarden-system
9595
jsonPointers:
9696
- /data
97+
- group: ""
98+
kind: "Secret"
99+
name: kubewarden-audit-scanner-client-cert
100+
namespace: kubewarden-system
101+
jsonPointers:
102+
- /data
97103
- group: "admissionregistration.k8s.io"
98104
kind: "MutatingWebhookConfiguration"
99105
jqPathExpressions:

‎docs/howtos/security-hardening/_category_.json

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"label": "Security",
3+
"position": 100,
4+
"collapsed": true
5+
}

‎docs/howtos/security-hardening/webhook-mtls.md

+159
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
---
2+
sidebar_label: Enable mTLS with k3s
3+
title: Secure webhooks with mutual TLS with k3s
4+
description: Harden the webhook configuration.
5+
keywords: [kubewarden, kubernetes, security]
6+
doc-persona: [kubewarden-operator, kubewarden-integrator]
7+
doc-type: [howto]
8+
doc-topic: [operator-manual, security]
9+
---
10+
11+
<head>
12+
<link rel="canonical" href="https://docs.kubewarden.io/howtos/security-hardening/webhook-mtls"/>
13+
</head>
14+
15+
This guide shows you how to enable mutual TLS (mTLS) for all the webhooks used by the Kubewarden
16+
stack when using [k3s](https://k3s.io/) as your Kubernetes distribution.
17+
18+
## Prerequisites
19+
20+
Before installing k3s, you need to create a certificate authority (CA) and a client certificate to use to secure the communication between the Kubewarden webhooks and the Kubernetes API server.
21+
22+
As a first step, create the `/etc/rancher/k3s/admission/certs` directory:
23+
24+
```console
25+
sudo mkdir -p /etc/rancher/k3s/admission/certs
26+
```
27+
28+
### Create a root CA and the client certificate
29+
30+
As `root` user, change directory to the `/etc/rancher/k3s/admission/certs` directory and
31+
create all needed certificates:
32+
33+
```console
34+
export FQDN=mtls.kubewarden.io
35+
36+
# Create CA
37+
openssl req -nodes -batch -x509 -sha256 -days 365 -newkey rsa:2048 -keyout rootCA.key -out rootCA.crt
38+
39+
# Create CSR
40+
openssl req -nodes -batch -newkey rsa:2048 -keyout client.key -out client.csr \
41+
-addext "subjectAltName = DNS:$FQDN"
42+
43+
# Create CRT
44+
openssl x509 -req -CA rootCA.crt -CAkey rootCA.key -in client.csr -out client.crt -days 365 -CAcreateserial \
45+
-extfile <(echo "subjectAltName=DNS:$FQDN")
46+
47+
# Print CRT
48+
openssl x509 -text -noout -in client.crt
49+
```
50+
51+
The following files should have been created:
52+
53+
- `client.crt`
54+
- `client.csr`
55+
- `client.key`
56+
- `rootCA.crt`
57+
- `rootCA.key`
58+
- `rootCA.srl`
59+
60+
### Create the Kubernetes configuration file
61+
62+
Create the `/etc/rancher/admission/admission.yaml` file with the following content:
63+
64+
```yaml
65+
# /etc/rancher/admission/admission.yaml
66+
apiVersion: apiserver.config.k8s.io/v1
67+
kind: AdmissionConfiguration
68+
plugins:
69+
- name: ValidatingAdmissionWebhook
70+
configuration:
71+
apiVersion: apiserver.config.k8s.io/v1
72+
kind: WebhookAdmissionConfiguration
73+
kubeConfigFile: "/etc/rancher/k3s/admission/kubeconfig"
74+
- name: MutatingAdmissionWebhook
75+
configuration:
76+
apiVersion: apiserver.config.k8s.io/v1
77+
kind: WebhookAdmissionConfiguration
78+
kubeConfigFile: "/etc/rancher/k3s/admission/kubeconfig"
79+
```
80+
81+
Finally, create a `kubeconfig` file at `/etc/rancher/k3s/admission/kubeconfig`:
82+
83+
```yaml
84+
# /etc/rancher/admission/kubeconfig
85+
apiVersion: v1
86+
kind: Config
87+
users:
88+
- name: '*.kubewarden.svc' # namespace where the kubewarden stack is deployed
89+
user:
90+
client-certificate: /etc/rancher/k3s/admission/certs/client.crt
91+
client-key: /etc/rancher/k3s/admission/certs/client.key
92+
```
93+
94+
### Create a k3s configuration file
95+
96+
Create a k3s configuration file at `/etc/rancher/k3s/config.yaml`:
97+
98+
```yaml
99+
# /etc/rancher/k3s/config.yaml
100+
kube-apiserver-arg:
101+
- admission-control-config-file=/etc/rancher/k3s/admission/admission.yaml
102+
```
103+
104+
## Install k3s
105+
106+
Install k3s using the following command:
107+
108+
```console
109+
curl -sfL https://get.k3s.io | sh -
110+
```
111+
112+
Wait for the installation to complete.
113+
114+
## Install the Kubewarden stack
115+
116+
### Prerequisites
117+
118+
The certificate of the root CA, that issued the Kubernetes client certificate, must be made available to
119+
the Kubewarden stack.
120+
121+
The root CA is available at `/etc/rancher/k3s/admission/certs/rootCA.crt` on the Kubernetes node. Its content
122+
has to be put into a `ConfigMap` under the `kubewarden` namespace. The contents of the `rootCA.crt` file
123+
must be stored in a key named `client-ca.crt`.
124+
125+
First, create the `kubewarden` namespace:
126+
127+
```console
128+
kubectl create namespace kubewarden
129+
```
130+
131+
Then create the `ConfigMap` in it. The following command, run on the Kubernetes node,
132+
does that:
133+
134+
```console
135+
kubectl create configmap -n kubewarden api-server-mtls \
136+
--from-file=client-ca.crt=/etc/rancher/k3s/admission/certs/rootCA.crt
137+
```
138+
139+
The resulting `ConfigMap` is named `api-server-mtls`.
140+
141+
### Install the Kubewarden stack
142+
143+
Install the Kubewarden stack as described in the [quickstart guide](../../quick-start.md).
144+
Follow all the steps, but when installing the `kubewarden-controller` Helm chart, make sure to
145+
enable the following values:
146+
147+
- `mTLS.enable`: must be set to `true`.
148+
- `mTLS.configMapName`: must be set to name of the `ConfigMap` that was previously created.
149+
150+
Given the `ConfigMap` was named `api-server-mtls`, the Helm command to install the `kubewarden-controller`
151+
is:
152+
153+
```console
154+
helm install --wait -n kubewarden kubewarden-controller kubewarden/kubewarden-controller \
155+
--set mTLS.enable=true \
156+
--set mTLS.configMapName=api-server-mtls
157+
```
158+
159+
Once this command finishes, the Kubewarden stack is installed and its webhooks are secured with mTLS.

‎docs/reference/security-hardening/_category_.json

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"label": "Security",
3+
"position": 70,
4+
"collapsed": true
5+
}

0 commit comments

Comments
 (0)