Skip to content

Commit 7272f2a

Browse files
sreejithgssreejithgs
authored
Merge pull request #322 from citrix/docs
Docs
2 parents 796b650 + a7671b2 commit 7272f2a

13 files changed

Lines changed: 593 additions & 9 deletions

‎crd/auth/README.md‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
Authentication and authorization policies are used to enforce access restrictions to the resources hosted by an application or API server. While you can verify the identity using the authentication policies, authorization policies are used to verify whether a specified request has the necessary permissions to access a resource.
44

5-
Citrix provides a Kubernetes [CustomResourceDefinitions](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#customresourcedefinitions) (CRDs) called the **Auth CRD** that you can use with the Citrix ingress controller to define authentication policies on the ingress Citrix ADC.
5+
Citrix provides a Kubernetes [CustomResourceDefinition](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#customresourcedefinitions) (CRD) called the **Auth CRD** that you can use with the Citrix ingress controller to define authentication policies on the ingress Citrix ADC.
66

77
## Auth CRD definition
88

@@ -200,6 +200,7 @@ spec:
200200
- servicenames
201201
```
202202
203+
203204
## Auth CRD attributes
204205
205206
The Auth CRD provides the following attributes that you use to define the authentication policies:
@@ -367,21 +368,22 @@ spec:
367368
- '/customers/'
368369
method: [POST]
369370
claims:
370-
- name: "scope"
371-
values: ["read", "write"]
371+
- name: "scope"
372+
values: ["read", "write"]
372373
373374
- resource:
374375
path:
375376
- '/reviews'
376377
claims:
377-
- name: "scope"
378-
values: ["read"]
378+
- name: "scope"
379+
values: ["read"]
379380
- resource:
380381
path:
381382
- '/products/'
382383
method: [GET]
383384
claims: []
384-
385+
386+
385387
```
386388

387389
The sample authentication policy performs the following:
@@ -395,10 +397,11 @@ The sample authentication policy performs the following:
395397
- The Citrix ADC performs the oAuth JWT verification as specified in the provider `jwt-auth-provider` for the requests to the **reviews** endpoint.
396398

397399
- The Citrix ADC performs the oAuth introspection as specified in the provider `introspect-provider` for the requests to the **customers** endpoint.
398-
400+
399401
- The Citrix ADC requires the `scope` claim with `read` and `write` permissions to access the **customers** endpoint and **POST**.
400402

401-
- The Citrix ADC does not need any authorization permissions to access the **products** endpoint with GET operation.
403+
- The Citrix ADC does not need any authorization permissions to access the **products** endpoint with GET operation.
404+
402405

403406
For oAuth, if the token is present in a custom header, it can be specified using the `token_in_hdr` attribute as follows:
404407

‎docs/configure/annotations.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ In service annotations, `index` is the ordered index of the ports in a service s
8787
| `service.citrix.com/ssl-ca-certificate-data-<index>` | Use this annotation to specify the server CA certificate value to verify the client certificate in PEM format.| service.citrix.com/ssl-ca-certificate-data-0: \| <`certificate`> |
8888
|`service.citrix.com/ssl-backend-ca-certificate-data-<index>`| Use this annotation to specify the CA certificate value to verify the server certificate of the back-end in PEM format.| service.citrix.com/ssl-backend-ca-certificate-data-0: \| <`certificate`> |
8989
| `service.citrix.com/ssl-termination-<index>` | Use this annotation to specify the SSL termination. The accepted values are `EDGE` and `REENCRYPT`. | service.citrix.com/ssl-termination-0: 'EDGE' |
90+
| `service.citrix.com/insecure-redirect` | Use this annotation to redirect insecure traffic to a secure port. You can either specify the secure port using {`secure-portname` : `port-number`} or {`secure-portnumber`- `secure-port-protocol` : `insecure-portnumber` } to redirect traffic from an insecure port. | service.citrix.com/insecure-redirect: '{"port-443": 80 }' <br> or <br> service.citrix.com/insecure-redirect: '{"443-tcp": 80 }' |
9091
| `service.citrix.com/frontend-ip` | Use this annotation to pass the VIP for services of type `LoadBalancer`.|service.citrix.com/frontend-ip: "192.168.1.1" |
9192
| `service.citrix.com/ipam-range` | Use this annotation to select a particular IP address range from a set of ranges specified to the Citrix IPAM controller. This annotation is used for services of type LoadBalancer.|service.citrix.com/ipam-range: "Dev"|
9293
| `service.citrix.com/secret` | Use this annotation to specify the name of the secret resource for the front-end server certificate.| service.citrix.com/secret: "hotdrink-secret" |
@@ -98,6 +99,39 @@ In service annotations, `index` is the ordered index of the ports in a service s
9899
|`service.citrix.com/preconfigured-backend-certkey` |Use this annotation to specify the name of the preconfigured certificate key in the Citrix ADC to be bound to the back-end SSL service group. This certificate is sent to the server during the SSL handshake for server authentication. | service.citrix.com/preconfigured-ca-certkey: 'coffee-ca-cert'|
99100
|`service.citrix.com/preconfigured-backend-ca-certkey` |Use this annotation to specify the name of the preconfigured CA certificate key in the Citrix ADC to bound to the back-end SSL service group for server authentication.|service.citrix.com/preconfigured-backend-ca-certkey: 'coffee-ca-cert' |
100101

