PX-Security in Rancher
This page guides you to enable the RBAC functionality of PX-Security on an existing Kubernetes cluster. If you are installing a new cluster via the recommended Portworx Operator, see enable security in Portworx.
Enable RBAC an existing cluster
If you already have a working Portworx cluster and wish to enhance security by enabling RBAC, you will need to enable it for the entire Portworx cluster.
Follow the steps for the Operator-based installation.
(Optionally) Generate a new cluster token.
If you use Disaster Recovery functionality or are using data-migrating functionality between Kubernetes clusters, run the following command to generate a new cluster token after these operations, as the token will have changed that is used for for pairing and migrating your clusters:
pxctl cluster token reset
You will then need to update any other clusters' clusterpair objects with the new token.
Implications on pxctl
The pxctl
command will also be secured. As a result, you may need to perform extra steps to run pxctl
commands.
Security parameter overview
The following parameters are utilized and required by PX-Security. In the Operator-based installation, here are the parameters that are automatically created for you, but they can be manually changed if needed.
Configuration
For non-sensitive information, you can use command-line parameters with the following arguments:
Name | Description |
---|---|
-jwt_issuer <issuer> | JSON Web Token issuer (e.g. openstorage.io). This is the token issuer for your self-signed tokens. It must match the iss value in token claims |
-jwt_rsa_pubkey_file <file path> | JSON Web Token RSA Public file path |
-jwt_ecds_pubkey_file <file path> | JSON Web Token ECDS Public file path |
-username_claim <claim> | Name of the claim in the token to be used as the unique ID of the user (<claim> can be sub , email or name , default: sub ) |