Marco AUTH

Google Cloud Function for Marco Auth

Development

Generate RS256 Keypair for signing and validating JWT value token

ssh-keygen -t rsa -b 2048 -f jwtRS256.key
# Don't add passphrase
openssl rsa -in jwtRS256.key -pubout -outform PEM -out jwtRS256.key.pub
cat jwtRS256.key
cat jwtRS256.key.pub

Start Redis Server with Docker:

docker run --name redis -p 6379:6379 -d redis:4-alpine

Environment Variables Configuration

View required variables on .env.example

Docker Image Launch

Build Docker Image

export NPM_TOKEN=00000000-0000-0000-0000-000000000000
export GCP_TESTING_SERVICE_ACCOUNT_CREDENTIALS=base64_encoded_service_account_key_json
export JWT_TESTING_PRIV_KEY=base64_encoded_jwt_priv_key
export JWT_TESTING_PUB_KEY=base64_encoded_jwt_pub_key

docker build \
--build-arg NPM_TOKEN=$NPM_TOKEN \
--build-arg GCP_TESTING_SERVICE_ACCOUNT_CREDENTIALS=$GCP_TESTING_SERVICE_ACCOUNT_CREDENTIALS \
--build-arg JWT_TESTING_PRIV_KEY=$JWT_TESTING_PRIV_KEY \
--build-arg JWT_TESTING_PUB_KEY=$JWT_TESTING_PUB_KEY \
-t finboot/marco-auth .

Create .env file from .env.example and configure it.

cp .env.example .env

Launch docker container

docker run --name marco-auth --env-file .docker-run-env -p 3000:3000 -d finboot/marco-auth

Continuous Delivery Configuration

Secure Build on GCP Container Build

Create KMS Keys to encrypt sensitive files and variables and configure it to be available at build by cloudbuild.yaml

gcloud kms keyrings create finboot-marco-prod  --location=global --project=finboot-kms-resources
gcloud kms keys create finboot-marco-auth-cloudbuild-secrets --location=global --keyring=finboot-marco-prod --purpose=encryption --project=finboot-kms-resources
gcloud kms keys add-iam-policy-binding finboot-marco-auth-cloudbuild-secrets --location=global --keyring=finboot-marco-prod --member=serviceAccount:[email protected] --role=roles/cloudkms.cryptoKeyEncrypterDecrypter --project=finboot-kms-resources
gcloud kms keys add-iam-policy-binding finboot-marco-auth-cloudbuild-secrets --location=global --keyring=finboot-marco-prod --member=serviceAccount:[email protected] --role=roles/cloudkms.cryptoKeyEncrypterDecrypter --project=finboot-kms-resources

Encrypt sensitive files to be decrypted by cloudbuild.yaml

gcloud kms encrypt \
  --plaintext-file=.gcpserviceaccount-<env>.json \
  --ciphertext-file=.gcpserviceaccount-<env>.json.enc \
  --location=global \
  --keyring=finboot-marco-prod \
  --key=finboot-marco-auth-cloudbuild-secrets \
  --project=finboot-kms-resources
  
gcloud kms encrypt \
  --plaintext-file=.npmtoken-prod \
  --ciphertext-file=.npmtoken-prod.enc \
  --location=global \
  --keyring=finboot-marco-prod \
  --key=finboot-marco-auth-cloudbuild-secrets \
  --project=finboot-kms-resources

Configure Kubernetes Cluster for new Deployment

Manage SSL Certificate using Let's Encrypt certbot:

# If a certificate already exists and needs to be renewed:
certbot renew

# For generate new SSL Certificate using Let's Encrypt certbot:
certbot -d auth.marco.finboot.com --manual --preferred-challenges dns certonly

# After having the certificate generate a Kubernetes secret for the certificate
kubectl delete secret auth-certs
kubectl create secret tls auth-certs --cert=<cert_or_fullchain_filename> --key=<key_filename>

# Update consuming services
MYDATE=$(date) && kubectl patch <service or deployment> <affected service or deployment> -p '{"spec":{"template":{"spec":{"containers":[{"name":"auth","env":[{"name":"RESTART_","value":"$MYDATE"}]}]}}}}'

Configure Kubernetes Secrets Config file with encoded variables and encrypt the file

NOTE for Kubernetes + MARCO Auth: Secrets must be double base64 encoded. This is because Kubernetes secrets are expected to be encoded in base64 but ALSO marco AUTH is expecting these secrets to be base64 encoded.

base64 -w 0 .gcpserviceaccount.json | base64 -w 0
base64 -w 0 jwtRS256.key | base64 -w 0
base64 -w 0 jwtRS256.key.pub | base64 -w 0
echo -n 'redis://:pass@host:port' | base64 -w 0

# Set result encoded values on corresponding kube-secret-<env>.yaml

gcloud kms encrypt \
  --plaintext-file=kube/envs/kube-secret-<env>.yaml \
  --ciphertext-file=kube/envs/kube-secret-<env>.yaml.enc \
  --location=global \
  --keyring=finboot-marco-prod \
  --key=finboot-marco-auth-cloudbuild-secrets \
  --project=finboot-kms-resources

Create Deployments

gcloud container clusters get-credentials cluster-1 --zone europe-west2-a --project marco-prod
kubectl apply -f kube/envs/kube-config-prod.yaml
kubectl apply -f kube/envs/kube-secret-prod.yaml
kubectl apply -f kube/envs/kube-deployment-prod.yaml
kubectl apply -f kube/

kubectl get deployment auth-deployment
kubectl get service auth-service

gcloud container clusters get-credentials marco-pre-cluster-1 --zone europe-west2-a --project marco-pre-231409
kubectl apply -f kube/envs/kube-config-pre.yaml
kubectl apply -f kube/envs/kube-secret-pre.yaml
kubectl apply -f kube/envs/kube-deployment-pre.yaml
kubectl apply -f kube/

kubectl get deployment auth-deployment
kubectl get service auth-service

Restart Deployment

MYDATE=$(date) && kubectl patch deployment auth-deployment -p '{"spec":{"template":{"spec":{"containers":[{"name":"auth","env":[{"name":"RESTART_","value":"$MYDATE"}]}]}}}}'