Skip to content

Commit 4cfbdf1

Browse files
sgayangisgayangi
committed
Add documentation on roles and rolebindings
1 parent 5da05cc commit 4cfbdf1

File tree

5 files changed

+683
-6
lines changed

5 files changed

+683
-6
lines changed

‎en/docs/assets/files/configure-permissions/apk-specific-permission.yaml

+203
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: {{ .Values.wso2.apk.auth.roleName }}
5+
namespace: {{ .Release.Namespace }}
6+
rules:
7+
- apiGroups: [""]
8+
resources: ["services", "configmaps", "secrets"]
9+
verbs: ["get", "list", "watch", "update", "delete", "create"]
10+
- apiGroups: ["gateway.networking.k8s.io"]
11+
resources: ["httproutes", "grpcroutes"]
12+
verbs: ["get", "list", "watch", "update", "delete", "create"]
13+
- apiGroups: ["gateway.networking.k8s.io"]
14+
resources: ["httproutes/status"]
15+
verbs: ["get", "patch", "update"]
16+
- apiGroups: ["dp.wso2.com"]
17+
resources: ["apis"]
18+
verbs: ["get", "list", "watch", "update", "delete", "create", "patch"]
19+
- apiGroups: ["dp.wso2.com"]
20+
resources: ["apis/finalizers"]
21+
verbs: ["update"]
22+
- apiGroups: ["dp.wso2.com"]
23+
resources: ["apis/status"]
24+
verbs: ["get", "patch", "update"]
25+
- apiGroups: ["dp.wso2.com"]
26+
resources: ["authentications"]
27+
verbs: ["get", "list", "watch", "update", "delete", "create"]
28+
- apiGroups: ["dp.wso2.com"]
29+
resources: ["authentications/finalizers"]
30+
verbs: ["update"]
31+
- apiGroups: ["dp.wso2.com"]
32+
resources: ["authentications/status"]
33+
verbs: ["get", "patch", "update"]
34+
- apiGroups: ["dp.wso2.com"]
35+
resources: ["backends"]
36+
verbs: ["get", "list", "watch", "update", "delete", "create"]
37+
- apiGroups: ["dp.wso2.com"]
38+
resources: ["backends/finalizers"]
39+
verbs: ["update"]
40+
- apiGroups: ["dp.wso2.com"]
41+
resources: ["backends/status"]
42+
verbs: ["get", "patch", "update"]
43+
- apiGroups: ["dp.wso2.com"]
44+
resources: ["apipolicies"]
45+
verbs: ["get", "list", "watch", "update", "delete", "create"]
46+
- apiGroups: ["dp.wso2.com"]
47+
resources: ["apipolicies/finalizers"]
48+
verbs: ["update"]
49+
- apiGroups: ["dp.wso2.com"]
50+
resources: ["grpcroutes"]
51+
verbs: ["get", "list", "watch", "update", "delete", "create"]
52+
- apiGroups: ["dp.wso2.com"]
53+
resources: ["grpcroutes/finalizers"]
54+
verbs: ["update"]
55+
- apiGroups: ["dp.wso2.com"]
56+
resources: ["grpcroutes/status"]
57+
verbs: ["get", "patch", "update"]
58+
- apiGroups: ["dp.wso2.com"]
59+
resources: ["apipolicies/status"]
60+
verbs: ["get", "patch", "update"]
61+
- apiGroups: ["dp.wso2.com"]
62+
resources: ["interceptorservices"]
63+
verbs: ["get", "list", "watch", "update", "delete", "create"]
