Skip to content
This repository has been archived by the owner on Sep 8, 2023. It is now read-only.

feat: added versioning for docs #84

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 16 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,22 +12,29 @@ This is the repository for the Tailwarden Organization Public Documentation. It

1. Clone this repository: `git clone "https://github.com/tailwarden/docs.komiser.io.git"`
2. Run the commands :
1. `npm install`
2. `npm run build`
3. `npm run start`
1. `npm install`
2. `npm run build`
3. `npm run start`
3. The site will be running locally on `http://localhost:3000`

### How To Contribute To the Documentation

1. Fork this repository
2. Create your documentation branch: `git checkout -b branch-name`
3. Make changes to the documentation in markdown
4. Add changes to the staging area `git add .`
5. Commit your changes using the command `git commit -m 'commit message'`
6. Push your changes to gitHub `git push origin branch-name`
7. Create new Pull Request
3. Check the version you want to contribute to in the version_docs folder.
4. Make changes to the particular version documentation in markdown
5. Add changes to the staging area `git add .`
6. Commit your changes using the command `git commit -m 'commit message'`
7. Push your changes to gitHub `git push origin branch-name`
8. Create new Pull Request

### How to Publish a new version For Maintainers

1. Add your changes to the docs folder.
1. Run the commands :
1. `npm run publish-version`
1. Commit your changes and push to github.

## History

### v1.0.0 (Aug, 2022)
### v1.0.0 (Aug, 2023)
118 changes: 77 additions & 41 deletions docs/Cloud Providers/aws.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ sidebar_label: Amazon Web Services
# Amazon Web Services

## Supported resources

- API Gateway
- Access control lists
- CloudFront distributions
Expand Down Expand Up @@ -46,40 +47,50 @@ sidebar_label: Amazon Web Services
- OpenSearch domains

## Komiser configurations
From Komiser v3 onwards we specify our komiser configuration by way of a `config.toml` file. If you place the config.toml file in the same directory as the Komiser binary then it will pick it up by default, if it's placed in a different location, then we need to pass in the path using the `--config` flag.

From Komiser v3 onwards we specify our komiser configuration by way of a `config.toml` file. If you place the config.toml file in the same directory as the Komiser binary then it will pick it up by default, if it's placed in a different location, then we need to pass in the path using the `--config` flag.

Example `start` command

```
komiser start
komiser start
```

## Config.toml file

---
![config-file](../../static/img/config-komiser.png)

![config-file](/img/config-komiser.png)
Komiser now supports multiple cloud accounts by default. Account configuration is done through the config.toml file, using either the `ENVIRONMENT_VARIABLES` or `CREDENTIALS_FILE`.

### Data persistence

Choose between these two methods of persisting your AWS Account data.

#### Postgres

**Add to config.toml file**

```
[postgres]
uri="postgres://postgres:komiser@localhost:5432/komiser?sslmode=disable"
```

Note: For Postgres, Komiser anticipates the existence of a role `postgres` and a database `komiser` on the local Postgres server.

#### SQLite

```
# Add to config.toml file

[sqlite]
file = "komiser.db"
```

*The reason for this external data persistence is to improve the filtering, sorting and tagging management experience making it faster and smoother. It also serves as a standalone DB which you are free to query and visualize as you see fit.*
_The reason for this external data persistence is to improve the filtering, sorting and tagging management experience making it faster and smoother. It also serves as a standalone DB which you are free to query and visualize as you see fit._

### Example config.toml

```
[[aws]]
name="sandbox"
Expand All @@ -105,10 +116,10 @@ uri="postgres://postgres:komiser@localhost:5432/komiser?sslmode=disable"

## Configuring Credentials

When using the CLI you'll generally need your AWS credentials to authenticate with AWS services. Komiser supports multiple methods of providing these credentials. By default the CLI will source credentials automatically from its default credential chain.
When using the CLI you'll generally need your AWS credentials to authenticate with AWS services. Komiser supports multiple methods of providing these credentials. By default the CLI will source credentials automatically from its default credential chain.
In the `source` section of the cloud profile inside the `config.toml` file we can choose between `ENVIRONMENT_VARIABLES` or `CREDENTIALS_FILE`

* Environment Credentials - Set of environment variables that are useful when sub processes are created for specific roles. Useful for local development
- Environment Credentials - Set of environment variables that are useful when sub processes are created for specific roles. Useful for local development

```
[[gcp]]
Expand All @@ -117,7 +128,7 @@ source="ENVIRONMENT_VARIABLES"
profile="production"
```

* EC2 Instance Role Credentials - Use EC2 Instance Role to assign credentials to application running on an EC2 instance. This removes the need to manage credential files in production.
- EC2 Instance Role Credentials - Use EC2 Instance Role to assign credentials to application running on an EC2 instance. This removes the need to manage credential files in production.

