{"id":19963684,"url":"https://github.com/cyberark/conjur-authn-k8s-client","last_synced_at":"2025-04-05T09:08:50.605Z","repository":{"id":37792240,"uuid":"132513819","full_name":"cyberark/conjur-authn-k8s-client","owner":"cyberark","description":"Authentication sidecar for Conjur Kubernetes integration.","archived":false,"fork":false,"pushed_at":"2025-01-03T16:00:45.000Z","size":19210,"stargazers_count":12,"open_issues_count":31,"forks_count":16,"subscribers_count":15,"default_branch":"master","last_synced_at":"2025-03-29T08:08:50.137Z","etag":null,"topics":["conjbot-notify","conjur","core","kubernetes","sidecar"],"latest_commit_sha":null,"homepage":"https://www.conjur.org","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cyberark.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-05-07T20:37:04.000Z","updated_at":"2025-01-03T16:00:48.000Z","dependencies_parsed_at":"2023-02-16T09:31:12.573Z","dependency_job_id":"e6bdda2a-ce2c-4397-90ea-d48d5d4690f5","html_url":"https://github.com/cyberark/conjur-authn-k8s-client","commit_stats":null,"previous_names":[],"tags_count":128,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cyberark%2Fconjur-authn-k8s-client","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cyberark%2Fconjur-authn-k8s-client/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cyberark%2Fconjur-authn-k8s-client/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cyberark%2Fconjur-authn-k8s-client/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cyberark","download_url":"https://codeload.github.com/cyberark/conjur-authn-k8s-client/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247312081,"owners_count":20918344,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["conjbot-notify","conjur","core","kubernetes","sidecar"],"created_at":"2024-11-13T02:16:48.659Z","updated_at":"2025-04-05T09:08:50.528Z","avatar_url":"https://github.com/cyberark.png","language":"Shell","funding_links":[],"categories":["Secret Management"],"sub_categories":[],"readme":"# conjur-authn-k8s-client\n\nAvailable images:\n- [DockerHub](https://hub.docker.com/r/cyberark/conjur-authn-k8s-client)\n- [RedHat Container Registry](https://catalog.redhat.com/software/containers/cyberark/conjur-openshift-authenticator/5c67286cecb5240adf708252)\n\n## What's inside ?\n\nThe Conjur authenticator client is designed to have a light footprint both in terms of storage and memory consumption. It has very few components:\n\n+ A static binary for the authenticator\n+ The `sleep` binary from busybox for debugging\n+ The `tar` binary from busybox to meet the requirement of the authentication service\n\n## Configuration\n\nThe client is configured entirely through environment variables. These are listed below.\n\n### Using conjur-authn-k8s-client with Conjur Open Source \n\nAre you using this project with [Conjur Open Source](https://github.com/cyberark/conjur)? Then we \n**strongly** recommend choosing the version of this project to use from the latest [Conjur OSS \nsuite release](https://docs.conjur.org/Latest/en/Content/Overview/Conjur-OSS-Suite-Overview.html). \nConjur maintainers perform additional testing on the suite release versions to ensure \ncompatibility. When possible, upgrade your Conjur version to match the \n[latest suite release](https://docs.conjur.org/Latest/en/Content/ReleaseNotes/ConjurOSS-suite-RN.htm); \nwhen using integrations, choose the latest suite release that matches your Conjur version. For any \nquestions, please contact us on [Discourse](https://discuss.cyberarkcommons.org/c/conjur/5).\n\n## Orchestrator\n- `MY_POD_NAME`: Pod name (see [downwards API](https://kubernetes.io/docs/tasks/inject-data-application/environment-variable-expose-pod-information))\n- `MY_POD_NAMESPACE`: Pod namespace (see [downwards API](https://kubernetes.io/docs/tasks/inject-data-application/environment-variable-expose-pod-information))\n- `CONTAINER_MODE`: Set this to `init` to run as an init container that will exit after performing authentication. All other values (including blank) will cause the container to run as a sidecar.