64+
- apiGroups: ["dp.wso2.com"]
65+
resources: ["interceptorservices/finalizers"]
66+
verbs: ["update"]
67+
- apiGroups: ["dp.wso2.com"]
68+
resources: ["interceptorservices/status"]
69+
verbs: ["get", "patch", "update"]
70+
- apiGroups: ["dp.wso2.com"]
71+
resources: ["scopes"]
72+
verbs: ["get", "list", "watch", "update", "delete", "create"]
73+
- apiGroups: ["dp.wso2.com"]
74+
resources: ["scopes/finalizers"]
75+
verbs: ["update"]
76+
- apiGroups: ["dp.wso2.com"]
77+
resources: ["scopes/status"]
78+
verbs: ["get", "patch", "update"]
79+
- apiGroups: ["dp.wso2.com"]
80+
resources: ["ratelimitpolicies"]
81+
verbs: ["get", "list", "watch", "update", "delete", "create"]
82+
- apiGroups: ["dp.wso2.com"]
83+
resources: ["ratelimitpolicies/finalizers"]
84+
verbs: ["update"]
85+
- apiGroups: ["dp.wso2.com"]
86+
resources: ["ratelimitpolicies/status"]
87+
verbs: ["get", "patch", "update"]
88+
- apiGroups: ["dp.wso2.com"]
89+
resources: ["airatelimitpolicies"]
90+
verbs: ["get", "list", "watch", "update", "delete", "create"]
91+
- apiGroups: ["dp.wso2.com"]
92+
resources: ["airatelimitpolicies/finalizers"]
93+
verbs: ["update"]
94+
- apiGroups: ["dp.wso2.com"]
95+
resources: ["airatelimitpolicies/status"]
96+
verbs: ["get", "patch", "update"]
97+
- apiGroups: ["coordination.k8s.io"]
98+
resources: ["leases"]
99+
verbs: ["get", "list", "watch", "update", "patch", "create", "delete"]
100+
- apiGroups: ["dp.wso2.com"]
101+
resources: ["tokenissuers"]
102+
verbs: ["get", "list", "watch", "update", "delete", "create"]
103+
- apiGroups: ["dp.wso2.com"]
104+
resources: ["tokenissuers/finalizers"]
105+
verbs: ["update"]
106+
- apiGroups: ["dp.wso2.com"]
107+
resources: ["tokenissuers/status"]
108+
verbs: ["get", "patch", "update"]
109+
- apiGroups: ["dp.wso2.com"]
110+
resources: ["backendjwts"]
111+
verbs: ["get", "list", "watch", "update", "delete", "create"]
112+
- apiGroups: ["dp.wso2.com"]
113+
resources: ["backendjwts/finalizers"]
114+
verbs: ["update"]
115+
- apiGroups: ["dp.wso2.com"]
116+
resources: ["backendjwts/status"]
117+
verbs: ["get", "patch", "update"]
118+
- apiGroups: ["dp.wso2.com"]
119+
resources: ["gqlroutes"]
120+
verbs: ["get", "list", "watch", "update", "delete", "create"]
121+
- apiGroups: ["dp.wso2.com"]
122+
resources: ["gqlroutes/finalizers"]
123+
verbs: ["update"]
124+
- apiGroups: ["dp.wso2.com"]
125+
resources: ["gqlroutes/status"]
126+
verbs: ["get", "patch", "update"]
127+
- apiGroups: ["dp.wso2.com"]
128+
resources: ["aiproviders"]
129+
verbs: ["get", "list", "watch", "update", "delete", "create"]
130+
- apiGroups: ["dp.wso2.com"]
131+
resources: ["aiproviders/status"]
132+
verbs: ["get", "patch", "update"]
