Skip to content

Commit 6cf600e

Browse files
JSticklerJStickler
authored
Merge pull request #49477 from JStickler/OSSMDOC-299
OSSMDOC-299: Document security settings for external Jaeger.
2 parents a158c25 + c5f8629 commit 6cf600e

File tree

4 files changed

+184
-0
lines changed

4 files changed

+184
-0
lines changed

‎modules/distr-tracing-config-security-ossm-cli.adoc

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
////
2+
This module included in the following assemblies:
3+
service_mesh/v2x/ossm-reference-jaeger.adoc
4+
////
5+
:_content-type: PROCEDURE
6+
[id="distr-tracing-config-security-ossm-cli_{context}"]
7+
= Configuring distributed tracing security for service mesh from the command line
8+
9+
You can modify the Jaeger resource to configure {JaegerShortName} security for use with {SMproductShortName} from the command line using the `oc` utility.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role. If you use {product-dedicated}, you must have an account with the `dedicated-admin` role.
14+
* The {SMProductName} Operator must be installed.
15+
* The `ServiceMeshControlPlane` deployed to the cluster.
16+
* You have access to the OpenShift CLI (oc) that matches your OpenShift Container Platform version.
17+
18+
.Procedure
19+
20+
. Log in to the {product-title} CLI as a user with the `cluster-admin` role. If you use {product-dedicated}, you must have an account with the `dedicated-admin` role.
21+
+
22+
[source,terminal]
23+
----
24+
$ oc login https://<HOSTNAME>:6443
25+
----
26+
+
27+
. Change to the project where you installed the control plane, for example `istio-system`, by entering the following command:
28+
+
29+
[source,terminal]
30+
----
31+
$ oc project istio-system
32+
----
33+
+
34+
. Run the following command to edit the Jaeger custom resource file, where `jaeger.yaml` is the name of your Jaeger custom resource.
35+
+
36+
[source,terminal]
37+
----
38+
$ oc edit -n tracing-system -f jaeger.yaml
39+
----
40+
+
41+
. Edit the `Jaeger` custom resource file to add the `htpasswd` configuration as shown in the following example.
42+
43+
* `spec.ingress.openshift.htpasswdFile`
44+
* `spec.volumes`
45+
* `spec.volumeMounts`
46+
+
47+
.Example Jaeger resource showing `htpasswd` configuration
48+
[source,yaml]
49+
----
50+
apiVersion: jaegertracing.io/v1
51+
kind: Jaeger
52+
spec:
53+
ingress:
54+
enabled: true
55+
openshift:
56+
htpasswdFile: /etc/proxy/htpasswd/auth
57+
sar: '{"namespace": "istio-system", "resource": "pods", "verb": "get"}'
58+
options: {}
59+
resources: {}
60+
security: oauth-proxy
61+
volumes:
62+
- name: secret-htpasswd
63+
secret:
64+
secretName: htpasswd
65+
- configMap:
66+
defaultMode: 420
67+
items:
68+
- key: ca-bundle.crt
69+
path: tls-ca-bundle.pem
70+
name: trusted-ca-bundle
71+
optional: true
72+
name: trusted-ca-bundle
73+
volumeMounts:
74+
- mountPath: /etc/proxy/htpasswd
75+
name: secret-htpasswd
76+
- mountPath: /etc/pki/ca-trust/extracted/pem/
77+
name: trusted-ca-bundle
78+
readOnly: true
79+
----
80+
+
81+
. Run the following command to apply your changes, where <jaeger.yaml> is the name of your Jaeger custom resource.
82+
+
83+
[source,terminal]
84+
----
85+
$ oc apply -n tracing-system -f <jaeger.yaml>
86+
----
87+
+
88+
. Run the following command to watch the progress of the pod deployment:
89+
+
90+
[source,terminal]
91+
----
92+
$ oc get pods -n tracing-system -w
93+
----

