Skip to content

Commit

Permalink
Merge pull request cyberark#2278 from cyberark/johnodon-conjur-name-c…
Browse files Browse the repository at this point in the history
…hange

Updating naming for Conjur editions
  • Loading branch information
jtuttle authored Jul 7, 2021
2 parents 4960a5a + 4592875 commit 7dbdf99
Show file tree
Hide file tree
Showing 12 changed files with 102 additions and 80 deletions.
40 changes: 20 additions & 20 deletions app/domain/authentication/authn_k8s/TROUBLESHOOTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,17 +3,17 @@
## Table of Contents

- [Overview](#overview)
- [Troubleshooting Kubernetes Authentication on Conjur OSS](#troubleshooting-kubernetes-authentication-on-conjur-oss)
* [Prerequisites for Troubleshooting on Conjur OSS](#prerequisites-for-troubleshooting-on-conjur-oss)
* [Before We Begin Troubleshooting: Some Handy Tools and How-Tos](#before-we-begin-troubleshooting-some-handy-tools-and-how-tos)
* [Step-by-Step: Verifying Your Conjur Authentication Configuration](#step-by-step-verifying-your-conjur-authentication-configuration)
* [Some Useful Conjur Commands](#some-useful-conjur-commands)
* [Failure Conditions and How to Troubleshoot](#failure-conditions-and-how-to-troubleshoot)
+ [Conjur server cannot access application Kubernetes Resources](#conjur-server-cannot-access-application-kubernetes-resources)
+ [Conjur Kubernetes Authenticator is not enabled](#conjur-kubernetes-authenticator-is-not-enabled)
+ [Conjur appliance URL is set incorrectly](#conjur-appliance-url-is-set-incorrectly)
+ [Certificate not valid for domain name in Conjur appliance URL](#certificate-not-valid-for-domain-name-in-conjur-appliance-url)
+ [Invalid Response to Certificate Signing Request](#invalid-response-to-certificate-signing-request)
- [Troubleshooting Kubernetes Authentication on Conjur Open Source](#troubleshooting-kubernetes-authentication-on-conjur-open-source)
- [Prerequisites for Troubleshooting on Conjur Open Source](#prerequisites-for-troubleshooting-on-conjur-open-source)
- [Before We Begin Troubleshooting: Some Handy Tools and How-Tos](#before-we-begin-troubleshooting-some-handy-tools-and-how-tos)
- [Step-by-Step: Verifying Your Conjur Authentication Configuration](#step-by-step-verifying-your-conjur-authentication-configuration)
- [Some Useful Conjur Commands](#some-useful-conjur-commands)
- [Failure Conditions and How to Troubleshoot](#failure-conditions-and-how-to-troubleshoot)
- [Conjur server cannot access application Kubernetes Resources](#conjur-server-cannot-access-application-kubernetes-resources)
- [Conjur Kubernetes Authenticator is not enabled](#conjur-kubernetes-authenticator-is-not-enabled)
- [Conjur appliance URL is set incorrectly](#conjur-appliance-url-is-set-incorrectly)
- [Certificate not valid for domain name in Conjur appliance URL](#certificate-not-valid-for-domain-name-in-conjur-appliance-url)
- [Invalid Response to Certificate Signing Request](#invalid-response-to-certificate-signing-request)

## Overview

Expand All @@ -22,13 +22,13 @@ functionality of
[Conjur Kubernetes authentication (`authn-k8s`)](https://docs.conjur.org/Latest/en/Content/Operations/Services/k8s_auth.htm)
on a [Conjur](https://docs.conjur.org/) cluster.

## Troubleshooting Kubernetes Authentication on Conjur OSS
## Troubleshooting Kubernetes Authentication on Conjur Open Source

This section presents some tips and guidelines for troubleshooting
[Conjur Kubernetes authentication (`authn-k8s`)](https://docs.conjur.org/Latest/en/Content/Operations/Services/k8s_auth.htm)
specifically on a [Conjur OSS](https://docs.conjur.org/) cluster that has
specifically on a [Conjur Open Source](https://docs.conjur.org/) cluster that has
been deployed via the
[Conjur OSS Helm Chart](https://github.com/cyberark/conjur-oss-helm-chart/conjur-oss).
[Conjur Open Source Helm Chart](https://github.com/cyberark/conjur-oss-helm-chart/conjur-oss).

