Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-05-02 14:26:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

docs: clarify permissions on install page (#184)

Browse source 
* docs: clarify permissions on install page

* docs: remove default attribute from tabs

* docs: publish to 2.0
This commit is contained in:
Thomas Tendyck 2022-09-21 16:58:04 +02:00 • committed by GitHub
parent 029e6783a3
commit 811ccc80a3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
18 changed files with 128 additions and 136 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/versioned_docs/version-2.0/getting-started/first-steps.md
View file

@ -7,7 +7,7 @@ The following steps guide you through the process of creating a cluster and depl
1. Create the configuration file for your selected cloud provider.
<tabs groupId="csp">
<tabItem value="azure" label="Azure" default>
<tabItem value="azure" label="Azure">
```bash
constellation config generate azure
@ -28,7 +28,7 @@ The following steps guide you through the process of creating a cluster and depl
2. Fill in your cloud provider specific information.
<tabs groupId="csp">
<tabItem value="azure" label="Azure (CLI)" default>
<tabItem value="azure" label="Azure (CLI)">
You need several resources for the cluster. You can use the following `az` script to create them:

88
docs/versioned_docs/version-2.0/getting-started/install.md
View file

@ -1,17 +1,17 @@
# Installation and Setup
# Installation and setup
Constellation runs entirely in your cloud environment and can be easily controlled via a dedicated Command Line Interface (CLI).
Constellation runs entirely in your cloud environment and can be controlled via a dedicated command-line interface (CLI).
The following guides you through the steps of installing the CLI on your machine, verifying it, and connecting it to your Cloud Service Provider (CSP).
The following guides you through the steps of installing the CLI on your machine, verifying it, and connecting it to your cloud service provider (CSP).
### Prerequisites
## Prerequisites
Make sure the following requirements are met:
- Your machine is running Linux or macOS
- You have admin rights on your machine
- [kubectl](https://kubernetes.io/docs/tasks/tools/) is installed
- Your cloud provider is Microsoft Azure or Google Cloud Platform (GCP)
- Your CSP is Microsoft Azure or Google Cloud Platform (GCP)
## Install the Constellation CLI
@ -100,18 +100,47 @@ The CLI supports autocompletion for various shells. To set it up, run `constella
## Set up cloud credentials
The CLI makes authenticated calls to the CSP API. Therefore, you need to set up Constellation with the credentials for your CSP. Currently, Microsoft Azure and Google Cloud Platform (GCP) are the only supported CSPs.
The CLI makes authenticated calls to the CSP API. Therefore, you need to set up Constellation with the credentials for your CSP.
### Step 1: Authenticate
### Required permissions
First, you need to authenticate with your CSP. The following lists the required steps for *testing* and *production* environments.
<tabs groupId="csp">
<tabItem value="azure" label="Azure">
You need the following permissions for your user account:
- `Contributor` (to create cloud resources)
- `User Access Administrator` (to create a service account)
If you don't have these permissions with scope *subscription*, ask your administrator to [create the service account and a resource group for your Constellation cluster](first-steps.md).
Your user account needs the `Contributor` permission scoped to this resource group.
</tabItem>
<tabItem value="gcp" label="GCP">
Create a new project for Constellation or use an existing one.
Enable the [Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com) on it.
You need the following permissions on this project:
- `compute.*` (or the subset defined by `roles/compute.instanceAdmin.v1`)
- `iam.serviceAccountUser`
Follow Google's guide on [understanding](https://cloud.google.com/iam/docs/understanding-roles) and [assigning roles](https://cloud.google.com/iam/docs/granting-changing-revoking-access).
</tabItem>
</tabs>
### Authentication
You need to authenticate with your CSP. The following lists the required steps for *testing* and *production* environments.
:::danger
The steps for a *testing* environment are simpler. However, they may expose secrets to the CSP. If in doubt, follow the *production* steps.
:::
<tabs groupId="csp">
<tabItem value="azure" label="Azure" default>
<tabItem value="azure" label="Azure">
**Testing**
@ -128,23 +157,15 @@ az login
Other options are described in Azure's [authentication guide](https://docs.microsoft.com/en-us/cli/azure/authenticate-azure-cli).
</tabItem>
<tabItem value="gcp" label="GCP" default>
Enable the following cloud APIs first:
- [Compute Engine API](https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com)
- [Cloud Resource Manager API](https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com)
- [Identity and Access Management (IAM) API](https://console.developers.google.com/apis/api/iam.googleapis.com)
<tabItem value="gcp" label="GCP">
**Testing**
If you are running from within VM on GCP, and the VM is allowed to access the necessary APIs, no further configuration is needed.
If you are using the [Google Cloud Shell](https://cloud.google.com/shell), make sure your [session is authorized](https://cloud.google.com/shell/docs/auth). For example, execute `gsutil` and accept the authorization prompt.
You can use the [Google Cloud Shell](https://cloud.google.com/shell). Make sure your [session is authorized](https://cloud.google.com/shell/docs/auth). For example, execute `gsutil` and accept the authorization prompt.
**Production**
For production, use one of the following options on a trusted machine:
Use one of the following options on a trusted machine:
- Use the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud)
@ -162,31 +183,6 @@ For production, use one of the following options on a trusted machine:
</tabItem>
</tabs>
### Step 2: Set permissions
Finally, set the required permissions for your user account.
<tabs groupId="csp">
<tabItem value="azure" label="Azure" default>
Set the following permissions:
- `Contributor`
- `User Access Administrator`
</tabItem>
<tabItem value="gcp" label="GCP" default>
Set the following permissions:
- `compute.*` (or the subset defined by `roles/compute.instanceAdmin.v1`)
- `iam.serviceAccountUser`
Follow Google's guide on [understanding](https://cloud.google.com/iam/docs/understanding-roles) and [assigning roles](https://cloud.google.com/iam/docs/granting-changing-revoking-access).
</tabItem>
</tabs>
### Next Steps
## Next steps
You are now ready to [deploy your first confidential Kubernetes cluster and application](first-steps.md).