102+
### Sample YAML with the service annotation to redirect insecure traffic
103+
104+
This example shows how to redirect traffic from clients making requests on an insecure port 80 to the secure port 443.
105+
106+
The following annotation is specified in the service YAML file to redirect traffic:
107+
108+
service.citrix.com/insecure-redirect: '{"port-443": 80}'
109+
110+
Following is a sample service definition:
111+
112+
```yml
113+
114+
apiVersion: v1
115+
kind: Service
116+
metadata:
117+
name: frontend-service
118+
annotations:
119+
service.citrix.com/service-type-0: SSL
120+
service.citrix.com/frontend-ip: '192.2.170.26'
121+
service.citrix.com/secret: '{"port-443": "web-ingress-secret"}'
122+
service.citrix.com/ssl-termination-0: "EDGE"
123+
service.citrix.com/insecure-redirect: '{"port-443": 80}'
124+
spec:
125+
type: LoadBalancer
126+
selector:
127+
app: frontend
128+
ports:
129+
- port: 443
130+
targetPort: 80
131+
name: port-443
132+
133+
```
134+
101135
## Smart annotations for services
102136

103137
Smart annotations for services are used to configure the Citrix ADC with custom values for Citrix ADC configuration parameters. The annotations are used for services of type `LoadBalancer` and for the services in Citrix ADC CPX used for East-West traffic.

‎docs/configure/cpx-bgp-router/configmap-example.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: config
5+
labels:
6+
app: cic
7+
data:
8+
NS_BGP_CONFIG: |
9+
bgpConfig:
10+
- bgpRouter:
11+
localAS: 100
12+
neighbor:
13+
- address: 10.102.33.33
14+
remoteAS: 100
15+
advertisementInterval: 30
16+
ASOriginationInterval: 30

‎docs/configure/cpx-bgp-router/configmap-nodeselector-example.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: config
5+
labels:
6+
app: cic
7+
data:
8+
NS_BGP_CONFIG: |
9+
bgpConfig:
10+
- nodeSelector: datacenter=ds1
11+
bgpRouter:
12+
localAS: 100
13+
neighbor:
14+
- address: 10.102.33.44
15+
remoteAS: 100
16+
advertisementInterval: 30
17+
ASOriginationInterval: 30
18+
- nodeSelector: datacenter=ds2
19+
bgpRouter:
20+
localAS: 100
21+
neighbor:
22+
- address: 10.102.28.12
23+
remoteAS: 100
24+
advertisementInterval: 30
25+
ASOriginationInterval: 30
26+

‎docs/configure/cpx-bgp-router/ingress-example.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: extensions/v1beta1
2+
kind: Ingress
3+
metadata:
4+
name: kuard
5+
spec:
6+
rules:
7+
- host: kuard.example.com
8+
http:
9+
paths:
10+
- path: /
11+
backend:
12+
serviceName: kuard
13+
servicePort: 80

