Skip to content

Commit 9ae5874

Browse files
stevsmitstevsmit
authored
Merge pull request #101072 from wgabor0427/OSDOCS-16038_v1
OSDOCS-16038_v1 created doc for egress proxy and proxy considerations
2 parents aca0b43 + c0c2ad6 commit 9ae5874

File tree

5 files changed

+122
-0
lines changed

5 files changed

+122
-0
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1258,6 +1258,8 @@ Topics:
12581258
File: external-secrets-operator-install
12591259
- Name: Configuring Network Policy for the Operand
12601260
File: external-secrets-operator-config-net-policy
1261+
- Name: Configuring the egress proxy
1262+
File: external-secrets-operator-proxy
12611263
- Name: Uninstalling the External Secrets Operator
12621264
File: external-secrets-operator-uninstall
12631265
- Name: External Secrets Operator APIs

‎modules/external-secrets-operator-configure-proxy.adoc‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-proxy.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-operator-configure-proxy_{context}"]
7+
= Configuring the egress proxy for the {external-secrets-operator}
8+
9+
The egress proxy can be configured in the `ExternalSecretsConfig` or the `ExternalSecretsManager` custom resource (CR). The Operator and the operand make use of the {product-title} supported certificate authority (CA) bundle for the proxy validations.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
* You have created the `ExternalSecretsConfig` custom CR.
16+
17+
.Procedure
18+
19+
* To set the proxy in the `ExternalSecretsConfig` resource, perform the following steps:
20+
21+
. Edit the `ExternalSecretsConfig` resource by running the following command:
22+
+
23+
[source,terminal]
24+
----
25+
$ oc edit externalsecretsconfigs.operator.openshift.io cluster
26+
----
27+
28+
. Edit the `spec.appConfig.proxy` section to set the proxy values as follows:
29+
+
30+
[source,yaml]
31+
----
32+
apiVersion: operator.openshift.io/v1alpha1
33+
kind: ExternalSecretsConfig
34+
...
35+
spec:
36+
appConfig:
37+
proxy:
38+
httpProxy: <http_proxy>
39+
httpsProxy: <https_proxy>
40+
noProxy: <no_proxy>
41+
----
42+
43+
where:
44+
45+
<http_proxy>:: Specifies the proxy URL for the http requests.
46+
47+
<https_proxy>:: Proxy URL for the https requests.
48+
49+
<no_proxy>:: Comma-separated list of hostnames, CIDRs, IPs or a combination of these, for which the proxy should not be used.
50+
51+
* To set the proxy in the `ExternalSecretsManager` CR, perform the following steps.
52+
53+
. Edit the `ExternalSecretsManager` CR by running the following command:
54+
+
55+
[source,terminal]
56+
----
57+
$ oc edit externalsecretsmanagers.operator.openshift.io cluster
58+
----
59+
60+
. Edit the `spec.globalConfig.proxy` section to set the proxy values as follows:
61+
+
62+
[source,yaml]
63+
----
64+
apiVersion: operator.openshift.io/v1alpha1
65+
kind: ExternalSecretsManager
66+
...
67+
spec:
68+
globalConfig:
69+
proxy:
70+
httpProxy: <http_proxy>
71+
httpsProxy: <https_proxy>
72+
noProxy: <no_proxy>
73+
----
74+
75+
where:
76+
77+
<http_proxy>:: Specifies the proxy URL for the http requests.
78+
79+
<https_proxy>:: Proxy URL for the https requests.
80+
81+
<no_proxy>:: Comma-separated list of hostnames, CIDRs, IPs or a combination of these for which the proxy should not be used.
82+

‎modules/external-secrets-operator-proxy-considerations.adoc‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/index.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="external-secrets-operator-proxy-considerations_{context}"]
7+
= Security considerations
8+
9+
When using the {external-secrets-operator}, there are some security concerns you should consider:
10+
11+
* The `external-secrets` operand fetches the secrets from the configured external providers and stores it in a Kubernetes native `Secrets` resource. This results in a secret zero problem. It is recommended to secure the secret objects using additional encryption. For more information, see link:https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.9/html/planning_your_deployment/security-considerations_rhodf#data-encryption-options_rhodf[Data encryption options].
12+
13+
* When configuring `SecretStore` and `ClusterSecretStore` resources, consider using short-term credential-based authorization. This approach enhances security by limiting the window of opportunity for unauthorized access, even if credentials are compromised.
14+
15+
* To enhance the security of the {external-secrets-operator}, it is crucial to implement role-based access controls (RBACs). These RBACs should define and limit access to the custom resources provided by the {external-secrets-operator-short}.

‎security/external_secrets_operator/external-secrets-operator-proxy.adoc‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="external-secrets-operator-proxy"]
3+
= About the egress proxy for the {external-secrets-operator}
4+
include::_attributes/common-attributes.adoc[]
5+
:context: external-secrets-operator-proxy
6+
7+
toc::[]
8+
9+
If a cluster-wide egress proxy is configured in {product-title}, Operator Lifecycle Manager (OLM) automatically configures Operators that it manages with the cluster-wide proxy. OLM automatically updates all of the Operator’s deployments with the `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY` environment variables.
10+
11+
// Configure egress proxy
12+
include::modules/external-secrets-operator-configure-proxy.adoc[leveloffset=+1]
13+
14+
[role="_additional-resources"]
15+
[id="external-resources-operator-proxy_additional-resources"]
16+
== Additional resources
17+
18+
* xref:../../operators/admin/olm-configuring-proxy-support.adoc#olm-configuring-proxy-support[Configuring proxy support in Operator Lifecycle Manager]

‎security/external_secrets_operator/index.adoc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ include::modules/external-secrets-test-coverage.adoc[leveloffset=+1]
2020
//FIPS compliant support
2121
include::modules/external-secrets-fips-support.adoc[leveloffset=+1]
2222

23+
//egress proxy security considerations
24+
include::modules/external-secrets-operator-proxy-considerations.adoc[leveloffset=+1]
25+
2326
[role="_additional-resources"]
2427
[id="external-secrets-operator-about_additional-resources"]
2528
== Additional resources
@@ -28,3 +31,5 @@ include::modules/external-secrets-fips-support.adoc[leveloffset=+1]
2831
* xref:../../security/container_security/security-compliance.adoc#security-compliance[Understanding compliance]
2932
* xref:../../installing/overview/installing-fips.adoc#installing-fips-mode_installing-fips[Installing a cluster in FIPS mode]
3033
* xref:../../installing/overview/installing-preparing.adoc#installing-preparing-security[Do you need extra security for your cluster?]
34+
* link:https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.19/html/planning_your_deployment/security-considerations_rhodf[Security considerations]
35+
* link:https://external-secrets.io/latest/guides/security-best-practices/[Security Best Practices]

0 commit comments

Comments
 (0)