Chapter 5. Securing a Service Registry deployment

Procedure

1. In the OpenShift web console, click Installed Operators and Red Hat Single Sign-On Operator, and then the Keycloak tab.

2. Click Create Keycloak to provision a new Red Hat Single Sign-On instance for securing a Service Registry deployment. You can use the default value, for example:

   apiVersion: keycloak.org/v1alpha1
   kind: Keycloak
   metadata:
     name: example-keycloak
     labels:
       app: sso
   spec:
     instances: 1
     externalAccess:
       enabled: True
     podDisruptionBudget:
       enabled: True

3. Wait until the instance has been created, and click Networking and then Routes to access the new route for the keycloak instance.
4. Click the Location URL and copy the displayed ../auth URL value for later use when deploying Service Registry.

5. Click Installed Operators and Red Hat Single Sign-On Operator, and click the Keycloak Realm tab, and then Create Keycloak Realm to create a registry example realm:

   apiVersion: keycloak.org/v1alpha1
   kind: KeycloakRealm
   metadata:
     name: registry-keycloakrealm
   spec:
     instanceSelector:
       matchLabels:
         app: sso
     realm:
       displayName: Registry
       enabled: true
       id: registry
       realm: registry
       sslRequired: none
       roles:
         realm:
           - name: sr-admin
           - name: sr-developer
           - name: sr-readonly
       clients:
         - clientId: registry-client-ui
           implicitFlowEnabled: true
           redirectUris:
             - '*'
           standardFlowEnabled: true
           webOrigins:
             - '*'
           publicClient: true
         - clientId: registry-client-api
           implicitFlowEnabled: true
           redirectUris:
             - '*'
           standardFlowEnabled: true
           webOrigins:
             - '*'
           publicClient: true
       users:
         - credentials:
             - temporary: false
               type: password
               value: changeme
           enabled: true
           realmRoles:
             - sr-admin
           username: registry-admin
         - credentials:
             - temporary: false
               type: password
               value: changeme
           enabled: true
           realmRoles:
             - sr-developer
           username: registry-developer
         - credentials:
             - temporary: false
               type: password
               value: changeme
           enabled: true
           realmRoles:
             - sr-readonly
           username: registry-user

   Important

   You must customize this KeycloakRealm resource with values suitable for your environment if you are deploying to production. You can also create and manage realms using the Red Hat Single Sign-On web console.

6. If your cluster does not have a valid HTTPS certificate configured, you can create the following HTTP Service and Ingress resources as a temporary workaround:

   1. Click Networking and then Services, and click Create Service using the following example:

      apiVersion: v1
      kind: Service
      metadata:
        name: keycloak-http
        labels:
          app: keycloak
      spec:
        ports:
          - name: keycloak-http
            protocol: TCP
            port: 8080
            targetPort: 8080
        selector:
          app: keycloak
          component: keycloak
        type: ClusterIP
        sessionAffinity: None
      status:
        loadBalancer: {}

   2. Click Networking and then Ingresses, and click Create Ingress using the following example::

      apiVersion: networking.k8s.io/v1beta1
      kind: Ingress
      metadata:
        name: keycloak-http
        labels:
          app: keycloak
      spec:
        rules:
          - host: keycloak-http.local
            http:
              paths:
                - path: /
                  pathType: ImplementationSpecific
                  backend:
                    serviceName: keycloak-http
                    servicePort: 8080

      Modify the host value to create a route accessible for the Service Registry user, and use it instead of the HTTPS route created by Red Hat Single Sign-On Operator.

7. Click the Service Registry Operator, and on the ApicurioRegistry tab, click Create ApicurioRegistry, using the following example, but replace your values in the keycloak section.

   apiVersion: registry.apicur.io/v1
   kind: ApicurioRegistry
   metadata:
     name: example-apicurioregistry-kafkasql-keycloak
   spec:
     configuration:
       security:
         keycloak:
           url: "http://keycloak-http-<namespace>.apps.<cluster host>/auth"
           # ^ Required
           # Keycloak server URL, must end with `/auth`.
           # Use an HTTP URL in development.
           realm: "registry"
           # apiClientId: "registry-client-api"
           # ^ Optional (default value)
           # uiClientId: "registry-client-ui"
           # ^ Optional (default value)
       persistence: 'kafkasql'
       kafkasql:
         bootstrapServers: '<my-cluster>-kafka-bootstrap.<namespace>.svc:9092'

