Step 3: Customizing security setup in airgapped EKS
Summary and Key concepts
Summary
This document explains how to further customize the security configuration of Portworx when using the Portworx Operator. It covers how to disable or manage the system guest role, which is enabled by default, allowing administrators to control access more strictly. The document also details how to customize the system guest role by enabling managed mode, allowing finer control over the role's configuration. Additionally, the guide covers changing the token lifetime for authentication tokens and configuring custom issuers and shared secrets to secure your cluster environment.
Kubernetes Concepts
- Secret: Used for storing sensitive information like shared secrets.
- Namespace: Represents the cluster's organizational boundary for the Portworx cluster configuration.
Portworx Concepts
- StorageCluster: Custom resource used to define and manage a Portworx cluster.
- PX-Security: Security feature that controls access to volumes and cluster resources.
This document guides you through optionally customizing your Portworx Operator Security configuration further to fit specific needs.
Prerequisites
- PX-Security enabled
Disable guest role access
In Portworx, the system guest role is enabled by default. To turn off this feature, you can disable it in the StorageCluster spec:
Once the guest role is disabled, volumes created without a token will only be accessible with a token.
apiVersion: core.libopenstorage.org/v1
kind: StorageCluster
metadata:
name: px-cluster
namespace: <px-namespace>
spec:
security:
enabled: true
auth:
guestAccess: 'Disabled'
Managing the guest role yourself
You can exercise finer control over the system.guest
role by setting it to managed
mode. This instructs the Operator to stop updating the system guest role, allowing you to customize it yourself.
To enter managed
mode, set the value of the spec.security.auth.guestAccess
field to managed
:
apiVersion: core.libopenstorage.org/v1
kind: StorageCluster
metadata:
name: px-cluster
namespace: <px-namespace>
spec:
security:
enabled: true
auth:
guestAccess: 'Managed'
Changing token lifetime
By default, the token is valid for 24 hours. You can optionally specify a different JWT token lifetime. The Operator then generates a token with that token lifetime and refreshes it for the user accordingly.
apiVersion: core.libopenstorage.org/v1
kind: StorageCluster
metadata:
name: px-cluster
namespace: <px-namespace>
spec:
security:
enabled: true
auth:
selfSigned:
tokenLifetime: '4h'
Add a custom issuer, shared secret, and tokenLifetime to your StorageCluster
Add your issuer
, tokenLifetime
, and sharedSecret
Kubernetes secret's name to the spec.security.auth.selfSigned
object in your StorageCluster:
apiVersion: core.libopenstorage.org/v1
kind: StorageCluster
metadata:
name: px-cluster
namespace: <px-namespace>
spec:
security:
enabled: true
auth:
selfSigned:
issuer: "portworx.com"
sharedSecret: "px-shared-secret"
tokenLifetime: "1h"