Add more details in guideline for Auth Istio&Apisix #485

XinyaoWa · 2024-10-18T10:29:38Z

Description

Add more details in guideline for Auth Istio&Apisix

Issues

List the issue or RFC link this PR is working on. If there is no such link, please mark it as n/a.

Type of change

List the type of change like below. Please delete options that are not relevant.

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds new functionality)
Breaking change (fix or feature that would break existing design and interface)

Dependencies

List the newly introduced 3rd party dependency if exists.

Tests

Describe the tests that you ran to verify your changes.

XinyaoWa · 2024-10-21T03:08:13Z

@ckhened Please help to have a review~

authN-authZ/auth-istio/README.md

Ruoyu-y · 2024-11-04T01:33:54Z

authN-authZ/auth-istio/README.md

+First export the router service through istio ingress gateway.
+
+```bash
+kubectl apply -f $(pwd)/$DEPLOY_METHOD/chatQnA_router_gateway.yaml


This file is only used for option: via JWT token generated by OIDC providers with curl
Why it is defined in the prerequisite section?

I think this has no relationship with the token generation way. It is just from istio gateway, and should be added for all megaservices if you want to do authentication.

Well, understand. But for authentication with the oauth service, another gateway configuration needs to get applied since there are some extra configuration. Applying both of them might introduce conflicts or complexity. So if you want to set the gateway anyway, please put the steps in each section, instead of putting the step in the Prerequisite section.

Thanks for your suggestion. Putting the steps in each section will be duplicated. Thus I add "Optional" to this part and add a suggestion for this, do you think it's work?

Thanks for your suggestion. Putting the steps in each section will be duplicated. Thus I add "Optional" to this part and add a suggestion for this, do you think it's work?

Well. I think it is a must for all options to find the ingress port and ip address, but for the step kubectl apply -f $(pwd)/$DEPLOY_METHOD/chatQnA_router_gateway.yaml, it is ONLY used for the first two options of authentication, and NOT needed(instead of optional) for the third option, as it shall only use kubectl apply -f $(pwd)/$DEPLOY_METHOD/chatQnA_router_gateway_oauth.yaml instead.

Thanks for your explanation!! I have just move this part to "Perform authentication and authorization via JWT tokens generated by OIDC provider" section as your original sequence, please have a check~

authN-authZ/auth-istio/README.md

authN-authZ/auth-apisix/README.md

authN-authZ/auth-apisix/keycloak_install.yaml

authN-authZ/auth-istio/README.md

Ruoyu-y · 2024-11-06T05:44:32Z

authN-authZ/auth-istio/README.md

+First export the router service through istio ingress gateway.
+
+```bash
+kubectl apply -f $(pwd)/$DEPLOY_METHOD/chatQnA_router_gateway.yaml


Well, understand. But for authentication with the oauth service, another gateway configuration needs to get applied since there are some extra configuration. Applying both of them might introduce conflicts or complexity. So if you want to set the gateway anyway, please put the steps in each section, instead of putting the step in the Prerequisite section.

authN-authZ/auth-istio/README.md

authN-authZ/auth-apisix/keycloak_install.yaml

Ruoyu-y

LGTM

Signed-off-by: Xinyao Wang <xinyao.wang@intel.com>

for more information, see https://pre-commit.ci

Signed-off-by: Xinyao Wang <xinyao.wang@intel.com>

for more information, see https://pre-commit.ci

Signed-off-by: Xinyao Wang <xinyao.wang@intel.com>

for more information, see https://pre-commit.ci

ckhened · 2024-12-04T01:06:06Z

authN-authZ/auth-apisix/apisix-chatqna-route.yaml

@@ -0,0 +1,33 @@
+# Copyright (C) 2024 Intel Corporation


Instead of adding this file, could you re use the one in templates and add a new values file like values_megaservice.yaml and update the values accordingly so that the implementation will be consistent with helm charts

mkbhanda

Please consistently write apisix in text as APISIX, that is how it is on their site. @chickenrae comment -- may want to talk to @yongfengdu - what/how. Please number the steps for installing/configuring keycloak, it helps people. Please add a statement to the effect that envsubst is needed only on the machine from which one is launching the kubectl commands, it is not needed on any of the kubernetes cluster machines.

mkbhanda · 2025-01-17T07:13:28Z

authN-authZ/auth-apisix/README.md

+export USER='mary'
+export PASSWORD=<password>
+export KEYCLOAK_REALM='apisix'
+export KEYCLOAK_CLIENT_ID='apisix'


realm and client_id have to be same? or any reason you choose same?

mkbhanda · 2025-01-17T07:14:47Z

authN-authZ/auth-apisix/README.md


-2. Run keycloak, setup a realm with OIDC based authentication and add users with passwords for each user.
+## Start Keycloak and configuration


Suggested change

## Start Keycloak and configuration

## Starting and Configuring Keycloak

mkbhanda · 2025-01-17T07:17:05Z

authN-authZ/auth-apisix/README.md

+
+In this case, we add a realm called `apisix` and add a user called `mary` with password. In the authentication step, only the user from `apisix` realm can access the chatQnA pipeline.
+
+Steps to start keycloak.


you cannot start something before installing it.

