update kubeflow dip-catalog

2025-01-13 02:31:27 +00:00
parent 1dc1181a03
commit 5451f16d72
1959 changed files with 602337 additions and 0 deletions
@@ -0,0 +1,19 @@
+# Kubernetes M2M Authentication with Istio and RequestAuthentication
+
+## Overview
+
+This kustomize component enables M2M (Machine-to-Machine) authentication in Kubernetes, using
+Istio and the `RequestAuthentication` object. It configures Istio to trust JWTs (JSON Web Tokens)
+in Authorization Bearer tokens when the JWT issuer matches the one in `RequestAuthentication`. The
+default setup uses Kubernetes' self-served OIDC issuer with self-signed certificates.
+
+In Kubernetes clusters managed by platform providers, the OIDC issuer is usually managed by the
+provider and served behind publicly trusted certificates. In these cases, it's advisable to use
+the platform-managed Kubernetes OIDC issuer in the `RequestAuthentication` for seamless integration
+and authentication compliance with the platform's security standards.
+
+For scenarios where the OIDC issuer is served behind self-signed certificates, the kustomize
+overlay using this component should include the `common/oidc-client/oauth2-proxy/components/configure-self-signed-kubernetes-oidc-issuer`
+component. This additional configuration is necessary to handle the self-signed nature of the
+certificates. This setup is the default in the Kustomize overlay defined in `common/oidc-client/oauth2-proxy/overlays/m2m-self-signed`,
+which is tailored for environments with self-signed OIDC issuers.
@@ -0,0 +1,29 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+- requestauthentication.yaml
+
+configMapGenerator:
+- name: istio-m2m-params
+  envs:
+  - m2m.env
+
+replacements:
+- source:
+    kind: ConfigMap
+    version: v1
+    name: istio-m2m-params
+    fieldPath: data.M2M_TOKEN_ISSUER
+  targets:
+  - fieldPaths:
+    - spec.jwtRules.0.issuer
+    select:
+      group: security.istio.io
+      version: v1beta1
+      kind: RequestAuthentication
+      name: m2m-token-issuer
+      namespace: istio-system
+
+configurations:
+- params.yaml
@@ -0,0 +1 @@
+M2M_TOKEN_ISSUER=issuer
@@ -0,0 +1,21 @@
+apiVersion: v1
+data:
+  M2M_TOKEN_ISSUER: issuer
+kind: ConfigMap
+metadata:
+  name: istio-m2m-params-gfd5m8bd92
+---
+apiVersion: security.istio.io/v1beta1
+kind: RequestAuthentication
+metadata:
+  name: m2m-token-issuer
+  namespace: istio-system
+spec:
+  jwtRules:
+  - forwardOriginalToken: true
+    issuer: issuer
+    outputClaimToHeaders:
+    - claim: sub
+      header: x-auth-request-user
+    - claim: sub
+      header: kubeflow-userid
@@ -0,0 +1,3 @@
+varReference:
+- path: spec/jwtRules/issuer
+  kind: RequestAuthentication
@@ -0,0 +1,14 @@
+apiVersion: security.istio.io/v1beta1
+kind: RequestAuthentication
+metadata:
+  name: m2m-token-issuer
+  namespace: istio-system
+spec:
+  jwtRules:
+    - forwardOriginalToken: true
+      issuer: M2M_TOKEN_ISSUER_PLACEHOLDER
+      outputClaimToHeaders:
+        - claim: sub
+          header: x-auth-request-user
+        - claim: email
+          header: kubeflow-userid