Skip to content

Commit d8461ca

Browse files
author
Yoan Moscatelli
committed
🔒 first iteration ingress hardenning
1 parent 75ed313 commit d8461ca

File tree

10 files changed

+156
-28
lines changed

10 files changed

+156
-28
lines changed

‎CHANGELOG.md

+3
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22

33
## Release 128.0.1 (in development)
44

5+
- Only use modern Ciphers in Ingress configuration
6+
(PR[#4488](https://github.com/scality/metalk8s/pull/4488))
7+
58
## Release 128.0.0
69

710
### Enhancements

‎buildchain/buildchain/codegen.py

+12-7
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ def codegen_chart_fluent_bit() -> types.TaskDict:
128128
def codegen_chart_ingress_nginx() -> types.TaskDict:
129129
"""Generate the SLS file for NGINX Ingress using the chart render script."""
130130
chart_dir = constants.CHART_ROOT / "ingress-nginx"
131+
namespace = "metalk8s-ingress"
131132
actions = []
132133
file_dep = list(utils.git_ls(chart_dir))
133134
file_dep.append(constants.CHART_RENDER_SCRIPT)
@@ -136,12 +137,13 @@ def codegen_chart_ingress_nginx() -> types.TaskDict:
136137
target_sls = (
137138
constants.ROOT / "salt/metalk8s/addons/nginx-ingress/deployed/chart.sls"
138139
)
139-
value_file = constants.CHART_ROOT / "ingress-nginx.yaml"
140+
name = "ingress-nginx"
141+
value_file = constants.CHART_ROOT / f"{name}.yaml"
140142
actions.append(
141143
doit.action.CmdAction(
142-
f"{constants.CHART_RENDER_CMD} ingress-nginx {value_file} {chart_dir} "
143-
f"--namespace metalk8s-ingress --remove-manifest ConfigMap "
144-
f"ingress-nginx-controller "
144+
f"{constants.CHART_RENDER_CMD} {name} {value_file} {chart_dir} "
145+
f"--namespace {namespace} --remove-manifest ConfigMap "
146+
f"{name}-controller "
145147
f"--output {target_sls}",
146148
cwd=constants.ROOT,
147149
)
@@ -154,11 +156,14 @@ def codegen_chart_ingress_nginx() -> types.TaskDict:
154156
/ "salt/metalk8s/addons/nginx-ingress-control-plane"
155157
/ "deployed/chart.sls"
156158
)
157-
value_file = constants.CHART_ROOT / "ingress-nginx-control-plane.yaml"
159+
name = "ingress-nginx-control-plane"
160+
value_file = constants.CHART_ROOT / f"{name}.yaml"
158161
actions.append(
159162
doit.action.CmdAction(
160-
f"{constants.CHART_RENDER_CMD} ingress-nginx-control-plane {value_file} "
161-
f"{chart_dir} --namespace metalk8s-ingress --output {target_sls}",
163+
f"{constants.CHART_RENDER_CMD} {name} {value_file} {chart_dir} "
164+
f"--namespace {namespace} --remove-manifest ConfigMap "
165+
f"{name}-controller "
166+
f"--output {target_sls}",
162167
cwd=constants.ROOT,
163168
)
164169
)

‎buildchain/buildchain/salt_tree.py

+10
Original file line numberDiff line numberDiff line change
@@ -443,6 +443,16 @@ def task(self) -> types.TaskDict:
443443
Path("salt/metalk8s/addons/nginx-ingress-control-plane/certs/server.sls"),
444444
Path("salt/metalk8s/addons/nginx-ingress-control-plane/deployed/init.sls"),
445445
Path("salt/metalk8s/addons/nginx-ingress-control-plane/deployed/chart.sls"),
446+
Path("salt/metalk8s/addons/nginx-ingress-control-plane/deployed/namespace.sls"),
447+
Path("salt/metalk8s/addons/nginx-ingress-control-plane/deployed/config-map.sls"),
448+
Path(
449+
"salt/metalk8s/addons/nginx-ingress-control-plane/deployed/",
450+
"service-configuration.sls",
451+
),
452+
Path(
453+
"salt/metalk8s/addons/nginx-ingress-control-plane/config/",
454+
"ingress-controller.yaml.j2",
455+
),
446456
Path("salt/metalk8s/addons/nginx-ingress-control-plane/deployed/tls-secret.sls"),
447457
Path("salt/metalk8s/backup/certs/ca.sls"),
448458
Path("salt/metalk8s/backup/certs/server.sls"),

