Skip to content

Commit 81bb483

Browse files
nicholasdillenicholasdille
authored
Added GitLab CI OIDC
1 parent fcb18dc commit 81bb483

File tree

5 files changed

+208
-23
lines changed

5 files changed

+208
-23
lines changed

‎120_kubernetes/oidc/README.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Authenticate GitLab CI jobs against Kubernetes using GitLab OIDC
2+
3+
XXX
4+
5+
## Prepare
6+
7+
Deploy a Kubernetes cluster with authentication configuration from `auth-config.yaml`:
8+
9+
```shell
10+
kind create cluster \
11+
--name gitlab-ci-oidc \
12+
--config kind.yaml \
13+
--wait 5m
14+
```
15+
16+
Deploy GitLab runner:
17+
18+
```shell
19+
helm repo add gitlab https://charts.gitlab.io
20+
helm repo update
21+
helm upgrade --install \
22+
gitlab-runner gitlab/gitlab-runner \
23+
--values values-gitlab-runner.yaml \
24+
--set runnerRegistrationToken=TOKEN \
25+
--wait \
26+
--timeout 5m
27+
```

‎120_kubernetes/oidc/auth-config.yaml

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
---
2+
apiVersion: apiserver.config.k8s.io/v1beta1
3+
kind: AuthenticationConfiguration
4+
jwt:
5+
- issuer:
6+
# url must be unique across all authenticators.
7+
# url must not conflict with issuer configured in --service-account-issuer.
8+
url: https://gitlab.example.com
9+
# audiences is the set of acceptable audiences the JWT must be issued to.
10+
# At least one of the entries must match the "aud" claim in presented JWTs.
11+
audiences:
12+
- gitlab_user_auth
13+
# this is required to be set to "MatchAny" when multiple audiences are specified.
14+
audienceMatchPolicy: MatchAny
15+
claimMappings:
16+
# username represents an option for the username attribute.
17+
# This is the only required attribute.
18+
username:
19+
# Same as --oidc-username-claim. Mutually exclusive with username.expression.
20+
claim: preferred_username
21+
# Same as --oidc-username-prefix. Mutually exclusive with username.expression.
22+
# if username.claim is set, username.prefix is required.
23+
# Explicitly set it to "" if no prefix is desired.
24+
prefix: "oidc:"
25+
# groups represents an option for the groups attribute.
26+
groups:
27+
# Same as --oidc-groups-claim. Mutually exclusive with groups.expression.
28+
claim: groups_direct
29+
# Same as --oidc-groups-prefix. Mutually exclusive with groups.expression.
30+
# if groups.claim is set, groups.prefix is required.
31+
# Explicitly set it to "" if no prefix is desired.
32+
prefix: "gitlab:"
33+
# uid represents an option for the uid attribute.
34+
uid:
35+
# Mutually exclusive with uid.expression.
36+
claim: preferred_username
37+
- issuer:
38+
# url must be unique across all authenticators.
39+
# url must not conflict with issuer configured in --service-account-issuer.
40+
url: https://gitlab.example.com/
41+
# audiences is the set of acceptable audiences the JWT must be issued to.
42+
# At least one of the entries must match the "aud" claim in presented JWTs.
43+
audiences:
44+
- gitlab_ci_auth
45+
# this is required to be set to "MatchAny" when multiple audiences are specified.
46+
audienceMatchPolicy: MatchAny
47+
claimMappings:
48+
# username represents an option for the username attribute.
49+
# This is the only required attribute.
50+
username:
51+
# Same as --oidc-username-claim. Mutually exclusive with username.expression.
52+
claim: sub
53+
# Same as --oidc-username-prefix. Mutually exclusive with username.expression.
54+
# if username.claim is set, username.prefix is required.
55+
# Explicitly set it to "" if no prefix is desired.
56+
prefix: "gitlab-ci:"
57+
# groups represents an option for the groups attribute.
58+
groups:
59+
# Same as --oidc-groups-claim. Mutually exclusive with groups.expression.
60+
claim: namespace_path
61+
# Same as --oidc-groups-prefix. Mutually exclusive with groups.expression.
62+
# if groups.claim is set, groups.prefix is required.
63+
# Explicitly set it to "" if no prefix is desired.
64+
prefix: "gitlab-ci:"
65+
# uid represents an option for the uid attribute.
66+
uid:
67+
# Mutually exclusive with uid.expression.
68+
claim: sub
69+
# extra attributes to be added to the UserInfo object. Keys must be domain-prefix path and must be unique.
70+
#extra:
71+
# # key is a string to use as the extra attribute key.
72+
# # key must be a domain-prefix path (e.g. example.org/foo). All characters before the first "/" must be a valid
73+
# # subdomain as defined by RFC 1123. All characters trailing the first "/" must
74+
# # be valid HTTP Path characters as defined by RFC 3986.
75+
# # k8s.io, kubernetes.io and their subdomains are reserved for Kubernetes use and cannot be used.
76+
# # key must be lowercase and unique across all extra attributes.
77+
#- key: gitlab.haufedev.systems/namespace
78+
# valueExpression: namespace_id
79+
#- key: gitlab.haufedev.systems/project
80+
# valueExpression: project_id
81+
#- key: gitlab.haufedev.systems/triggerer
82+
# valueExpression: user_id
83+
#- key: gitlab.haufedev.systems/pipeline
84+
# valueExpression: pipeline_id
85+
#- key: gitlab.haufedev.systems/job
86+
# valueExpression: job_id
87+
#- key: gitlab.haufedev.systems/runner
88+
# valueExpression: runner_id
89+
#- key: gitlab.haufedev.systems/ref
90+
# valueExpression: ref
91+
#- key: gitlab.haufedev.systems/sha
92+
# valueExpression: sha

