sia

README

SIA for AWS EKS

Configuration

SIA EKS requires a configuration file to be present in the /etc/sia/sia_config with the following required attributes:

{
    "version": "1.0.0",
    "service": "application-service-name",
    "accounts": [
        {
            "domain":  "application-domain-name",
            "account": "application-account-aws-id"
        }
    ]
}

The AWS Account administrator must create an IAM Role called <application-domain-name>.<application-service-name> and this role must be setup with a trust relationship configured with trusted entity as the role name for EKS IAM Role for Kubernetes Service Account, which will be used by the application.

SIA Configuration file provides a way to change the default user/group settings that the private key is owned by. By default, the private key is owned by user root and readable by group athenz. If the user wants to provide access to their service identity private key to another user, it can be accomplished by adding the user to the group athenz. If the user wants to change the user and group values, a config file must contain following optional fields:

{
    "version": "1.0.0",
    "service": "application-service-name",
    "accounts": [
        {
            "domain":  "application-domain-name",
            "account": "application-account-aws-id",
            "user": "unix-username",
            "group": "unix-groupname"
        }
    ]
}

SIA-EKS can be built with following parameters - e.g.

GOOS=linux go install -ldflags "-X main.Version=1.0.0 -X main.ZtsEndPoint=zts.athenz.io -X main.DnsDomain=aws.athenz.cloud -X main.ProviderPrefix=athenz.aws" ./...

alternatively, those parameters can be passed during runtime and runtime parameters will take precedence over build time parameters.

Documentation

Index

• func GetEKSAccessProfile(configFile, metaEndpoint string, useRegionalSTS bool, region string) (*options.AccessProfileConfig, error)
• func GetEKSConfig(configFile, profileConfigFile, metaEndpoint string, useRegionalSTS bool, ...) (*options.Config, *options.ConfigAccount, *options.AccessProfileConfig, error)
• func GetEKSPodId() string
• type EKSProvider
  • func (eks EKSProvider) AttestationData(svc string, key crypto.PrivateKey, sigInfo *signature.SignatureInfo) (string, error)
  • func (eks EKSProvider) CloudAttestationData(base, svc, ztSserverName string) (string, error)
  • func (tp EKSProvider) GetAccessManagementProfileFromMeta(base string) (string, error)
  • func (eks EKSProvider) GetAccountDomainServiceFromMeta(base string) (string, string, string, error)
  • func (eks EKSProvider) GetCsrDn() pkix.Name
  • func (eks EKSProvider) GetEmail(service string) []string
  • func (eks EKSProvider) GetHostname() string
  • func (eks EKSProvider) GetName() string
  • func (eks EKSProvider) GetRoleDnsNames(cert *x509.Certificate, service string) []string
  • func (eks EKSProvider) GetSanDns(service string, includeHost bool, wildcard bool, cnames []string) []string
  • func (eks EKSProvider) GetSanIp(docIp map[string]bool, ips []net.IP, opts ip.Opts) []net.IP
  • func (eks EKSProvider) GetSanUri(svc string, opts ip.Opts) []*url.URL
  • func (eks EKSProvider) GetSuffix() string
  • func (eks EKSProvider) PrepareKey(file string) (crypto.PrivateKey, error)

Functions

func GetEKSAccessProfile

func GetEKSAccessProfile(configFile, metaEndpoint string, useRegionalSTS bool, region string) (*options.AccessProfileConfig, error)

func GetEKSConfig

func GetEKSConfig(configFile, profileConfigFile, metaEndpoint string, useRegionalSTS bool, region string) (*options.Config, *options.ConfigAccount, *options.AccessProfileConfig, error)

func GetEKSPodId

func GetEKSPodId() string

Types

type EKSProvider

type EKSProvider struct {
	Name string
}

func (EKSProvider) AttestationData

func (eks EKSProvider) AttestationData(svc string, key crypto.PrivateKey, sigInfo *signature.SignatureInfo) (string, error)

func (EKSProvider) CloudAttestationData

func (eks EKSProvider) CloudAttestationData(base, svc, ztSserverName string) (string, error)

func (EKSProvider) GetAccessManagementProfileFromMeta

func (tp EKSProvider) GetAccessManagementProfileFromMeta(base string) (string, error)

func (EKSProvider) GetAccountDomainServiceFromMeta

func (eks EKSProvider) GetAccountDomainServiceFromMeta(base string) (string, string, string, error)

func (EKSProvider) GetCsrDn

func (eks EKSProvider) GetCsrDn() pkix.Name

func (EKSProvider) GetEmail

func (eks EKSProvider) GetEmail(service string) []string

func (EKSProvider) GetHostname

func (eks EKSProvider) GetHostname() string

GetHostname returns the hostname as per the provider

func (EKSProvider) GetName

func (eks EKSProvider) GetName() string

GetName returns the name of the current provider

func (EKSProvider) GetRoleDnsNames

func (eks EKSProvider) GetRoleDnsNames(cert *x509.Certificate, service string) []string

func (EKSProvider) GetSanDns

func (eks EKSProvider) GetSanDns(service string, includeHost bool, wildcard bool, cnames []string) []string

func (EKSProvider) GetSanIp

func (eks EKSProvider) GetSanIp(docIp map[string]bool, ips []net.IP, opts ip.Opts) []net.IP

func (EKSProvider) GetSanUri

func (eks EKSProvider) GetSanUri(svc string, opts ip.Opts) []*url.URL

func (EKSProvider) GetSuffix

func (eks EKSProvider) GetSuffix() string

func (EKSProvider) PrepareKey

func (eks EKSProvider) PrepareKey(file string) (crypto.PrivateKey, error)