Skip to content

Commit 894d14e

Browse files
stevsmitstevsmit
authored
Merge pull request #104210 from openshift-cherrypick-robot/cherry-pick-103762-to-enterprise-4.21
[enterprise-4.21] OSDOCS-17629 updated documentation for GA
2 parents a2ac0de + bfc1d2a commit 894d14e

26 files changed

+683
-168
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1233,14 +1233,16 @@ Topics:
12331233
Topics:
12341234
- Name: Zero Trust Workload Identity Manager overview
12351235
File: zero-trust-manager-overview
1236+
- Name: Zero Trust Workload Identity Manager components
1237+
File: zero-trust-manager-components
12361238
- Name: Zero Trust Workload Identity Manager release notes
12371239
File: zero-trust-manager-release-notes
12381240
- Name: Installing Zero Trust Workload Identity Manager
12391241
File: zero-trust-manager-install
1240-
- Name: Configuring the egress proxy
1241-
File: zero-trust-manager-proxy
12421242
- Name: Deploying Zero Trust Workload Identity Manager operands
12431243
File: zero-trust-manager-configuration
1244+
- Name: Configuring the egress proxy
1245+
File: zero-trust-manager-proxy
12441246
- Name: Configuring Zero Trust Workload Identity Manager OIDC Federation
12451247
File: zero-trust-manager-oidc-federation
12461248
- Name: Configuring Zero Trust Workload Identity Manager SPIRE Federation

‎modules/zero-trust-manager-about-components.adoc‎

Lines changed: 0 additions & 30 deletions
This file was deleted.

‎modules/zero-trust-manager-about-controller-manager.adoc‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zer-trust-manager-features.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="zero-trust-manager-about-controller-manager_{context}"]
7+
= SPIRE Controller Manager
8+
9+
[role="_abstract"]
10+
Use the SPIRE Controller Manager to automate workload registration with custom resource definitions (CRDs). The manager monitors pods and CRDs to create, update, or delete entries on the SPIRE Server. This process helps ensure that your SPIRE entries accurately reflect your active resources.
11+
12+
The SPIRE Controller Manager is designed to be deployed on the same pod as the SPIRE Server. The manager communicates with the SPIRE Server API using a private UNIX Domain Socket within a shared volume.
13+

‎modules/zero-trust-manager-about-csi-driver.adoc‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zer-trust-manager-features.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="zero-trust-manager-about-csi-driver_{context}"]
7+
= SPIFFE CSI Driver
8+
9+
[role="_abstract"]
10+
The SPIFFE Container Storage Interface (CSI) driver helps pods securely obtain their {svid-full} by delivering the Workload API socket. By using Kubernetes ephemeral inline volumes, the driver simplifies how applications request temporary storage for identity management.
11+
12+
When the pod starts, the Kubelet calls the SPIFFE CSI driver to provision and mount a volume into the pod's containers. The SPIFFE CSI driver mounts a directory that contains the SPIFFE Workload API into the pod. Applications in the pod then communicate with the Workload API to obtain their SVIDs. The driver guarantees that each SVID is unique.
13+

‎modules/zero-trust-manager-about-oidc-provider.adoc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zer-trust-manager-features.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="zero-trust-manager-about-oidc-provider_{context}"]
7+
= SPIRE OpenID Connect Discovery Provider
8+
9+
[role="_abstract"]
10+
Use the SPIRE OpenID Connect (OIDC) Discovery Provider to integrate SPIRE workload identities with OIDC-compliant systems. This component exposes endpoints for token verification. It helps ensure compatibility between SPIRE-issued credentials and external APIs requiring standard OIDC tokens.
11+
12+
While SPIRE primarily issues identities for workloads, additional workload-related claims can be embedded into JWT-SVIDs through the configuration of SPIRE, which these claims to be included in the token and verified by OIDC-compliant clients.