\n\n## Conjur\n- `CONJUR_ACCOUNT`: Conjur account name\n- `CONJUR_AUTHN_URL`: URL pointing to authenticator service endpoint\n- `CONJUR_AUTHN_LOGIN`: Host login for pod e.g. `namespace/service_account/some_service_account`\n- `CONJUR_SSL_CERTIFICATE`: Public SSL cert for Conjur connection\n- `CONJUR_TOKEN_TIMEOUT`: Timeout for fetching a new token (defaults to 6 minutes). \n                          In most cases, this variable should not be modified. The value should be in a\n                          format that can be parsed with [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) (e.g \"6m0s\")\n\nFlow:\n\nThe client's process logs its flow to `stdout` and `stderr`.\n+ Exponential backoff is exercised when an error occurs\n+ Client will re-login when certificate has expired\n\n1. Client goes through login by presenting certificate signing request (CSR) -\u003e Server (authn-k8s or authn-jwt running inside the Conjur Enterprise) injects signed client certificate out of band into requesting pod\n1. Client picks up signed client certificate, deletes it from disk and uses to authenticator via mutual TLS -\u003e Server responds with auth token (retrieved via authn-local) encrypted with the public key of the client.\n1. Client decrypts the auth token and writes it to to the shared memory volume (`/run/conjur/access-token`)\n1. Client proceeds to authenticate time and time again\n\n## Running Authenticator Client with a Non-Default User ID in Kubernetes\n\nBy default, the Conjur Kubernetes authenticator client container runs using\na default username `authenticator`, user ID `777`, and group ID `777`.\n\nIf you would like to run the authenticator client on a *non-OpenShift*\nKubernetes platform, using a non-default user and/or group ID in a Pod that\nincludes the authenticator client as a sidecar or init container, then you\ncan configure your Pod manifest as follows:\n\n_**NOTE:** This technique is not supported on OpenShift platforms. For\n   OpenShift platforms, the authenticator container should be run\n   with the container's default user and group._\n\n- Configure the\n  [Pod's Security Context](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#podsecuritypolicy-v1beta1-policy)\n  for the desired user ID / group ID. Setting the `fsGroup` to the desired\n  user group will cause Kubernetes to set that group as the owner of\n  any files that are created in volumes of type `emptyDir`, including the\n  authenticator client's SSL certificate and the application's Conjur access\n  token.\n\n  For example, to run with a user ID of `65534` (the `nobody` user) and a\n  group ID of `65534` (the `nobody` group):\n\n  ```\n        securityContext:\n          fsGroup: 65534\n          runAsGroup: 65534\n          runAsNonRoot: true\n          runAsUser: 65534\n  ```\n\n- Include a `volumeMount` for the authenticator client certificate directory:\n\n  ```\n          volumeMounts:\n          - name: client-ssl\n            mountPath: /etc/conjur/ssl\n  ```\n\n- Include an `emptyDir` volume for the authenticator client certificate\n  directory. Using a volume of type `emptyDir` allows the client certificate\n  file to be created with its group owner set to the value of `fsGroup` as\n  configured in the above PodSecurityContext:\n\n  ```\n          volumes:\n          - name: client-ssl\n            emptyDir:\n              medium: Memory\n  ```\n\n## Contributing\n\nWe welcome contributions of all kinds to this repository. For instructions on how to get started and descriptions of our development workflows, please see our [contributing\nguide][contrib].\n\n[contrib]: https://github.com/cyberark/conjur-authn-k8s-client/blob/master/CONTRIBUTING.md\n\n## Update postgresql chart for testing\n```\nhelm repo add bitnami https://charts.bitnami.com/bitnami\nhelm repo update\nhelm pull bitnami/postgresql --version \u003cversion to update to\u003e\ncp postgresql-\u003cversion\u003e.tgz vendor_helm/.\n```\n\nUpdate `bin/test-workflow/6_app_deploy_backend.sh` to reference the new file","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyberark%2Fconjur-authn-k8s-client","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcyberark%2Fconjur-authn-k8s-client","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyberark%2Fconjur-authn-k8s-client/lists"}