Description and step don't match.

If you have numbered steps, let step 1 be "Create a persistent volume for keycloak"

mkbhanda · 2025-01-17T07:17:40Z

authN-authZ/auth-apisix/README.md


-# install keycloak with helm by setting
+Then install keycloak.


make this (2) for your step 2. Install keycloak

mkbhanda · 2025-01-17T07:18:28Z

authN-authZ/auth-apisix/README.md

+kubectl apply -f ./keycloak_install.yaml
+```
+
+Get the ip and port to access keycloak.


step 3 3) Determine keycloak service ip and port.

mkbhanda · 2025-01-17T07:53:50Z

authN-authZ/auth-istio/README.md

@@ -151,18 +174,63 @@ The user management is done via Keycloak and the configuration steps look like t

 4. Create a new user name as `mary` and another user as `bob`. Set passwords for both users (set 'Temporary' to 'Off'). Select Role mapping on the top, assign the `user` role to `mary` and assign the `viewer` role to `bob`.

-**Apply authentication and authorization policies to the pipeline endpoint based on OIDC provider**
+5. Turn off the all the 'Required actions' under the 'Authentication' section in Keycloak


Suggested change

5. Turn off the all the 'Required actions' under the 'Authentication' section in Keycloak

5. Turn off the 'Required actions' under the 'Authentication' section in Keycloak

grammar is wrong with "the all the" but wondering if there is an "all" somewhere in the console ..

mkbhanda · 2025-01-17T07:55:56Z

authN-authZ/auth-istio/README.md

+./kcadm.sh update realms/master -s sslRequired=NONE --server ${KEYCLOAK_ADDR}
+```
+
+Then after open the console and create `istio` realm, go to "Realm setting", set "Require SSL" to "None"


Suggested change

Then after open the console and create `istio` realm, go to "Realm setting", set "Require SSL" to "None"

Then after opening the console, create the `istio` realm. Next go to "Realm setting", and set "Require SSL" to "None"

mkbhanda · 2025-01-17T07:57:28Z

authN-authZ/auth-istio/README.md

+
+**Export the router service through istio ingress gateway**
+
+For authentication safegard, we should add a gateway for the service. Here we the istio ingress gateway will be used to access the chatQnA service in different setups.


Suggested change

For authentication safegard, we should add a gateway for the service. Here we the istio ingress gateway will be used to access the chatQnA service in different setups.

For authentication safegard, we should add a gateway for the service. Here we show how to set up the istio ingress gateway to control access to the chatQnA service.

mkbhanda · 2025-01-17T07:59:20Z

authN-authZ/auth-istio/README.md

+# set the INGRESS_PORT to the istio-ingressgateway svc port
+export INGRESS_PORT=${gateway_svc_port}
+
+#Case2: If your environment support external load balancers


Suggested change

#Case2: If your environment support external load balancers

#Case2: If your environment supports external load balancers

mkbhanda · 2025-01-17T09:00:34Z

authN-authZ/auth-istio/README.md

@@ -330,3 +398,15 @@ sudo sed -i '1i\127.0.0.1       chatqna-ui.com' /etc/hosts
 Open browser with address `"chatqna-ui.com:${INGRESS_PORT}"` if using GMC based deployment. Otherwise, open the browser with address `"chatqna-service.com:${INGRESS_PORT}"`.


we never told folks how to find the address of chatqna-ui.com. the way it is written it feels like a fully qualified domain name like google.com!

poussa · 2025-01-17T10:08:53Z

Looks like we need more time to adapt all the changes, so this will not make v1.2 release.

XinyaoWa requested a review from Ruoyu-y as a code owner October 18, 2024 10:29

Ruoyu-y requested changes Nov 4, 2024

View reviewed changes

Ruoyu-y requested a review from ckhened November 4, 2024 01:44

XinyaoWa requested a review from Ruoyu-y November 6, 2024 03:34

Ruoyu-y reviewed Nov 6, 2024

View reviewed changes

Ruoyu-y approved these changes Nov 19, 2024

View reviewed changes

XinyaoWa and others added 11 commits November 28, 2024 10:32

add more for auth apisix&istio

466e163

Signed-off-by: Xinyao Wang <xinyao.wang@intel.com>

fix bug

01ad2ef

Signed-off-by: Xinyao Wang <xinyao.wang@intel.com>

[pre-commit.ci] auto fixes from pre-commit.com hooks

4c11325

for more information, see https://pre-commit.ci

move keycloak_install.yaml place

07a23c0

Signed-off-by: Xinyao Wang <xinyao.wang@intel.com>

refine readme

f73c473

Signed-off-by: Xinyao Wang <xinyao.wang@intel.com>

refine readme

ce23b74

Signed-off-by: Xinyao Wang <xinyao.wang@intel.com>

refine readme

630d148

Signed-off-by: Xinyao Wang <xinyao.wang@intel.com>

[pre-commit.ci] auto fixes from pre-commit.com hooks

3364a4e

for more information, see https://pre-commit.ci

fix readme

3742fea

Signed-off-by: Xinyao Wang <xinyao.wang@intel.com>

fix ingress gateway

8ecbef1

Signed-off-by: Xinyao Wang <xinyao.wang@intel.com>

[pre-commit.ci] auto fixes from pre-commit.com hooks

2a515a9

for more information, see https://pre-commit.ci

lianhao force-pushed the auth branch from 70a1509 to 2a515a9 Compare November 28, 2024 02:32

lianhao requested a review from mkbhanda November 28, 2024 02:33

ckhened reviewed Dec 4, 2024

View reviewed changes

joshuayao added this to the v1.2 milestone Jan 7, 2025

joshuayao linked an issue Jan 7, 2025 that may be closed by this pull request

[Feature] Istio m/TLS integration #548

Closed

joshuayao removed a link to an issue Jan 7, 2025

[Feature] Istio m/TLS integration #548

Closed

joshuayao requested review from ckhened and Ruoyu-y January 17, 2025 03:27

Ruoyu-y approved these changes Jan 17, 2025

View reviewed changes

mkbhanda reviewed Jan 17, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add more details in guideline for Auth Istio&Apisix #485

Add more details in guideline for Auth Istio&Apisix #485

XinyaoWa commented Oct 18, 2024

XinyaoWa commented Oct 21, 2024

Ruoyu-y Nov 4, 2024

XinyaoWa Nov 6, 2024

Ruoyu-y Nov 6, 2024

XinyaoWa Nov 7, 2024

Ruoyu-y Nov 11, 2024

XinyaoWa Nov 12, 2024

Ruoyu-y Nov 6, 2024

Ruoyu-y left a comment

ckhened Dec 4, 2024

mkbhanda left a comment

mkbhanda Jan 17, 2025

mkbhanda Jan 17, 2025

mkbhanda Jan 17, 2025

mkbhanda Jan 17, 2025

mkbhanda Jan 17, 2025

mkbhanda Jan 17, 2025

mkbhanda Jan 17, 2025

mkbhanda Jan 17, 2025

mkbhanda Jan 17, 2025

mkbhanda Jan 17, 2025

mkbhanda Jan 17, 2025

poussa commented Jan 17, 2025


		2. Run keycloak, setup a realm with OIDC based authentication and add users with passwords for each user.
		## Start Keycloak and configuration

	## Start Keycloak and configuration
	## Starting and Configuring Keycloak


		In this case, we add a realm called `apisix` and add a user called `mary` with password. In the authentication step, only the user from `apisix` realm can access the chatQnA pipeline.

		Steps to start keycloak.


		# install keycloak with helm by setting
		Then install keycloak.

	5. Turn off the all the 'Required actions' under the 'Authentication' section in Keycloak
	5. Turn off the 'Required actions' under the 'Authentication' section in Keycloak

	Then after open the console and create `istio` realm, go to "Realm setting", set "Require SSL" to "None"
	Then after opening the console, create the `istio` realm. Next go to "Realm setting", and set "Require SSL" to "None"


		Export the router service through istio ingress gateway

		For authentication safegard, we should add a gateway for the service. Here we the istio ingress gateway will be used to access the chatQnA service in different setups.

	#Case2: If your environment support external load balancers
	#Case2: If your environment supports external load balancers

		@@ -330,3 +398,15 @@ sudo sed -i '1i\127.0.0.1 chatqna-ui.com' /etc/hosts
		Open browser with address `"chatqna-ui.com:${INGRESS_PORT}"` if using GMC based deployment. Otherwise, open the browser with address `"chatqna-service.com:${INGRESS_PORT}"`.

Add more details in guideline for Auth Istio&Apisix #485

Are you sure you want to change the base?

Add more details in guideline for Auth Istio&Apisix #485

Conversation

XinyaoWa commented Oct 18, 2024

Description

Issues

Type of change

Dependencies

Tests

XinyaoWa commented Oct 21, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Ruoyu-y left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mkbhanda left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

poussa commented Jan 17, 2025