‎120_kubernetes/oidc/kind.yaml

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -6,30 +6,30 @@ nodes:
66
- |
77
kind: ClusterConfiguration
88
apiServer:
9-
# enable auditing flags on the API server
10-
extraArgs:
11-
audit-log-path: /var/log/kubernetes/kube-apiserver-audit.log
12-
audit-policy-file: /etc/kubernetes/policies/audit-policy.yaml
13-
oidc-issuer-url: https://gitlab.com
14-
oidc-client-id: $GL_APP_ID
15-
oidc-username-claim: preferred_username
16-
oidc-username-prefix: "oidc:"
17-
oidc-groups-claim: groups_direct
18-
oidc-groups-prefix: "gitlab:"
19-
# mount new files / directories on the control plane
20-
extraVolumes:
21-
- name: audit-policies
22-
hostPath: /etc/kubernetes/policies
23-
mountPath: /etc/kubernetes/policies
24-
readOnly: true
25-
pathType: "DirectoryOrCreate"
26-
- name: "audit-logs"
27-
hostPath: "/var/log/kubernetes"
28-
mountPath: "/var/log/kubernetes"
29-
readOnly: false
30-
pathType: DirectoryOrCreate
31-
# mount the local file on the control plane
9+
extraArgs:
10+
audit-log-path: /var/log/kubernetes/kube-apiserver-audit.log
11+
audit-policy-file: /etc/kubernetes/policies/audit-policy.yaml
12+
authentication-config: /etc/kubernetes/auth/auth-config.yaml
13+
extraVolumes:
14+
- name: audit-policies
15+
hostPath: /etc/kubernetes/policies
16+
mountPath: /etc/kubernetes/policies
17+
readOnly: true
18+
pathType: DirectoryOrCreate
19+
- name: audit-logs
20+
hostPath: /var/log/kubernetes
21+
mountPath: /var/log/kubernetes
22+
readOnly: false
23+
pathType: DirectoryOrCreate
24+
- name: auth-config
25+
hostPath: /etc/kubernetes/auth
26+
mountPath: /etc/kubernetes/auth
27+
readOnly: false
28+
pathType: DirectoryOrCreate
3229
extraMounts:
3330
- hostPath: ./audit-policy.yaml
3431
containerPath: /etc/kubernetes/policies/audit-policy.yaml
32+
readOnly: true
33+
- hostPath: ./auth-config.yaml
34+
containerPath: /etc/kubernetes/auth/auth-config.yaml
3535
readOnly: true

‎120_kubernetes/oidc/rbac.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,15 @@ roleRef:
1010
subjects:
1111
- kind: Group
1212
name: gitlab:k8s-oidc-demo
13+
---
14+
kind: ClusterRoleBinding
15+
apiVersion: rbac.authorization.k8s.io/v1
16+
metadata:
17+
name: oidc-test
18+
roleRef:
19+
apiGroup: rbac.authorization.k8s.io
20+
kind: ClusterRole
21+
name: view
22+
subjects:
23+
- kind: User
24+
name: gitlab-ci:project_path:DilleN/foo:ref_type:branch:ref:main

‎120_kubernetes/oidc/values-gitlab-runner.yaml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
image:
2+
registry: registry.gitlab.com
3+
image: gitlab-org/gitlab-runner
4+
#tag: alpine-v16.4.0
5+
imagePullPolicy: Always
6+
probeTimeoutSeconds: 5
7+
8+
## How many runner pods to launch.
9+
##
10+
## Note: Using more than one replica is not supported with a runnerToken. Use a runnerRegistrationToken
11+
## to create multiple runner replicas.
12+
# replicas: 1
13+
14+
gitlabUrl: https://gitlab.example.com/
15+
16+
unregisterRunners: true
17+
terminationGracePeriodSeconds: 3600
18+
concurrent: 5
19+
checkInterval: 5
20+
21+
rbac:
22+
create: true
23+
rules:
24+
- resources: ["pods", "secrets", "configmaps"]
25+
verbs: ["get", "list", "watch", "create", "patch", "delete", "update"]
26+
- apiGroups: [""]
27+
resources: ["pods/attach", "pods/exec"]
28+
verbs: ["create", "patch", "delete"]
29+
clusterWideAccess: false
30+
podSecurityPolicy:
31+
enabled: false
32+
resourceNames:
33+
- gitlab-runner
34+
35+
runners:
36+
config: |
37+
[[runners]]
38+
executor = "kubernetes"
39+
40+
[runners.kubernetes]
41+
image = "alpine"
42+
locked: false
43+
44+
securityContext:
45+
allowPrivilegeEscalation: false
46+
readOnlyRootFilesystem: false
47+
runAsNonRoot: true
48+
privileged: false
49+
capabilities:
50+
drop: ["ALL"]
51+
52+
podSecurityContext:
53+
runAsUser: 100
54+
fsGroup: 65533

0 commit comments

Comments
 (0)