133+
- apiGroups: ["dp.wso2.com"]
134+
resources: ["aiproviders/finalizers"]
135+
verbs: ["update"]
136+
- apiGroups: ["cp.wso2.com"]
137+
resources: ["applications"]
138+
verbs: ["get", "list", "watch", "update", "delete", "create"]
139+
- apiGroups: ["cp.wso2.com"]
140+
resources: ["applications/finalizers"]
141+
verbs: ["update"]
142+
- apiGroups: ["cp.wso2.com"]
143+
resources: ["applications/status"]
144+
verbs: ["get", "patch", "update"]
145+
- apiGroups: ["cp.wso2.com"]
146+
resources: ["subscriptions"]
147+
verbs: ["get", "list", "watch", "update", "delete", "create"]
148+
- apiGroups: ["cp.wso2.com"]
149+
resources: ["subscriptions/finalizers"]
150+
verbs: ["update"]
151+
- apiGroups: ["cp.wso2.com"]
152+
resources: ["subscriptions/status"]
153+
verbs: ["get", "patch", "update"]
154+
- apiGroups: ["cp.wso2.com"]
155+
resources: ["applicationmappings"]
156+
verbs: ["get", "list", "watch", "update", "delete", "create"]
157+
- apiGroups: ["cp.wso2.com"]
158+
resources: ["applicationmappings/finalizers"]
159+
verbs: ["update"]
160+
- apiGroups: ["cp.wso2.com"]
161+
resources: ["applicationmappings/status"]
162+
verbs: ["get", "patch", "update"]
163+
---
164+
apiVersion: rbac.authorization.k8s.io/v1
165+
kind: RoleBinding
166+
metadata:
167+
name: {{ template "apk-helm.resource.prefix" . }}-role-binding
168+
namespace: {{ .Release.Namespace }}
169+
roleRef:
170+
kind: Role
171+
name: {{ .Values.wso2.apk.auth.roleName }}
172+
apiGroup: rbac.authorization.k8s.io
173+
subjects:
174+
- kind: ServiceAccount
175+
name: {{ .Values.wso2.apk.auth.serviceAccountName }}
176+
namespace: {{ .Release.Namespace }}
177+
---
178+
apiVersion: rbac.authorization.k8s.io/v1
179+
kind: ClusterRole
180+
metadata:
181+
name: {{ template "apk-helm.resource.prefix" . }}-gw-cluser-role
182+
namespace: {{ .Release.Namespace }}
183+
rules:
184+
- apiGroups: ["gateway.networking.k8s.io"]
185+
resources: ["gateways", "gatewayclasses"]
186+
verbs: ["get", "list", "watch", "update", "delete", "create"]
187+
- apiGroups: ["gateway.networking.k8s.io"]
188+
resources: ["gateways/status", "gatewayclasses/status"]
189+
verbs: ["get", "patch", "update"]
190+
---
191+
apiVersion: rbac.authorization.k8s.io/v1
192+
kind: ClusterRoleBinding
193+
metadata:
194+
name: {{ template "apk-helm.resource.prefix" . }}-cluster-role-binding
195+
namespace: {{ .Release.Namespace }}
196+
roleRef:
197+
kind: ClusterRole
198+
name: {{ template "apk-helm.resource.prefix" . }}-gw-cluser-role
199+
apiGroup: rbac.authorization.k8s.io
200+
subjects:
201+
- kind: ServiceAccount
202+
name: {{ .Values.wso2.apk.auth.serviceAccountName }}
203+
namespace: {{ .Release.Namespace }}

