Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add validator host ID to allow authn-k8s config to be validated #135

Open
diverdane opened this issue Apr 19, 2021 · 0 comments
Open

Add validator host ID to allow authn-k8s config to be validated #135

diverdane opened this issue Apr 19, 2021 · 0 comments

Comments

@diverdane
Copy link
Contributor

Is your feature request related to a problem? Please describe.

It would be very helpful to have a special validator host ID configured in Conjur security policy
that could be used to validate the Kubernetes authenticator configuration e.g. after preparing
the Kubernetes cluster with authenticator RBAC objects, or after preparing an application
Namespace with a Conjur connection ConfigMap.

The validator host ID could be for a low-privileged host, e.g. it would not require access to
application secrets in order to perform authentication validation.

The validator host would need to be configured with an Kubernetes identity annotation
for the Namespace that it resides in, since the authenticator will authenticate based on
at least the Namespace of a Pod doing an authentication request. For this, the security
policy should assume the Namespace to which Conjur is deployed.

Describe the solution you would like

A special validator host ID is added to the demo security policy to allow a validation Pod
to perform basic authentication with Conjur so that authn-k8s configuration can be validated.

Describe alternatives you have considered

Additional context

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant