-
Notifications
You must be signed in to change notification settings - Fork 16
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update repo documents. Cleanup unused files (#175)
* Update repo documents. Cleanup unused files Signed-off-by: Max Lambrecht <[email protected]> --------- Signed-off-by: Max Lambrecht <[email protected]>
- Loading branch information
Max Lambrecht
authored
Jun 1, 2023
1 parent
e957f82
commit 8307243
Showing
8 changed files
with
136 additions
and
94 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,23 +1,33 @@ | ||
| ## Project Roles | ||
| ## Roles within the Galadriel Project | ||
|
|
||
| ### Users | ||
|
|
||
| These are individuals who | ||
| - Want to learn more about the Galadriel Project; | ||
| - Are existing users of Galadriel and its tools who wish to follow the project's progress. | ||
| Users are individuals who: | ||
|
|
||
| - Are interested in learning more about the Galadriel Project; | ||
| - Are existing users of Galadriel and its tools, wanting to stay updated on the project's progress. | ||
|
|
||
| ### Contributors | ||
|
|
||
| These are individuals who wish to contribute code or ideas to Galadriel. Contributors submit code and ideas through GitHub issues or by creating pull requests. | ||
| Contributors are individuals who have a desire to contribute to Galadriel. They provide contributions in the form of | ||
| code or innovative ideas. Contributions are typically made through GitHub issues or by creating pull requests. | ||
|
|
||
| ### Maintainers | ||
|
|
||
| These are individuals who can approve submitted pull requests to be merged into the primary codebase. The project requires pull requests to be approved by at least two (2) maintainers. Once approved, a pull request can be merged by maintainers. A list of the current maintainers can be found in the [Codeowners](./CODEOWNERS) file. | ||
| Maintainers are individuals with the authority to approve pull requests for merging into the primary codebase. To | ||
| maintain the quality and integrity of the code, the Galadriel Project requires at least one maintainer to approve a | ||
| pull request before it can be merged. The list of current maintainers is available in the [Codeowners](./CODEOWNERS) | ||
| file. | ||
|
|
||
| ## Change Review Process | ||
|
|
||
| **All changes must be submitted as a GitHub Pull Request (PR)** | ||
| **All changes must be submitted via GitHub Pull Request (PR)** | ||
|
|
||
| The submitter of a pull request bears the responsibility of addressing any feedback received. While the pull request is | ||
| open, it is also the submitter's responsibility to ensure that the proposed change is always in a mergeable state. For | ||
| guidelines on submitting a pull request for approval, please refer to the [Contributor's Guide](/CONTRIBUTING.md). | ||
|
|
||
| The submitter of a pull request is responsible for responding to any feedback. While it remains open, the submitter is also responsible for ensuring the change is always in a state where it can be merged. Guidelines for submitting a pull request for approval can be found [here](/CONTRIBUTING.md). | ||
| **All changes must garner approval from at least one Maintainer** | ||
|
|
||
| **All changes must be approved by at least two (2) Maintainers** | ||
| Each proposed change must be approved by at least one maintainer before it can be merged into the primary codebase. | ||
| This ensures that the code is thoroughly reviewed and maintains the high standards set by the Galadriel Project. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,47 +1,68 @@ | ||
| # Galadriel | ||
|
|
||
| [](https://github.com/HewlettPackard/galadriel/actions/workflows/codeql.yml) | ||
| [](https://github.com/HewlettPackard/galadriel/actions/workflows/pr_build.yml) | ||
| [](https://github.com/HewlettPackard/galadriel/actions/workflows/scorecards.yml) | ||
| [](https://github.com/HewlettPackard/galadriel/actions/workflows/trivy.yml) | ||
|
|
||
| --- | ||
|
|
||
| Project Galadriel, or just Galadriel, is an open source project that enables scalable and easy configuration of Federation relationships among SPIRE Servers. It works as a central hub for managing and auditing Federation relationships. | ||
| Project Galadriel is an open-source project that streamlines the configuration of Federation relationships among SPIRE | ||
| Servers and manages the secure exchange of Trust Bundles based on the registered and approved relationships. It | ||
| functions as a central hub for the management and auditing of these Federation relationships. | ||
|
|
||
| ### What is Galadriel? | ||
|
|
||
| - **Alternative approach to SPIRE Federation**: Galadriel is built on top of SPIRE APIs to streamline the management of | ||
| foreign Trust Bundles. | ||
| - **Federation at scale**: Galadriel simplifies the configuration of multiple SPIRE Server federations while | ||
| prioritizing security. | ||
| - **Central hub**: Galadriel provides a centralized platform where federation relationships can be defined and audited. | ||
|
|
||
| ### What Galadriel IS? | ||
| - **Alternative approach to SPIRE Federation**: it's built on top of SPIRE APIs to facilitate foreign Trust Bundles management. | ||
| - **Multi-tenant**: multiple organizations can leverage the same Galadriel deployment, while ensuring data and operations isolation. | ||
| - **Federation at scale**: configuring multiple SPIRE Server federation should be easy and secure by default, that is Galadriel's main focus. | ||
| - **Central hub**: it's a central place where federation relationships can be defined and audited. | ||
| ### What Galadriel is not? | ||
|
|
||
| ### What Galadriel IS NOT? | ||
| - **A replacement of SPIRE/SPIFFE Federation**: it doesn't replace SPIRE Federation, it leverages what's already built in there. | ||
| - **A SPIRE plugin**: it's deployed as a separate component, not as a SPIRE plugin. | ||
| - **A replacement for SPIRE/SPIFFE Federation**: Galadriel does not replace SPIRE Federation, instead, it leverages | ||
| existing SPIRE capabilities. | ||
| - **A SPIRE plugin**: Galadriel is deployed as a standalone component, not as a SPIRE plugin. | ||
|
|
||
| --- | ||
|
|
||
| ## Get started | ||
| ## Getting Started | ||
|
|
||
| - Learn how to run the Proof of Concept (v0.1.0) [here](https://github.com/HewlettPackard/galadriel/blob/v0.1.0/doc/INSTRUCTIONS.md) | ||
| - [Configuration and CLI Usage instructions](./doc/USAGE.md) | ||
| - **TBD** | ||
|
|
||
| ## Contribute | ||
| ## Contributing | ||
|
|
||
| Project Galadriel is an open source project under the [Apache 2 license](./LICENSE), and as such, any kind of contribution is welcome, being documentation, new features, bugfixing, issues, etc. Check out our [Contributing guidelines](./CONTRIBUTING.md) to learn how we manage contributions, and the [Governance policy](./GOVERNANCE.md) to learn about the different roles in the project. | ||
| Project Galadriel is an open-source project under the [Apache 2 license](./LICENSE). We welcome any form of | ||
| contribution, whether it's documentation, new features, bug fixes, or issues. Check out | ||
| our [Contributing guidelines](./CONTRIBUTING.md) to learn about our contribution management, and | ||
| the [Governance policy](./GOVERNANCE.md) to understand the various roles within the project. | ||
|
|
||
| ## Roadmap | ||
|
|
||
| Project Galadriel has currently reached the Proof of Concept milestone ([v0.1.0](https://github.com/HewlettPackard/galadriel/blob/v0.1.0/doc/INSTRUCTIONS.md)). Refer to the [Roadmap](./ROADMAP.md) to learn what's next. | ||
| Project Galadriel has currently reached the Proof of Concept | ||
| milestone ([v0.1.0](https://github.com/HewlettPackard/galadriel/blob/v0.1.0/doc/INSTRUCTIONS.md)). Refer to | ||
| the [Roadmap](./ROADMAP.md) to learn about our future plans. | ||
|
|
||
| ## Want to know more? | ||
| ## Want to Know More? | ||
|
|
||
| ### Design document | ||
| Please feel free to check out our [Design Document](https://docs.google.com/document/d/1nkiJV4PAV8Wx1oNvx4CT3IDtDRvUFSL8/edit?usp=sharing&ouid=106690422347586185642&rtpof=true&sd=true), where you can find more information about the architecture and future plans for Galadriel. Comments and suggestions are welcome and highly appreciated. | ||
| ### Design Document | ||
|
|
||
| Feel free to explore | ||
| our [Design Document](https://docs.google.com/document/d/1nkiJV4PAV8Wx1oNvx4CT3IDtDRvUFSL8/edit?usp=sharing&ouid=106690422347586185642&rtpof=true&sd=true), | ||
| which provides more information about Galadriel's architecture and future plans. Your comments and suggestions are | ||
| welcome and highly appreciated. | ||
|
|
||
| ### Community Presentations & Blog Posts | ||
| - SPIRE Bridge: an Alternative Approach to SPIFFE Federation - [Juliano Fantozzi](https://github.com/jufantozzi), [Maximiliano Churichi](https://github.com/mchurichi) / SPIFFE Community Day Fall 2022 (October 2022) / [video](https://www.youtube.com/watch?v=pHdOm4MdPHE), [slides](https://docs.google.com/presentation/d/1Cox9MNeZA1bD2aktg2HTMjcgGn_6Rbb0/edit?usp=sharing&ouid=106690422347586185642&rtpof=true&sd=true), [demo](https://github.com/HewlettPackard/galadriel/tree/v0.1.0/demos) | ||