The intended audience for this section of the guide is anyone who encounters
issues when deploying Kubernetes applications that make use of Conjur
Expand All @@ -40,7 +40,7 @@ authenticate with Conjur:
- [Conjur Kubernetes Authenticator Client](https://github.com/cyberark/conjur-authn-k8s-client)
as either a sidecar or init container

### Prerequisites for Troubleshooting on Conjur OSS
### Prerequisites for Troubleshooting on Conjur Open Source

This section of the guide assumes that you have:

Expand Down Expand Up @@ -92,7 +92,7 @@ This section of the guide assumes that you have:
</details>

- [`conjur` CLI](https://github.com/cyberark/conjur-cli) access to your
[Conjur OSS](https://docs.conjur.org/) server.
[Conjur Open Source](https://docs.conjur.org/) server.

If you don't have this set up already, see the
[Creating a Conjur CLI Pod](#creating-a-conjur-cli-pod) section below.
Expand All @@ -109,7 +109,7 @@ In some cases, it may be helpful to create a Conjur CLI pod in your
Kubernetes cluster, and create a `conjur` command alias that executes
commands via that Conjur CLI pod.

For example, you may be exploring Conjur OSS and Kubernetes authentication
For example, you may be exploring Conjur Open Source and Kubernetes authentication
on a [Kubernetes-in-Docker (KinD)](https://kind.sigs.k8s.io/) or
or [MiniKube](https://minikube.sigs.k8s.io/docs/) cluster, and you prefer
not to install a software load balancer such as
Expand All @@ -123,7 +123,7 @@ not to install a software load balancer such as
HELM_RELEASE=conjur-oss
CONJUR_NAMESPACE=conjur-oss

# Create a Conjur CLI pod in the Conjur OSS namespace
# Create a Conjur CLI pod in the Conjur Open Source namespace
CLI_IMAGE=cyberark/conjur-cli:5-latest
echo "
---
Expand Down Expand Up @@ -186,7 +186,7 @@ the Kubernetes cluster.
# Set environment. Modify as necessary to match your setup.
CONJUR_NAMESPACE=conjur-oss

# Create a 'pod-curl' pod in the Conjur OSS namespace
# Create a 'pod-curl' pod in the Conjur Open Source namespace
echo "
---
apiVersion: v1
Expand Down Expand Up @@ -346,7 +346,7 @@ of your Conjur authentication configuration.
- Check the [Postgres pod logs](#collecting-conjur-postgres-pod-logs)
for warnings or errors.
- [Enable Conjur debug logging](#enabling-debug-logs-for-the-conjur-server),
and then delete the Conjur OSS server pod to force a pod recreate, and
and then delete the Conjur Open Source server pod to force a pod recreate, and
check the [Conjur server logs](#collecting-conjur-server-logs) again
for warnings or errors.

Expand Down
2 changes: 1 addition & 1 deletion design/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Conjur Design Documentation

This folder contains design documents for some Conjur OSS components.
This folder contains design documents for some Conjur Open Source components.

The linked documents below represent the original feature designs; to learn
more about the current state of the features, please see the official
Expand Down
11 changes: 6 additions & 5 deletions design/authenticators/authn_azure/authn_azure_solution_design.md
Original file line number Diff line number Diff line change
Expand Up @@ -411,7 +411,7 @@ Azure authenticator performance should conform with our other authenticators wit

- Conjur

- DAP
- Conjur Enterprise

## Security

Expand Down Expand Up @@ -535,7 +535,7 @@ The default TTL of an Azure access token is one hour, but it can reduced to a sh

- Conjur

- DAP
- Conjur Enterprise

## DoD

Expand All @@ -552,12 +552,13 @@ The default TTL of an Azure access token is one hour, but it can reduced to a sh
- [ ] Security action items were taken care of
- [ ] Performance tests were done and align with SLA
- [ ] Logs were reviewed by TW and PO
- [ ] Documentation has been written and reviewed by PO and TW for both DAP and Conjur
- [ ] Documentation has been written and reviewed by PO and TW for both
Conjur Enterprise and Open Source
- [ ] A demo was created for the new authenticator
- [ ] Engineer(s) that were not involved in the project use documentation to authenticate with Conjur using Azure
- [ ] Versions are bumped in all relevant projects
- [ ] Conjur
- [ ] DAP
- [ ] Conjur
- [ ] Conjur Enterprise

## Open questions

Expand Down
23 changes: 12 additions & 11 deletions design/authenticators/authn_gcp/authn_gcp_solution_design.md
Original file line number Diff line number Diff line change
Expand Up @@ -336,7 +336,7 @@ GCP authenticator performance should conform with our other authenticators with
### Affected Components
- Conjur

- DAP
- Conjur Enterprise

## Security
* **Future support in Service account key needs to be done very carefully** since there is a concern of impersonate other Conjur hosts,
Expand Down Expand Up @@ -394,9 +394,10 @@ We would like to add automated tests for the GCP Authenticator.
While Unit Tests are already automated, we will need to add some infrastructure for running integration tests.