‎modules/zero-trust-manager-available-metrics.adoc‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zer_trust_workload_identity_manager/zero-trust-manager-monitoring.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="zero-trust-manager-available-metrics_{context}"]
7+
= {zero-trust-full} monitoring available metrics
8+
9+
[role="_abstract"]
10+
Monitor the health and performance of {zero-trust-full} components by reviewing exposed metrics. This reference describes controller, certificate, and runtime metrics that help you maintain system health and troubleshoot errors.
11+
12+
The {zero-trust-full} exposes the following metrics:
13+
14+
Controller runtime metrics::
15+
16+
* `controller_runtime_active_workers`: Number of currently used workers per controller
17+
18+
* `controller_runtime_max_concurrent_reconciles`: Maximum number of concurrent reconciles per controller
19+
20+
* `controller_runtime_reconcile_errors_total`: Total number of reconciliation errors per controller
21+
22+
* `controller_runtime_reconcile_time_seconds`: Length of time per reconciliation per controller
23+
24+
* `controller_runtime_reconcile_total`: Total number of reconciliations per controller
25+
26+
Certificate watcher metrics::
27+
28+
* `certwatcher_read_certificate_errors_total`: Total number of certificate read errors
29+
30+
* `certwatcher_read_certificate_total`: Total number of certificates read
31+
32+
Go runtime metrics::
33+
34+
Standard Go runtime metrics including:
35+
36+
* `go_gc_duration_seconds`: Garbage collection duration
37+
38+
* `go_goroutines`: Number of goroutines
39+
40+
* `go_memstats_*`: Memory statistics
41+
42+
* `process_*`: Process statistics
43+
44+
Custom Operator metrics::
45+
46+
The operator also exposes custom metrics related to:
47+
48+
* SPIRE Server status and health
49+
50+
* SPIRE Agent deployment status
51+
52+
* SPIFFE CSI Driver status
53+
54+
* OIDC Discovery Provider status
55+
56+
* Workload identity management operations
57+
58+
59+
60+