```
[[aws]]
Expand All @@ -126,10 +137,13 @@ source="CREDENTIALS_FILE"
path=./path/to/credentials/file
profile="default"
```

### Credentials file
It is not recommended to add your AWS Access and Secret Access key in the credentials file in `production`. The most secure way of authentication is by using temporary credentials through IAM roles.

It is not recommended to add your AWS Access and Secret Access key in the credentials file in `production`. The most secure way of authentication is by using temporary credentials through IAM roles.

Example

```
[ADMIN-account]
region = eu-central-1
Expand All @@ -144,50 +158,61 @@ role_session_name = komiser_session
```

## Local Komiser CLI

---

### Create an IAM user
* Create an IAM user with the following IAM [policy](https://raw.githubusercontent.com/mlabouardy/komiser/master/policy.json):

- Create an IAM user with the following IAM [policy](https://raw.githubusercontent.com/mlabouardy/komiser/master/policy.json):

```
wget https://raw.githubusercontent.com/mlabouardy/komiser/master/policy.json
```

### Add user credentials locally
* Add your **Access Key ID** and **Secret Access Key** to *~/.aws/credentials* using this format

```
- Add your **Access Key ID** and **Secret Access Key** to _~/.aws/credentials_ using this format

```
[default]
aws_access_key_id = <access key id>
aws_secret_access_key = <secret access key>
region = <AWS region>
```

### Run Komiser CLI
* That should be it. Try out the following from your command prompt to start the server:

- That should be it. Try out the following from your command prompt to start the server:

```
komiser start
```

## Komiser CLI (Restricted regions)

---
There might be times when you would like to specifically restrict the scope of Komiser's reach to a specific cloud region or a subset of them. This can be useful for organizations with tight SCPs in place.
Add the `--regions` flag to the `Komiser start` command and seperate the regions with commas.

There might be times when you would like to specifically restrict the scope of Komiser's reach to a specific cloud region or a subset of them. This can be useful for organizations with tight SCPs in place.
Add the `--regions` flag to the `Komiser start` command and seperate the regions with commas.

```
komiser start --regions eu-central-1,us-east-1,ap-southeast-1
komiser start --regions eu-central-1,us-east-1,ap-southeast-1

```
> Note that all AWS Global resources in your account will be retrieved even using the `--regions`
```

> Note that all AWS Global resources in your account will be retrieved even using the `--regions`

## EKS installation (single account)

---

Link to [repository](https://github.com/tailwarden/helm/blob/master/README.md#configuration-single-aws-account)

We will be using the official Komiser [Helm Chart](https://github.com/tailwarden/helm#configuration-multiple-aws-accounts) to deploy Komiser to our EKS cluster.
We will be using the official Komiser [Helm Chart](https://github.com/tailwarden/helm#configuration-multiple-aws-accounts) to deploy Komiser to our EKS cluster.

### Prerequisite

* [Helm](https://helm.sh/docs/intro/install/) installed locally
- [Helm](https://helm.sh/docs/intro/install/) installed locally

### Create and IAM OIDC provider for your cluster

Expand All @@ -213,7 +238,7 @@ We will be using the official Komiser [Helm Chart](https://github.com/tailwarden

1. Open the IAM console at [https://console\.aws\.amazon\.com/iam/](https://console.aws.amazon.com/iam/)\.

1. In the left navigation pane, choose **Policies** and then choose **Create policy**\.
1. In the left navigation pane, choose **Policies** and then choose **Create policy**\.

1. Choose the **JSON** tab\.

Expand Down Expand Up @@ -257,7 +282,7 @@ We will be using the official Komiser [Helm Chart](https://github.com/tailwarden

`NOTE: Make sure to substitute ${NAMESPACE} for the namespace you will deploy the helm chart in. If deployed in any other namespace, you will see sts:AssumeRoleWithWebIdentity failure messages in the pod logs.`

1. Run the modified code block from the previous step to create a file named *`trust.json`*\.
1. Run the modified code block from the previous step to create a file named _`trust.json`_\.

1. Run the following AWS CLI command to create the role\. Replace `my-iam-role` with a name for your IAM role, and `my-role-description` with a description for your role\.

Expand All @@ -274,6 +299,7 @@ We will be using the official Komiser [Helm Chart](https://github.com/tailwarden
### Update ServiceAccount

Update [templates/service-account.yaml](https://github.com/tailwarden/helm/blob/master/templates/service-account.yaml) with the IAM role you've created previously

