Its my Homelab, Why Should I Care About SSO

Users. Roles. Single-sign on. These are enterprise features. I don’t need them in my homelab, right? Everyone’s homelab is different, and the reasons for building one are just as different. No matter why you built it, everyone should always be thinking least privilege. The problem is that least privilege, especially with Kubernetes, is hard. It doesn’t have to be. In this talk, you will see what can happen when you don’t implement least privilege, how to configure roles, and how to use them. We will look at how to do this with a number of tools and end with a quick look at doing everything with Infra which is 100% open source. You will leave the session with actionable next steps to get single sign on up and running in minutes at home using only open-source tools.

Transcript

1. It's My HomeLab Why Would I Want SSO? Matt Williams – Evangelist @ Infra matt@infrahq.com | @technovangelist
2. It's My HomeLab Why Would I Want Single Sign On? Or Roles? Or Users? * Specific to Kubernetes Matt Williams – Evangelist @ Infra matt@infrahq.com | @technovangelist
3. A HomeLab can be whatever you want it to be.
5. A HomeLab can be made of whatever you have
6. My first HomeLab was…
7. My HomeLab Today
12. Kubernetes in the HomeLab Can take advantage of a hodgepodge of machines
13. Kubernetes in the HomeLab Consistent Deployments
14. Why Users and Roles in K8S at Home?
15. Kubernetes: What is a User? • They don’t exist - or – • A signed certificate in a kubeconfig file
16. apiVersion: v1 clusters: - cluster: certificate-authority-data: certgoeshere server: https://clusterendpoint.k8s.ondigitalocean.com name: mycluster contexts: - context: cluster: mycluster user: do-sfo3-matt-primary-admin name: mycontext current-context: mycontext kind: Config preferences: {} users: - name: do-sfo3-matt-primary-admin user: token: dop_v1_dea9d7ff2b8eb092f53ffebogus31d2bd4602a62a19b5ac4
17. apiVersion: v1 clusters: - cluster: certificate-authority-data: certgoeshere server: https://clusterendpoint.k8s.ondigitalocean.com name: mycluster contexts: - context: cluster: mycluster user: do-sfo3-matt-primary-admin name: mycontext current-context: mycontext kind: Config preferences: {} users: - name: do-sfo3-matt-primary-admin user: token: dop_v1_dea9d7ff2b8eb092f53ffebogus31d2bd4602a62a19b5ac4
18. apiVersion: v1 clusters: - cluster: certificate-authority-data: certgoeshere server: https://clusterendpoint.k8s.ondigitalocean.com name: mycluster contexts: - context: cluster: mycluster user: do-sfo3-matt-primary-admin name: mycontext current-context: mycontext kind: Config preferences: {} users: - name: do-sfo3-matt-primary-admin user: token: dop_v1_dea9d7ff2b8eb092f53ffebogus31d2bd4602a62a19b5ac4
19. apiVersion: v1 clusters: - cluster: certificate-authority-data: certgoeshere server: https://clusterendpoint.k8s.ondigitalocean.com name: mycluster contexts: - context: cluster: mycluster user: do-sfo3-matt-primary-admin name: mycontext current-context: mycontext kind: Config preferences: {} users: - name: do-sfo3-matt-primary-admin user: token: dop_v1_dea9d7ff2b8eb092f53ffebogus31d2bd4602a62a19b5ac4
20. Kubernetes: What is a Role? • Defines the level of access a ‘user’ has to the cluster • Resource • Verb
21. Kubernetes: What is a Role? apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: marketing-dev labels: app.infrahq.com/include-role: "true" rules: - apiGroups: [""] # "" indicates the core API group resources: ["pods"] verbs: ["get", "watch", "list"]
22. Kubernetes: What is a Role? apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: marketing-dev labels: app.infrahq.com/include-role: "true" rules: - apiGroups: [""] # "" indicates the core API group resources: ["pods"] verbs: ["get", "watch", "list"]
23. Kubernetes: What is a Role? apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: marketing-dev labels: app.infrahq.com/include-role: "true" rules: - apiGroups: [""] # "" indicates the core API group resources: ["pods"] verbs: ["get", "watch", "list"]
24. Kubernetes: What is a Role? apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: marketing-dev labels: app.infrahq.com/include-role: "true" rules: - apiGroups: [""] # "" indicates the core API group resources: ["pods"] verbs: ["get", "watch", "list"]
25. How to create a User • Create the user key (openssl genpkey…) • Create the CSR (openssl req –new) • Submit the CSR to the cluster (yaml) • Approve the request (kubectl certificate approve…)
26. How to create a User • Get the approved request (kubectl get csr…) • Build the kubeconfig (kubectl --kubeconfig myuserconfig config set-credentials, kubectl -- kubeconfig myuserconfig configset-context) • Then distribute the file https://infrahq.com/blog/how-to-create-users
27. How to create a User • And then repeat often • ensure bad parties can’t access • And redistribute
28. Just give everyone admin??? • What happens when • User fired • User compromised • Kubernetes is Remote Execution as a Service
29. Can we automate it?
30. Brendan Burns - AddUser • https://github.com/brendandburns/kub ernetes-adduser
31. What’s missing from the script • Key / Config file distribution
32. How about something easier?
34. Infra • Two deployment options • Self Hosted • Use Infra Cloud (coming soon)
35. Demo
36. Summary • HomeLabs let you practice • You should be using Users/Roles/SSO with K8s • Users in K8s are hard • Infra is easy • Infra lets you do the hard stuff without much thinking
37. It's My HomeLab Why Would I Want SSO? Matt Williams – Evangelist @ Infra matt@infrahq.com | @technovangelist