‎modules/zero-trust-manager-enable-metrics-operator.adoc‎

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zer_trust_workload_identity_manager/zero-trust-manager-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-enable-metrics-operator_{context}"]
7+
= Configuring metrics collection for the Operator by using a ServiceMonitor
8+
9+
[role="_abstract"]
10+
The {zero-trust-full} exposes metrics by default on port 8443 at the `/metrics` service endpoint. You can configure metrics collection for the Operator by creating a `ServiceMonitor` custom resource (CR) that enables the Prometheus Operator to collect custom metrics. For more information, see "Configuring user workload monitoring".
11+
12+
13+
The SPIRE Server operand exposes metrics by default on port `9402` at the `/metrics` endpoint. You can configure metrics collection for the SPIRE Server by creating a `ServiceMonitor` custom resource (CR) that enables the Prometheus Operator to collect custom metrics.
14+
15+
16+
.Prerequisites
17+
18+
* You have access to the cluster as a user with the `cluster-admin` cluster role.
19+
20+
* You have installed the {zero-trust-full}.
21+
22+
* You have enabled the user workload monitoring.
23+
24+
.Procedure
25+
26+
. Configure the Operator to use HTTP or HTTPS protocols for the metrics server.
27+
28+
.. Update the subscription object for {zero-trust-full} to configure the HTTP protocol by running the following command:
29+
+
30+
[source,terminal]
31+
----
32+
$ oc -n zero-trust-workload-identity-manager patch subscription zero-trust-workload-identity-manager-subscription --type='merge' -p '{"spec":{"config":{"env":[{"name":"METRICS_BIND_ADDRESS","value":":8080"}, {"name": "METRICS_SECURE", "value": "false"}]}}}'
33+
----
34+
35+
.. Verify the {zero-trust-full} pod is redeployed and that the configured values for `METRICS_BIND_ADDRESS` and `METRICS_SECURE` is updated by running the following command:
36+
+
37+
[source,terminal]
38+
----
39+
$ oc set env --list deployment/zero-trust-workload-identity-manager-controller-manager -n zero-trust-workload-identity-manager | grep -e METRICS_BIND_ADDRESS -e METRICS_SECURE -e container
40+
----
41+
+
42+
.Example output
43+
[source,text]
44+
----
45+
deployments/zero-trust-workload-identity-manager-controller-manager, container manager
46+
METRICS_BIND_ADDRESS=:8080
47+
METRICS_SECURE=false
48+
----
49+
50+
. Create the `Secret` resource with `kubernetes.io/service-account.name` annotation to inject the token required for authenticating with the metrics server.
51+
52+
.. Create the `secret-zero-trust-workload-identity-manager.yaml` YAML file:
53+
+
54+
[source,yaml]
55+
----
56+
apiVersion: v1
57+
kind: Secret
58+
metadata:
59+
labels:
60+
name: zero-trust-workload-identity-manager
61+
name: zero-trust-workload-identity-manager-metrics-auth
62+
namespace: zero-trust-workload-identity-manager
63+
annotations:
64+
kubernetes.io/service-account.name: zero-trust-workload-identity-manager-controller-manager
65+
type: kubernetes.io/service-account-token
66+
----
67+
68+
.. Create the `Secret` resource by running the following command:
69+
+
70+
[source,terminal]
71+
----
72+
$ oc apply -f secret-zero-trust-workload-identity-manager.yaml
73+
----
74+
75+
. Create the `ClusterRoleBinding` resource required for granting permissions to access the metrics.
76+
77+
.. Create the `clusterrolebinding-zero-trust-workload-identity-manager.yaml` YAML file:
78+
+
79+
[source,yaml]
80+
----
81+
apiVersion: rbac.authorization.k8s.io/v1
82+
kind: ClusterRoleBinding
83+
metadata:
84+
labels:
85+
name: zero-trust-workload-identity-manager
86+
name: zero-trust-workload-identity-manager-allow-metrics-access
87+
roleRef:
88+
apiGroup: rbac.authorization.k8s.io
89+
kind: ClusterRole
90+
name: zero-trust-workload-identity-manager-metrics-reader
91+
subjects:
92+
- kind: ServiceAccount
93+
name: zero-trust-workload-identity-manager-controller-manager
94+
namespace: zero-trust-workload-identity-manager
95+
----
96+
97+
.. Create the `ClusterRoleBinding` resource by running the following command:
98+
+
99+
[source,terminal]
100+
----
101+
$ oc apply -f clusterrolebinding-zero-trust-workload-identity-manager.yaml
102+
----
103+
104+
. Create the following `ServiceMonitor` CR if the metrics server is configured to use `http`.
105+
106+
.. Create the `servicemonitor-zero-trust-workload-identity-manager-http.yaml` YAML file:
107+
+
108+
[source,yaml]
109+
----
110+
apiVersion: monitoring.coreos.com/v1
111+
kind: ServiceMonitor
112+
metadata:
113+
labels:
114+
name: zero-trust-workload-identity-manager
115+
name: zero-trust-workload-identity-manager-metrics-monitor
116+
namespace: zero-trust-workload-identity-manager
117+
spec:
118+
endpoints:
119+
- authorization:
120+
credentials:
121+
name: zero-trust-workload-identity-manager-metrics-auth
122+
key: token
123+
type: Bearer
124+
interval: 60s
125+
path: /metrics
126+
port: metrics-http
127+
scheme: http
128+
scrapeTimeout: 30s
129+
namespaceSelector:
130+
matchNames:
131+
- zero-trust-workload-identity-manager
132+
selector:
133+
matchLabels:
134+
name: zero-trust-workload-identity-manager
135+
----
136+
137+
.. Create the `ServiceMonitor` CR by running the following command:
138+
+
139+
[source,terminal]
140+
----
141+
$ oc apply -f servicemonitor-zero-trust-workload-identity-manager-http.yaml
142+
----
143+
. Create the following `ServiceMonitor` CR if the metrics server is configured to use `https`.
144+
145+
.. Create the `servicemonitor-zero-trust-workload-identity-manager-https.yaml` YAML file:
146+
+
147+
[source,yaml]
148+
----
149+
apiVersion: monitoring.coreos.com/v1
150+
kind: ServiceMonitor
151+
metadata:
152+
labels:
153+
name: zero-trust-workload-identity-manager
154+
name: zero-trust-workload-identity-manager-metrics-monitor
155+
namespace: zero-trust-workload-identity-manager
156+
spec:
157+
endpoints:
158+
- authorization:
159+
credentials:
160+
name: zero-trust-workload-identity-manager-metrics-auth
161+
key: token
162+
type: Bearer
163+
interval: 60s
164+
path: /metrics
165+
port: metrics-https
166+
scheme: https
167+
scrapeTimeout: 30s
168+
tlsConfig:
169+
ca:
170+
configMap:
171+
name: openshift-service-ca.crt
172+
key: service-ca.crt
173+
serverName: zero-trust-workload-identity-manager-metrics-service.zero-trust-workload-identity-manager.svc.cluster.local
174+
namespaceSelector:
175+
matchNames:
176+
- zero-trust-workload-identity-manager
177+
selector:
178+
matchLabels:
179+
name: zero-trust-workload-identity-manager
180+
----
181+
182+
.. Create the `ServiceMonitor` CR by running the following command:
183+
+
184+
[source,terminal]
185+
----
186+
$ oc apply -f servicemonitor-zero-trust-workload-identity-manager-https.yaml
187+
----
188+
+
189+
After the `ServiceMonitor` CR is created, the user workload Prometheus instance begins metrics collection from the SPIRE Server. The collected metrics are labeled with `job="zero-trust-workload-identity-manager-metrics-service"`.
190+
191+
.Verification
192+
193+
. In the {product-title} web console, navigate to *Observe* → *Targets*.
194+
195+
. In the *Label* filter field, enter the following label to filter the metrics targets:
196+
+
197+
[source,terminal]
198+
----
199+
$ service=zero-trust-workload-identity-manager-metrics-service
200+
----
201+
202+
. Confirm that the *Status* column shows `Up` for the `zero-trust-workload-identity-manager` entry.
203+

