Skip to main content

Configure Authenticators via a Kubernetes Dynamic Admission Controller

This walkthrough provides the steps necessary to configure and deploy a Corsha Primer Admission Controller, which injects a Corsha Authenticator Sidecar. The Corsha Primer Admission Controller is a custom Kubernetes Dynamic Admission Controller.

If your application is already deployed on Kubernetes, this will automatically deploy the Corsha Authenticator alongside your API client as a sidecar. When successfully configured, the Corsha Authenticator allows your application to communicate with a Corsha-Protected API by adding a one-time use token to the headers of the API call.

Prerequisites​

There are a few prerequisites for deploying the Corsha Authenticator.

  • It is strongly recommended that you configure your Corsha-Protected API before deploying Authenticators. Deployment documentation is available for the Corsha Gatekeeper.

  • You should have an active Corsha mIDP deployment.

  • You are using Helm v3.15.x or newer.

  • You have a Primer Secret generated from the Console.

  • You have determined a Kubernetes Namespace for the injected Authenticator.

  • You have determined a Kubernetes Namespace for the Admission Controller.

Preparing to Deploy the Admission Controller​

Add the Corsha Helm repository, if you have not already, using the username and password you have been provided in your Deployment Guide.

tip

If this command returns repository name (corsha) already exists then you have already logged in to the repository.

helm repo add corsha https://corsha.jfrog.io/corsha/corsha --username <Artifactory username>
helm repo update

You will be prompted to input your Corsha Artifactory password.

Corsha Admission Controller Configuration​

To use the Corsha Primer Admission Controller to inject an Authenticator sidecar, follow these steps:

  1. Create a values.yaml configuration file containing the following contents:
primer:
  authserver:
    host: "<corsha-auth-server-primer>"
    port: 443
  primerSecret: <my-primer-secret> # Use primer secret fetched from Console

webhook:
  # List of namespaces which are eligible for injection
  injectNamespaces:
  - namespace-1
  # Label set to limit pods which are eligible for injection, target pods must have all labels
  injectLabels:
    app: "myapp"

authenticator:
  configSecret: corsha-authenticator-config
  imagePullSecret: "corsha-authenticator-img-pull-secret"
  # Image which will be injected as sidecar
  image: corsha-docker.jfrog.io/corsha-authenticator:<version> # Fill in with the version provided by your Corsha TPOC

fullnameOverride: "primer-admission-controller-{{ .Release.Namespace }}"

imageCredentials:
  registry: corsha-docker.jfrog.io
  username: <Artifactory username>
  password: <Artifactory password>
Corsha Authenticator Configuration​
  1. Create a config.yaml configuration file (details about this file can be found here):
authenticator:
  authServerTrustedMachine:
    url: "<corsha-auth-server-trusted>:443"
  authServerUntrustedMachine:
    url: "<corsha-auth-server-untrusted>:443"
  listen: 0.0.0.0:8081
  loggingLevel: info
  streamsDir: /opt/corsha/authenticator
  writeTime: 1m
  1. Create Kubernetes Secret containing the Authenticator Config from the previous step.
kubectl -n <authenticator namespace> create secret generic corsha-authenticator-config --from-file config.yaml
  1. Create an image pull secret in the Authenticator namespace that will be utilized to pull Corsha Authenticator and Proxy images from Corsha's artifact repository.
kubectl -n <authenticator namespace> create secret docker-registry corsha-authenticator-img-pull-secret --docker-server=corsha-docker.jfrog.io --docker-username=<MY_ARTIFACTORY_USERNAME> --docker-password=<MY_ARTIFACTORY_PASSWORD>

Deploying the Admission Controller​

Now that we have setup our local environment, we are ready to deploy the Corsha Admission Controller to the Kubernetes environment. We will use the Admission Controller values.yaml generated above with Helm to install the components.

helm upgrade --install injector corsha/primer-admission-controller \
--verify --version "$VERSION" -f values.yaml --wait --namespace <injector-namespace>

Using the Admission Controller​

  1. To inject a Corsha Authenticator as a sidecar to your workloads, ensure the following annotation is set within your pod spec:
annotations:
    corsha.io/inject-authenticator: "true"

  1. Verify your pod has an additional container named corsha-authenticator.

  2. Verify in the Console that a new Machine has been created and status is STATUS_RUNNING.