Procedure

1. Generate a keystore with a self-signed certificate. You can skip this step if you are using your own certificates.

   keytool -genkey -trustcacerts -keyalg RSA -keystore registry-keystore.jks -storepass password

2. Create a new secret to hold the keystore and keystore password.

   1. In the left navigation menu of the OpenShift web console, click Workloads > Secrets > Create Key/Value Secret.

   2. Use the following values:
      Name: registry-keystore
      Key 1: keystore.jks
      Value 1: registry-keystore.jks (uploaded file)
      Key 2: password
      Value 2: password

      Note

      If you encounter a java.io.IOException: Invalid keystore format, the upload of the binary file did not work properly. As an alternative, encode the file as a base64 string using cat registry-keystore.jks | base64 -w0 > data.txt and edit the Secret resource as yaml to manually add the encoded file.

3. Edit the Deployment resource of the Service Registry instance. You can find the correct name in a status field of the Service Registry Operator.

   1. Add the keystore secret as a volume:

      template:
        spec:
          volumes:
          - name: registry-keystore-secret-volume
            secret:
            secretName: registry-keystore

   2. Add a volume mount:

      volumeMounts:
        - name: registry-keystore-secret-volume
          mountPath: /etc/registry-keystore
          readOnly: true

   3. Add JAVA_OPTIONS and KEYSTORE_PASSWORD environment variables:

      - name: KEYSTORE_PASSWORD
        valueFrom:
          secretKeyRef:
            name: registry-keystore
            key: password
      - name: JAVA_OPTIONS
          value: >-
           -Dquarkus.http.ssl.certificate.key-store-file=/etc/registry-keystore/keystore.jks
           -Dquarkus.http.ssl.certificate.key-store-file-type=jks
           -Dquarkus.http.ssl.certificate.key-store-password=$(KEYSTORE_PASSWORD)

      Note

      Order is important when using string interpolation.

   4. Enable the HTTPS port:

      ports:
        - containerPort: 8080
          protocol: TCP
        - containerPort: 8443
          protocol: TCP

4. Edit the Service resource of the Service Registry instance. You can find the correct name in a status field of the Service Registry Operator.

   ports:
     - name: http
       protocol: TCP
       port: 8080
       targetPort: 8080
     - name: https
       protocol: TCP
       port: 8443
       targetPort: 8443

5. Verify that the connection is working:

   1. Connect into a pod on the cluster using SSH (you can use the Service Registry pod):

      oc rsh -n default example-apicurioregistry-deployment-vx28s-4-lmtqb

   2. Find the cluster IP of the Service Registry pod from the Service resource (see the Location column in the web console). Afterwards, execute a test request (we are using self-signed certificate, so an insecure flag is required):

      curl -k https://172.30.209.198:8443/health
      [...]

Procedure

1. Add a second Route in addition to the HTTP route created by the Service Registry Operator. See the following example:

   kind: Route
   apiVersion: route.openshift.io/v1
   metadata:
     [...]
     labels:
       app: example-apicurioregistry
       [...]
   spec:
     host: example-apicurioregistry-default.apps.example.com
     to:
       kind: Service
       name: example-apicurioregistry-service-9whd7
       weight: 100
     port:
       targetPort: 8080
     tls:
       termination: edge
       insecureEdgeTerminationPolicy: Redirect
     wildcardPolicy: None

   Note

   Make sure the insecureEdgeTerminationPolicy: Redirect configuration property is set.

   If you do not specify a certificate, OpenShift will use a default. You can alternatively generate a custom self-signed certificate using the following commands:

   openssl genrsa 2048 > host.key &&
   openssl req -new -x509 -nodes -sha256 -days 365 -key host.key -out host.cert

   and then create a route using the OpenShift CLI:

   oc create route edge \
     --service=example-apicurioregistry-service-9whd7 \
     --cert=host.cert --key=host.key \
     --hostname=example-apicurioregistry-default.apps.example.com \
     --insecure-policy=Redirect \
     -n default