‎en/docs/setup/cert-manager.md

+122
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
# Configuring Cert-Manager in Custom Scenarios
2+
3+
In certain scenarios, you may already have **cert-manager** installed or need to install it in a different namespace. This guide outlines the steps to configure **APK cert-manager** in such cases.
4+
5+
## 1. Ensure Cert-Manager is Installed
6+
7+
Before proceeding, ensure that your **cert-manager** is installed and running in its own namespace. You can refer to the <a href="https://cert-manager.io/docs/installation/" target="_blank">official cert-manager documentation </a> for this.
8+
9+
## 2. Create the Namespace for APK
10+
11+
We will use this namespace to install APK. For this guide, we will create a namespace named `apk`. Run the following command:
12+
13+
```sh
14+
kubectl create ns apk
15+
```
16+
17+
## 3. Create an Issuer for Cert-Manager in the APK namespace
18+
19+
Create an Issuer required for cert-manager by applying the following configuration:
20+
```
21+
apiVersion: cert-manager.io/v1
22+
kind: Issuer
23+
metadata:
24+
name: custom-issuer
25+
namespace: apk
26+
spec:
27+
ca:
28+
secretName: apk-root-certificate
29+
```
30+
31+
You can obtain the <a href="../../assets/files/cert-manager/issuer.yaml" target="_blank" download>issuer.yaml</a> file here.
32+
33+
!!! note
34+
### Why Use an Issuer Instead of a ClusterIssuer?
35+
36+
By default, APK installation comes with a ClusterIssuer, which operates cluster-wide. However, the ClusterIssuer looks for the secret named `apk-root-certificate` in the namespace where the cert-manager is installed, whereas APK creates the secret in its own namespace.
37+
38+
There are two ways to fix this.
39+
40+
1. Modify the cert-manager installation by forcing the ClusterIssuer to check the APK namespace, as in the <a href="https://cert-manager.io/docs/configuration/#cluster-resource-namespace" target="_blank">official cert-manager documentation</a>.
41+
42+
2. To avoid modifying cert-manager’s installation, **create an Issuer instead**, which will look for secrets in its own namespace. Then it can correctly reference the secret containing the root certificate.
43+
44+
We will proceed with the **second method** in this guide.
45+
46+
## 4. Apply the Issuer
47+
48+
Run the following command to apply the issuer in the apk namespace:
49+
50+
=== "Command"
51+
```
52+
kubectl apply -f issuer.yaml -n apk
53+
```
54+
=== "Format"
55+
```
56+
kubectl apply -f <path-to-issuer.yaml-file> -n <namespace>
57+
```
58+
59+
At this stage, if you run
60+
=== "Command"
61+
```
62+
kubectl describe issuer custom-issuer -n apk
63+
```
64+
=== "Format"
65+
```
66+
kubectl describe <issuer-name> -n <namespace>
67+
```
68+
69+
it may show a "False" Ready status. This is expected, as the root certificate secret is not created yet. The secret will be generated when APK is installed.
70+
71+
## 5. Update `values.yaml`
72+
73+
Modify the values.yaml file with the following configuration:
74+
```
75+
certmanager:
76+
enabled: false
77+
enableClusterIssuer: false
78+
enableRootCa: true
79+
rootCaSecretName: "apk-root-certificate"
80+
issuerKind: "Issuer"
81+
listeners:
82+
issuerName: "custom-issuer"
83+
issuerKind: "Issuer"
84+
servers:
85+
issuerName: "custom-issuer"
86+
issuerKind: "Issuer"
87+
```
88+
89+
This configuration
90+
91+
- disables the cert-manager included with APK
92+
- creates the root certificate for the Issuer
93+
- refers to an Issuer for the certificate management instead of a ClusterIssuer
94+
95+
## 6. Install APK
96+
97+
Now, install APK using Helm with the modified values.yaml file.
98+
99+
=== "Command"
100+
```
101+
helm install apk wso2apk/apk-helm --version 1.3.0 -f values.yaml -n apk
102+
```
103+
=== "Format"
104+
```
105+
helm install <chart-name> <repository-name>/apk-helm --version <version-of-APK> -f <path-to-values.yaml-file> -n <namespace>
106+
```
107+
108+
## 7. Verify the Certificate Status
109+
110+
Once APK is installed, check the certificates by running:
111+
=== "Command"
112+
```
113+
kubectl get certificates -n apk
114+
```
115+
=== "Format"
116+
```
117+
kubectl get certificates -n <namespace>
118+
```
119+
120+
You should be able to see them having transitioned to the Ready status as follows.
121+
122+
[![Certificates](../../assets/img/cert-manager/certificates.png)](../../assets/img/cert-manager/certificates.png)

0 commit comments

Comments
 (0)