‎docs/operation/cluster_and_service_configuration.rst

+49-3
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,28 @@ under the key ``data.config\.yaml``:
163163
metalk8s-ingress-controller-config
164164
165165
166+
The following documentation is not exhaustive and is just here to give
167+
some hints on basic usage, for more details or advanced
168+
configuration, see the official `Nginx Ingress Controller documentation`_.
169+
170+
.. _Nginx Ingress Controller documentation: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
171+
172+
Control plane Ingress Controller Configuration Customization
173+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
174+
175+
Same as the Workload plane Ingress Controller, Control Plane can be overridden
176+
by editing its Cluster and Service ConfigMap
177+
``metalk8s-ingress-control-plane-controller-config``
178+
in namespace ``metalk8s-ingress``
179+
under the key ``data.config\.yaml``:
180+
181+
.. code-block:: shell
182+
183+
root@bootstrap $ kubectl --kubeconfig /etc/kubernetes/admin.conf \
184+
edit configmap -n metalk8s-ingress \
185+
metalk8s-ingress-control-plane-controller-config
186+
187+
166188
The following documentation is not exhaustive and is just here to give
167189
some hints on basic usage, for more details or advanced
168190
configuration, see the official `Nginx Ingress Controller documentation`_.
@@ -186,6 +208,29 @@ HTTP2 can be disabled by setting ``use-http2`` to ``false``:
186208
config:
187209
use-http2: "false"
188210
211+
Modify authorized Ciphers
212+
"""""""""""""""""""""""""
213+
214+
Strong cipher configurations may not allow legacy user agents or user agents
215+
with weak configurations to connect to your site. If your server must also
216+
pass to a legacy upstream server, this may prevent it from being able to
217+
negotiate a cipher upstream.
218+
219+
If you use an old client that does not support modern ciphers, you can use the
220+
ones provided by the CIS Nginx Benchmark for example:
221+
222+
.. code-block:: yaml
223+
224+
apiVersion: v1
225+
kind: ConfigMap
226+
data:
227+
config.yaml: |-
228+
apiVersion: addons.metalk8s.scality.com/v1alpha2
229+
kind: IngressControllerConfig
230+
spec:
231+
config:
232+
ssl-ciphers: "ALL:!EXP:!NULL:!ADH:!LOW:!SSLv2:!SSLv3:!MD5:!RC4"
233+
189234
Applying configuration
190235
""""""""""""""""""""""
191236

@@ -195,9 +240,10 @@ then be applied with Salt.
195240
.. parsed-literal::
196241
197242
root\@bootstrap $ kubectl exec --kubeconfig /etc/kubernetes/admin.conf \\
198-
-n kube-system -c salt-master salt-master-bootstrap -- \\
199-
salt-run state.sls \\
200-
metalk8s.addons.nginx-ingress.deployed \\
243+
$(kubectl --kubeconfig /etc/kubernetes/admin.conf \\
244+
get pod -n kube-system -l app=salt-master -o name) \\
245+
-n kube-system -c salt-master -- \\
246+
salt-run state.sls metalk8s.addons.nginx-ingress.deployed \\
201247
saltenv=metalk8s-|version|
202248
203249

‎salt/metalk8s/addons/nginx-ingress-control-plane/config/ingress-controller.yaml.j2

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!jinja|yaml
2+
3+
# Defaults for configuration of Ingress Controller
4+
apiVersion: addons.metalk8s.scality.com/v1alpha2
5+
kind: IngressControllerConfig
6+
spec:
7+
config:
8+
allow-snippet-annotations: 'true'
9+
hide-headers: 'Server,X-Powered-By'
10+
ssl-ciphers: 'EECDH+AESGCM:EDH+AESGCM'
11+
ssl-protocols: 'TLSv1.2 TLSv1.3'