```
apiVersion: v1
kind: ServiceAccount
Expand All @@ -284,6 +310,7 @@ metadata:
```

### Add custom values to config.toml file in [configMap template](https://github.com/tailwarden/helm/blob/master/templates/configmap-awsaccounts.yaml)

```
[[aws]]
name="NAME"
Expand All @@ -294,12 +321,13 @@ profile="default"
[sqlite]
file="komiser.db"

// or
// or
// [postgres]
// uri="postgres://postgres:komiser@localhost:5432/komiser?sslmode=disable"
```

### Installing the chart

To install the chart:

```bash
Expand Down Expand Up @@ -334,14 +362,16 @@ The above command deploys Komiser on the Kubernetes cluster in the default confi
</div>

## Multiple account EKS (Helm chart) installation

---

Link to [README](https://github.com/tailwarden/helm/blob/master/README.md#configuration-multiple-aws-accounts) file with step by step instructions.

Steps for a container to access the resources in multiple AWS accounts.
We are working with two example clusters, ADMIN and DEV cluster.

Solution diagram:
![solutions-diagram](../../static/img/multi-account-graph.png)
![solutions-diagram](/img/multi-account-graph.png)

### Create and IAM OIDC provider for your cluster

Expand Down Expand Up @@ -369,19 +399,21 @@ Solution diagram:

2. Open the IAM console at [https://console\.aws\.amazon\.com/iam/](https://console.aws.amazon.com/iam/)\.

1. In the left navigation pane, choose **Identity Providers** under **Access management**\.
3. In the left navigation pane, choose **Identity Providers** under **Access management**\.

1. To create a provider, choose **Add Provider**\.
4. To create a provider, choose **Add Provider**\.

1. For **Provider Type**, choose **OpenID Connect**\.
5. For **Provider Type**, choose **OpenID Connect**\.

1. For **Provider URL**, paste the ADMIN OIDC issuer URL, and then choose **Get thumbprint**\.
6. For **Provider URL**, paste the ADMIN OIDC issuer URL, and then choose **Get thumbprint**\.

1. For **Audience**, enter `sts.amazonaws.com` and choose **Add provider**\.
7. For **Audience**, enter `sts.amazonaws.com` and choose **Add provider**\.

### Create A `DEV IAM role`
* Add the recommended [Komiser policy](https://github.com/tailwarden/komiser/blob/master/policy.json)
* Create a Trust Relathionship with the `ADMIN` role (once it's created)

- Add the recommended [Komiser policy](https://github.com/tailwarden/komiser/blob/master/policy.json)
- Create a Trust Relathionship with the `ADMIN` role (once it's created)

```
{
"Version": "2012-10-17",
Expand All @@ -399,8 +431,10 @@ Solution diagram:
```

### Create an `ADMIN IAM role`
* Create a [role](#create-iam-role-and-attach-a-komiser-iam-policy) with the same configuration as above.
* Additionally attach the policy to assume the `DEV` role

- Create a [role](#create-iam-role-and-attach-a-komiser-iam-policy) with the same configuration as above.
- Additionally attach the policy to assume the `DEV` role

```
{
"Version": "2012-10-17",
Expand All @@ -415,6 +449,7 @@ Solution diagram:
```

### Add the `ADMIN` role to the ServiceAccount

Add your values for `ACCOUNT_ID` and `ROLE_Name`

```
Expand Down Expand Up @@ -463,22 +498,22 @@ metadata:
3. Have a valid credentials file that the deployment has access to.

```
apiVersion: apps/v1
kind: Deployment
metadata:
apiVersion: apps/v1
kind: Deployment
metadata:
name: komiser
spec:
selector:
matchLabels:
selector:
matchLabels:
app: komiser
template:
metadata:
template:
metadata:
name: komiser
labels:
labels:
app: komiser
spec:
serviceAccountName: komiser
containers:
containers:
- name: {{ .Chart.Name }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
Expand All @@ -495,3 +530,4 @@ metadata:
- name: test-volume
configMap:
name: aws-configmap
```
Loading