‎modules/distr-tracing-config-security-ossm-web.adoc

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
////
2+
This module included in the following assemblies:
3+
service_mesh/v2x/ossm-reference-jaeger.adoc
4+
////
5+
:_content-type: PROCEDURE
6+
[id="distr-tracing-config-security-ossm-web_{context}"]
7+
= Configuring distributed tracing security for service mesh from the OpenShift console
8+
9+
You can modify the Jaeger resource to configure {JaegerShortName} security for use with {SMproductShortName} in the OpenShift console.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role. If you use {product-dedicated}, you must have an account with the `dedicated-admin` role.
14+
* The {SMProductName} Operator must be installed.
15+
* The `ServiceMeshControlPlane` deployed to the cluster.
16+
* You have access to the OpenShift Container Platform web console.
17+
18+
.Procedure
19+
20+
. Log in to the {product-title} web console as a user with the `cluster-admin` role.
21+
22+
. Navigate to Operators → Installed Operators.
23+
24+
. Click the *Project* menu and select the project where your `ServiceMeshControlPlane` resource is deployed from the list, for example `istio-system`.
25+
26+
. Click the *{JaegerName} Operator*.
27+
28+
. On the *Operator Details* page, click the *Jaeger* tab.
29+
30+
. Click the name of your Jaeger instance.
31+
32+
. On the Jaeger details page, click the `YAML` tab to modify your configuration.
33+
34+
. Edit the `Jaeger` custom resource file to add the `htpasswd` configuration as shown in the following example.
35+
36+
* `spec.ingress.openshift.htpasswdFile`
37+
* `spec.volumes`
38+
* `spec.volumeMounts`
39+
+
40+
.Example Jaeger resource showing `htpasswd` configuration
41+
[source,yaml]
42+
----
43+
apiVersion: jaegertracing.io/v1
44+
kind: Jaeger
45+
spec:
46+
ingress:
47+
enabled: true
48+
openshift:
49+
htpasswdFile: /etc/proxy/htpasswd/auth
50+
sar: '{"namespace": "istio-system", "resource": "pods", "verb": "get"}'
51+
options: {}
52+
resources: {}
53+
security: oauth-proxy
54+
volumes:
55+
- name: secret-htpasswd
56+
secret:
57+
secretName: htpasswd
58+
- configMap:
59+
defaultMode: 420
60+
items:
61+
- key: ca-bundle.crt
62+
path: tls-ca-bundle.pem
63+
name: trusted-ca-bundle
64+
optional: true
65+
name: trusted-ca-bundle
66+
volumeMounts:
67+
- mountPath: /etc/proxy/htpasswd
68+
name: secret-htpasswd
69+
- mountPath: /etc/pki/ca-trust/extracted/pem/
70+
name: trusted-ca-bundle
71+
readOnly: true
72+
----
73+
+
74+
. Click *Save*.

‎modules/distr-tracing-config-security-ossm.adoc

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
////
2+
This module included in the following assemblies:
3+
service_mesh/v2x/ossm-reference-jaeger.adoc
4+
////
5+
:_content-type: CONCEPT
6+
[id="distr-tracing-config-security-ossm_{context}"]
7+
= Configuring distributed tracing security for service mesh
8+
9+
The {JaegerShortName} uses OAuth for default authentication. However {SMProductName} uses a secret called `htpasswd` to facilitate communication between dependent services such as Grafana, Kiali, and the {JaegerShortName}. When you configure your {JaegerShortName} in the `ServiceMeshControlPlane` the {SMProductShortName} automatically configures security settings to use `htpasswd`.
10+
11+
If you are specifying your {JaegerShortName} configuration in a Jaeger custom resource, you must manually configure the `htpasswd` settings and ensure the `htpasswd` secret is mounted into your Jaeger instance so that Kiali can communicate with it.

‎service_mesh/v2x/ossm-reference-jaeger.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,12 @@ include::modules/ossm-configuring-external-jaeger.adoc[leveloffset=+1]
1818

1919
include::modules/distr-tracing-deployment-best-practices.adoc[leveloffset=+2]
2020

21+
include::modules/distr-tracing-config-security-ossm.adoc[leveloffset=+2]
22+
23+
include::modules/distr-tracing-config-security-ossm-web.adoc[leveloffset=+3]
24+
25+
include::modules/distr-tracing-config-security-ossm-cli.adoc[leveloffset=+3]
26+
2127
include::modules/distr-tracing-config-default.adoc[leveloffset=+2]
2228

2329
include::modules/distr-tracing-config-jaeger-collector.adoc[leveloffset=+2]

0 commit comments

Comments
 (0)