‎salt/metalk8s/addons/nginx-ingress-control-plane/deployed/chart.sls

-17
Original file line numberDiff line numberDiff line change
@@ -23,23 +23,6 @@ metadata:
2323
name: ingress-nginx-control-plane
2424
namespace: metalk8s-ingress
2525
---
26-
apiVersion: v1
27-
data:
28-
allow-snippet-annotations: 'true'
29-
kind: ConfigMap
30-
metadata:
31-
labels:
32-
app.kubernetes.io/component: controller
33-
app.kubernetes.io/instance: ingress-nginx-control-plane
34-
app.kubernetes.io/managed-by: salt
35-
app.kubernetes.io/name: ingress-nginx
36-
app.kubernetes.io/part-of: metalk8s
37-
app.kubernetes.io/version: 1.10.3
38-
helm.sh/chart: ingress-nginx-4.10.3
39-
heritage: metalk8s
40-
name: ingress-nginx-control-plane-controller
41-
namespace: metalk8s-ingress
42-
---
4326
apiVersion: rbac.authorization.k8s.io/v1
4427
kind: ClusterRole
4528
metadata:

‎salt/metalk8s/addons/nginx-ingress-control-plane/deployed/config-map.sls

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{%- set ingress_control_plane_controller_defaults = salt.slsutil.renderer(
2+
'salt://metalk8s/addons/nginx-ingress-control-plane/config/ingress-controller.yaml.j2', saltenv=saltenv
3+
)
4+
%}
5+
6+
{%- set ingress_control_plane_controller = salt.metalk8s_service_configuration.get_service_conf(
7+
'metalk8s-ingress', 'metalk8s-ingress-control-plane-controller-config', ingress_control_plane_controller_defaults
8+
)
9+
%}
10+
11+
Create Control Plane Ingress Controller configuration Config Map:
12+
metalk8s_kubernetes.object_present:
13+
- manifest:
14+
apiVersion: v1
15+
kind: ConfigMap
16+
metadata:
17+
name: ingress-nginx-control-plane-controller
18+
namespace: metalk8s-ingress
19+
labels:
20+
app.kubernetes.io/component: controller
21+
app.kubernetes.io/instance: ingress-nginx-control-plane
22+
app.kubernetes.io/managed-by: salt
23+
app.kubernetes.io/name: ingress-nginx
24+
app.kubernetes.io/part-of: metalk8s
25+
heritage: metalk8s
26+
annotations:
27+
ingressclass.kubernetes.io/is-default-class: "true"
28+
data:
29+
{{ ingress_control_plane_controller.spec.config | yaml(False) | indent(10) }}

‎salt/metalk8s/addons/nginx-ingress-control-plane/deployed/init.sls

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
include:
2-
- metalk8s.addons.nginx-ingress.deployed.namespace
32
- .tls-secret
43
- .chart
4+
- .service-configuration
5+
- .config-map

‎salt/metalk8s/addons/nginx-ingress-control-plane/deployed/service-configuration.sls

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
include:
2+
- .namespace
3+
4+
{%- set namespace = 'metalk8s-ingress' %}
5+
{%- set name = 'metalk8s-ingress-control-plane-controller-config' %}
6+
7+
{%- set ingress_service_config = salt.metalk8s_kubernetes.get_object(
8+
kind='ConfigMap',
9+
apiVersion='v1',
10+
namespace=namespace,
11+
name=name
12+
)
13+
%}
14+
15+
{%- if ingress_service_config is none %}
16+
17+
Create Ingress ServiceConfiguration (metalk8s-ingress/metalk8s-ingress-control-plane-controller-config):
18+
metalk8s_kubernetes.object_present:
19+
- manifest:
20+
apiVersion: v1
21+
kind: ConfigMap
22+
metadata:
23+
name: {{ name }}
24+
namespace: {{ namespace }}
25+
data:
26+
config.yaml: |-
27+
apiVersion: addons.metalk8s.scality.com/v1alpha2
28+
kind: IngressControllerConfig
29+
spec: {}
30+
31+
32+
{%- else %}
33+
34+
Ingress ServiceConfiguration already exists:
35+
test.succeed_without_changes: []
36+
37+
{%- endif %}

‎salt/metalk8s/addons/nginx-ingress/config/ingress-controller.yaml.j2

+3
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,6 @@ kind: IngressControllerConfig
66
spec:
77
config:
88
allow-snippet-annotations: 'true'
9+
hide-headers: 'Server,X-Powered-By'
10+
ssl-ciphers: 'EECDH+AESGCM:EDH+AESGCM'
11+
ssl-protocols: 'TLSv1.2 TLSv1.3'

0 commit comments

Comments
 (0)