generated from coulomb/repo-seed
Bernd Worsch
0754dc32e6
Replaces the Keycloak+privacyIDEA SSO tier with the lightweight stack built during KEY-WP-0001: Authelia (password frontend), LLDAP (directory), and KeyCape (OIDC orchestration). privacyIDEA is retained as the MFA engine. Stack: kc.coulomb.social — KeyCape OIDC server (stateless, custom Go) auth.coulomb.social — Authelia login portal (password auth → Authelia OIDC → KeyCape) lldap.coulomb.social — LLDAP admin UI (IP-restricted) pink.coulomb.social — privacyIDEA MFA engine (unchanged) Changes: - Remove sso-mfa/k8s/keycloak/ (7 files) - Add sso-mfa/k8s/lldap/ (pvc, deployment, middleware, ingress, create-secrets, README) - Add sso-mfa/k8s/authelia/ (pvc, configmap, deployment, ingress, create-secrets, README) - Add sso-mfa/k8s/keycape/ (deployment, middleware, ingress, create-secrets, create-pi-token, README) - Update network-policies/netpol-sso.yaml for new component topology - Update verify-t05.sh: checks LLDAP + Authelia + KeyCape (23 checks) - Update CONFIG.md: fix CP-NK-004 (KeyCape), add CP-NK-005 (Authelia), CP-NK-006 (LLDAP) - Update bootstrap/gen-secrets.sh: add LLDAP/Authelia/KeyCape sections, remove Keycloak - Update k8s/README.md: network policy table reflects new traffic paths - Add sso-mfa/WORKPLAN.md: resumable task checklist Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
111 lines
4.2 KiB
Markdown
111 lines
4.2 KiB
Markdown
# T02 — K8s Foundations
|
|
|
|
Phase 1 of NK-WP-0001: namespaces, NetworkPolicies, cert-manager, StorageClass.
|
|
|
|
## SSO stack overview
|
|
|
|
The `sso` namespace hosts three components:
|
|
- **KeyCape** (`kc.coulomb.social`) — OIDC orchestration layer, stateless
|
|
- **Authelia** (`auth.coulomb.social`) — password authentication frontend
|
|
- **LLDAP** (`lldap.coulomb.social`) — lightweight LDAP directory (admin UI restricted)
|
|
|
|
The `mfa` namespace hosts:
|
|
- **privacyIDEA** (`pink.coulomb.social`) — MFA engine, called by KeyCape
|
|
|
|
## Prerequisites
|
|
|
|
- K3s cluster running (ThreePhoenix HA or single-node dev)
|
|
- T01 Phase 0a complete (KeePassXC vault populated, ops bundle exported)
|
|
- `kubectl` configured with cluster access
|
|
|
|
## Apply order
|
|
|
|
```bash
|
|
# 1. Install cert-manager (if not already on cluster)
|
|
helm repo add jetstack https://charts.jetstack.io
|
|
helm repo update
|
|
helm install cert-manager jetstack/cert-manager \
|
|
--namespace cert-manager --create-namespace \
|
|
--set crds.enabled=true
|
|
|
|
# Wait for cert-manager to be ready
|
|
kubectl rollout status deployment/cert-manager -n cert-manager
|
|
|
|
# 2. Create namespaces
|
|
kubectl apply -f namespaces/namespaces.yaml
|
|
|
|
# 3. Apply NetworkPolicies
|
|
kubectl apply -f network-policies/netpol-sso.yaml
|
|
kubectl apply -f network-policies/netpol-mfa.yaml
|
|
kubectl apply -f network-policies/netpol-databases.yaml
|
|
|
|
# 4. Create ClusterIssuers
|
|
# Edit issuers.yaml first: replace ACME_EMAIL with your address
|
|
kubectl apply -f cert-manager/issuers.yaml
|
|
|
|
# 5. Verify cert-manager with test certificate
|
|
kubectl apply -f cert-manager/test-certificate.yaml
|
|
kubectl wait --for=condition=Ready certificate/selfsigned-test \
|
|
-n cert-manager-test --timeout=60s
|
|
kubectl delete namespace cert-manager-test
|
|
|
|
# 6. Verify StorageClass
|
|
kubectl apply -f storage/verify-pvc.yaml
|
|
kubectl wait --for=condition=Ready pod/storage-test \
|
|
-n storage-test --timeout=60s
|
|
kubectl logs -n storage-test storage-test
|
|
kubectl delete namespace storage-test
|
|
|
|
# 7. Run the full verification script
|
|
chmod +x verify-t02.sh
|
|
./verify-t02.sh
|
|
```
|
|
|
|
## NetworkPolicy design
|
|
|
|
All three namespaces follow a default-deny-all posture. Only the minimal
|
|
required paths are opened:
|
|
|
|
| Source | Destination | Port | Purpose |
|
|
|--------|-------------|------|---------|
|
|
| Traefik (kube-system) | KeyCape (sso) | 8080 | OIDC endpoints — public |
|
|
| Traefik (kube-system) | Authelia (sso) | 9091 | Login portal — public |
|
|
| Traefik (kube-system) | LLDAP (sso) | 17170 | Admin web UI — IP-restricted |
|
|
| Traefik (kube-system) | privacyIDEA (mfa) | 8080 | MFA portal — public |
|
|
| KeyCape (sso) | Authelia (sso) | 9091 | OIDC token exchange |
|
|
| KeyCape (sso) | LLDAP (sso) | 3890 | User attribute lookup |
|
|
| KeyCape (sso) | privacyIDEA (mfa) | 8080 | MFA challenge + validation |
|
|
| Authelia (sso) | LLDAP (sso) | 3890 | Credential validation |
|
|
| privacyIDEA (mfa) | PostgreSQL (databases) | 5432 | DB |
|
|
| CNPG operator (cnpg-system) | PostgreSQL (databases) | 5432/9187 | Operator + metrics |
|
|
| All pods | kube-dns (kube-system) | 53 | DNS resolution |
|
|
| CNPG pods | K8s API | 6443 | Status updates |
|
|
|
|
## Verifying denied paths (manual)
|
|
|
|
After applying NetworkPolicies, confirm that illegal paths are blocked:
|
|
|
|
```bash
|
|
# Test: KeyCape → privacyIDEA (should be ALLOWED)
|
|
kubectl run test-allowed -n sso --rm -it --image=busybox --restart=Never \
|
|
-- nc -zv privacyidea.mfa.svc.cluster.local 8080
|
|
|
|
# Test: Authelia → privacyIDEA (should be DENIED — only KeyCape calls privacyIDEA)
|
|
kubectl run test-denied -n sso --rm -it --image=busybox --restart=Never \
|
|
-l app.kubernetes.io/name=authelia \
|
|
-- nc -zv -w3 privacyidea.mfa.svc.cluster.local 8080
|
|
|
|
# Test: databases → sso (should be DENIED — DB pods must not initiate connections)
|
|
kubectl run test-denied2 -n databases --rm -it --image=busybox --restart=Never \
|
|
-- nc -zw3 keycape.sso.svc.cluster.local 8080
|
|
```
|
|
|
|
## Notes
|
|
|
|
- `net-kingdom/component` labels on namespaces are used by NetworkPolicy
|
|
`namespaceSelector` rules. Do not remove them.
|
|
- `cnpg.io/cluster: net-kingdom-pg` in `netpol-databases.yaml` must match
|
|
the name of the CloudNativePG `Cluster` CR you create in T03.
|
|
- The `letsencrypt-prod` ClusterIssuer requires public DNS and port 80 open
|
|
to Let's Encrypt servers. Update `ACME_EMAIL` before applying.
|