‎modules/zero-trust-manager-enable-metrics-server.adoc‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,10 @@
44

55
:_mod-docs-content-type: PROCEDURE
66
[id="zero-trust-manager-enable-metrics-server_{context}"]
7-
= Configuring metrics collection for SPIRE Server by using a Service Monitor
7+
= Configuring metrics collection for SPIRE Server by using a ServiceMonitor
8+
9+
[role="_abstract"]
10+
To collect custom metrics from the SPIRE Server, create a ServiceMonitor custom resource (CR). This configuration enables the Prometheus Operator to scrape metrics from the default endpoint, which helps you monitor your SPIRE deployment.
811

912
The SPIRE Server operand exposes metrics by default on port `9402` at the `/metrics` endpoint. You can configure metrics collection for the SPIRE Server by creating a `ServiceMonitor` custom resource (CR) that enables the Prometheus Operator to collect custom metrics.
1013

@@ -31,8 +34,8 @@ apiVersion: monitoring.coreos.com/v1
3134
kind: ServiceMonitor
3235
metadata:
3336
labels:
34-
app.kubernetes.io/name: server
35-
app.kubernetes.io/instance: spire
37+
app.kubernetes.io/name: server
38+
app.kubernetes.io/instance: spire
3639
name: spire-server-metrics
3740
namespace: zero-trust-workload-identity-manager
3841
spec:
@@ -70,3 +73,4 @@ $ service=zero-trust-workload-identity-manager-metrics-service
7073
----
7174

7275
. Confirm that the *Status* column shows `Up` for the `spire-server-metrics` entry.
76+

‎modules/zero-trust-manager-how-it-works.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
[id="zero-trust-manager-how-it-works_{context}"]
77
= About the {zero-trust-full} workflow
88

9+
[role="_abstract"]
10+
Understand the high-level workflow of {zero-trust-full} to help you manage secure identities. This process relies on SPIRE components and custom resource definitions (CRDs) to validate nodes and workloads.
911

1012
The following is a high-level workflow of the {zero-trust-full} within the Red{nbsp}Hat OpenShift cluster.
1113

0 commit comments

Comments
 (0)