### Scope
- Run integration tests in OSS
- Run a vanilla test in appliance
- Run automation on a DAP image that is deployed on GCP (Manual at first stage, automation on POST GA)
- Run integration tests in OSS
- Run a vanilla test in appliance
- Run automation on a Conjur Enterprise image that is deployed on GCP
(Manual at first stage, automation on POST GA)

### Run Integration Tests in OSS
GCP Authenticator tests will be added to the the general infrastructure of our integration test.
Expand Down Expand Up @@ -531,7 +532,7 @@ TODO: Inbal to decide which versions?
- Conjur
- DAP
- Conjur Enterprise
## Open questions
- Authenticator name may change `authn-gcp` ? TODO: Inbal to decide
Expand Down Expand Up @@ -574,8 +575,8 @@ Note: LLD designs need will be decided at implementation level
4. Release from side branch **E1**
4.1 Merge stable released Conjur to our side branch
4.2 Update Conjur and DAP versions
4.3 Release DAP as CA from side branch
4.2 Update Conjur and Conjur Enterprise versions
4.3 Release Conjur Enterprise as CA from side branch
5. Implement user extraction for aud claim indie the token **E1**
#### Testing EE19
Expand All @@ -585,12 +586,12 @@ Note: LLD designs need will be decided at implementation level
1.2. OSS - Issue an identity token **EE1**
1.3. DAP - Create GCE instance **EE1**
1.3. Conjur Enterprise - Create GCE instance **EE1**
1.4. DAP - Issue an identity token **EE1**
1.4. Conjur Enterprise - Issue an identity token **EE1**
2. OSS - Implement integration tests **EE5**
3. DAP - Implement integration tests for **EE3**
3. Conjur Enterprise - Implement integration tests for **EE3**
4. Manual tests according to docs (customer env) **EE1**
5. Performance tests **EE3**
6. Setting customer env **EE2**
Expand All @@ -616,7 +617,7 @@ Note: LLD designs need will be decided at implementation level
### Post GA EE6 + ??
#### Testing
1. Infrastructure to deploy DAP image on GCP
1. Infrastructure to deploy Conjur Enterprise image on GCP
#### Designs
1. LLD for K8S, Azure ang GCP to use same component of ValidateResourceRestrictions class **EE3**
Expand Down
4 changes: 2 additions & 2 deletions design/authenticators/authn_jwt/authn_jwt_solution_design.md
Original file line number Diff line number Diff line change
Expand Up @@ -395,7 +395,7 @@ JWT authenticator performance should conform with our other authenticators with
### Affected Components
- Conjur

- DAP
- Conjur Enterprise

## Open questions
1. Do we want to support static keys in 1st phase?
Expand Down Expand Up @@ -468,4 +468,4 @@ TODO
* Implementation EE 4
* Testing EE 3
* Security EE 2
* Docs EE 2
* Docs EE 2
Original file line number Diff line number Diff line change
Expand Up @@ -186,9 +186,10 @@ The performance of the "inject-client-cert" request will not be affected as the

## Affected Components

[//]: # "Address the components that will be affected by your solution [Conjur, DAP, clients, integrations, etc.]"
[//]: # "Address the components that will be affected by your solution
[Conjur, Conjur Enterprise, clients, integrations, etc.]"
- Conjur
- DAP
- Conjur Enterprise
- conjur-authn-k8s-client
- seed-fetcher
- secrets-provider-for-k8s
Expand Down Expand Up @@ -228,7 +229,11 @@ Additionally, we should address [this issue](https://github.com/cyberark/conjur/
There are no new audit messages in this fix. We already write the inject-client-cert request to the audit log.

## Documentation
[//]: # "Add notes on what should be documented in this solution. Elaborate on where this should be documented. If the change is in open-source projects, we may need to update the docs in github too. If it's in Conjur and/or DAP mention which products are affected by it"
[//]: # "Add notes on what should be documented in this solution."
[//]: # "Elaborate on where this should be documented. If the change is in"
[//]: # "open-source projects, we may need to update the docs in github too."
[//]: # "If it's in Conjur and/or Conjur Enterprise mention which"
[//]: # "products are affected by it"
This is an internal process so it doesn't require any new documentation. A CHANGELOG entry will be added about the response code change in "inject-client-cert"

## Delivery plan
Expand Down Expand Up @@ -277,4 +282,4 @@ EE: 19 days
[//]: # "Note and estimate the tasks which are related to creating a demo that demonstrates the solution"

- Record a demo of a successful and unsuccessful request
- EE: 1 day
- EE: 1 day
Loading

0 comments on commit 7dbdf99

Please sign in to comment.