‎docs/configure/cpx-bgp-router/rbac.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
kind: ClusterRole
2+
apiVersion: rbac.authorization.k8s.io/v1beta1
3+
metadata:
4+
name: cpx-ingress-k8s-role
5+
rules:
6+
- apiGroups: [""]
7+
resources: ["endpoints", "ingresses", "pods", "secrets", "nodes", "routes", "namespaces", "configmaps"]
8+
verbs: ["get", "list", "watch"]
9+
# services/status is needed to update the loadbalancer IP in service status for integrating
10+
# service of type LoadBalancer with external-dns
11+
- apiGroups: [""]
12+
resources: ["services/status"]
13+
verbs: ["patch"]
14+
- apiGroups: [""]
15+
resources: ["services"]
16+
verbs: ["get", "list", "watch", "patch"]
17+
- apiGroups: [""]
18+
resources: ["events"]
19+
verbs: ["create"]
20+
- apiGroups: ["extensions"]
21+
resources: ["ingresses", "ingresses/status"]
22+
verbs: ["get", "list", "watch"]
23+
- apiGroups: ["apiextensions.k8s.io"]
24+
resources: ["customresourcedefinitions"]
25+
verbs: ["get", "list", "watch"]
26+
- apiGroups: ["apps"]
27+
resources: ["deployments"]
28+
verbs: ["get", "list", "watch"]
29+
- apiGroups: ["citrix.com"]
30+
resources: ["rewritepolicies", "canarycrds", "authpolicies", "ratelimits", "listeners", "httproutes"]
31+
verbs: ["get", "list", "watch"]
32+
- apiGroups: ["citrix.com"]
33+
resources: ["rewritepolicies/status", "canarycrds/status", "ratelimits/status", "authpolicies/status", "listeners/status", "httproutes/status"]
34+
verbs: ["get", "list", "patch"]
35+
- apiGroups: ["citrix.com"]
36+
resources: ["vips"]
37+
verbs: ["get", "list", "watch", "create", "delete"]
38+
- apiGroups: ["route.openshift.io"]
39+
resources: ["routes"]
40+
verbs: ["get", "list", "watch"]
41+
42+
---
43+
44+
kind: ClusterRoleBinding
45+
apiVersion: rbac.authorization.k8s.io/v1beta1
46+
metadata:
47+
name: cpx-ingress-k8s-role
48+
roleRef:
49+
apiGroup: rbac.authorization.k8s.io
50+
kind: ClusterRole
51+
name: cpx-ingress-k8s-role
52+
subjects:
53+
- kind: ServiceAccount
54+
name: cpx-ingress-k8s-role
55+
namespace: default
56+
apiVersion: rbac.authorization.k8s.io/v1
57+
58+
---
59+
60+
apiVersion: v1
61+
kind: ServiceAccount
62+
metadata:
63+
name: cpx-ingress-k8s-role
64+
namespace: default
65+
66+
---

‎docs/configure/cpx-bgp-router/service-example.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: kuard-service
5+
annotations:
6+
# This uses IPAM to allocate an IP from range 'Dev'
7+
# service.citrix.com/ipam-range: 'Dev'
8+
service.citrix.com/frontend-ip: 172.217.163.17
9+
service.citrix.com/service-type-0: 'HTTP'
10+
service.citrix.com/service-type-1: 'SSL'
11+
service.citrix.com/lbvserver: '{"80-tcp":{"lbmethod":"ROUNDROBIN"}}'
12+
service.citrix.com/servicegroup: '{"80-tcp":{"usip":"yes"}}'
13+
service.citrix.com/ssl-termination: edge
14+
service.citrix.com/monitor: '{"80-tcp":{"type":"http"}}'
15+
service.citrix.com/frontend-httpprofile: '{"dropinvalreqs":"enabled", "websocket" : "enabled"}'
16+
service.citrix.com/backend-httpprofile: '{"dropinvalreqs":"enabled", "websocket" : "enabled"}'
17+
service.citrix.com/frontend-tcpprofile: '{"ws":"enabled", "sack" : "enabled"}'
18+
service.citrix.com/backend-tcpprofile: '{"ws":"enabled", "sack" : "enabled"}'
19+
service.citrix.com/frontend-sslprofile: '{"hsts":"enabled", "tls12" : "enabled"}'
20+
service.citrix.com/backend-sslprofile: '{"tls12" : "enabled"}
21+
service.citrix.com/ssl-certificate-data-1: |
22+
-----BEGIN CERTIFICATE-----
23+
#redacted certificate
24+
-----END CERTIFICATE-----
25+
service.citrix.com/ssl-key-data-1: |
26+
-----BEGIN RSA PRIVATE KEY-----
27+
#redacted certificate
28+
-----END RSA PRIVATE KEY-----
29+
spec:
30+
type: LoadBalancer
31+
selector:
32+
app: kuard
33+
ports:
34+
- port: 80
35+
targetPort: 8080
36+
name: http
37+
- port: 443
38+
targetPort: 8443
39+
name: https
40+

0 commit comments

Comments
 (0)