| - Galadriel - A SPIRE Federation Alternative - [William Barrera Fuentes](https://github.com/wibarre) / HPE Developer Community (October 2022) / [blog post](https://developer.hpe.com/blog/galadriel-a-spire-federation-alternative/) | ||
|
|
||
| ## Found a security issue? | ||
| - SPIRE Bridge: an Alternative Approach to SPIFFE | ||
| Federation - [Juliano Fantozzi](https://github.com/jufantozzi), [Maximiliano Churichi](https://github.com/mchurichi) / | ||
| SPIFFE Community Day Fall 2022 (October | ||
| 2022) / [video](https://www.youtube.com/watch?v=pHdOm4MdPHE), [slides](https://docs.google.com/presentation/d/1Cox9MNeZA1bD2aktg2HTMjcgGn_6Rbb0/edit?usp=sharing&ouid=106690422347586185642&rtpof=true&sd=true), [demo](https://github.com/HewlettPackard/galadriel/tree/v0.1.0/demos) | ||
| - Galadriel - A SPIRE Federation Alternative - [William Barrera Fuentes](https://github.com/wibarre) / HPE Developer | ||
| Community (October 2022) / [blog post](https://developer.hpe.com/blog/galadriel-a-spire-federation-alternative/) | ||
|
|
||
| ## Encountered a Security Issue? | ||
|
|
||
| Please refer to the [Security policy](./SECURITY.md) to learn more about security updates and reporting potential vulnerabilities. | ||
| Please refer to our [Security policy](./SECURITY.md) for more information about security updates and how to report | ||
| potential vulnerabilities. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,29 +1,33 @@ | ||
| # Roadmap | ||
|
|
||
| ## Milestones | ||
| ## Recently Completed | ||
|
|
||
| ### Proof of Concept (PoC) | ||
| - **Status**: Completed ([v0.1.0](https://github.com/HewlettPackard/galadriel/tree/v0.1.0/)) | ||
| - **Goal**: Exercise concepts about trust bundle exchange based on relationships. It will corroborate the feasibility of having a Harvester agent as a medium to manage federated relationships in SPIRE servers, the Server as a middle hub for exchange, and the relationship as a control for the exchange. | ||
| - **Result**: | ||
| - Server runs, and stores bundles and defined relationships in an ephemeral storage system. | ||
| - Server exposes local APIs for admins to register new members, generate access tokens for them, and define bidirectional 1:1 relationships. | ||
| - Server exposes public authenticated APIs for Harvesters. | ||
| - Harvester uses Server-generated access tokens to communicate with the Server. | ||
| - Harvester communicates with the SPIRE Server to fetch its bundle and to set foreign bundles. | ||
| - Harvester sends its collocated SPIRE bundle, and fetches and keeps in sync foreign bundles based on the defined relationships. | ||
| - APIs for Server and Harvester defined through Open API spec. | ||
| - TLS enabled between Galadriel Server and Harvesters, using a disk-based upstream CA that the Server uses to sign its | ||
| certificate. | ||
| - Secure Harvester introduction using a single-use join token. | ||
| - Harvester authentication using JWT issued by the Server, which are rotated. The JWT is issued by the Server using | ||
| either an in-memory KeyManager or a disk-based KeyManager for generating the private keys. | ||
| - Bundle signing and verification using a disk-based Signer and Verifier implementation. | ||
| - Added support for SQLite and Postgres. | ||
| - Simple implementation of the Federation Relationship approval flow. | ||
| - Federated bundle synchronization across Harvesters based on configured and approved relationships. | ||
|
|
||
| ## Near-Term and Medium-Term | ||
|
|
||
| - Support for SPIRE running in high-availability (HA) mode. | ||
| - Support for Galadriel Server in high-availability (HA) mode. | ||
| - Support for other upstream CAs for TLS certificates. | ||
| - Support for other Key Management Systems (KMS) for the private keys used for JWT issuing. | ||
| - Support for relationship consent signing. | ||
| - Support for other bundle signers and verifiers, e.g., using Sigstore. | ||
| - Telemetry, health checkers, alerts, and API versioning. | ||
|
|
||
| ### Minimum Viable Product (MVP) | ||
| - **Status**: In Progress | ||
| - **Goal**: Have a minimal product for early evaluation, that is is API based, and implements the security and core principles identified in the [Design Document](https://docs.google.com/document/d/1nkiJV4PAV8Wx1oNvx4CT3IDtDRvUFSL8/edit?usp=sharing&ouid=106690422347586185642&rtpof=true&sd=true). | ||
| - **Result**: | ||
| - Server and Harvester APIs are well defined and documented. | ||
| - Harvester is securely introduced to the Server. | ||
| - One or more production-ready database systems are available to be used as backend storage. | ||
| - Multiple organizations can share the same Galadriel Server instance without data leak risks. | ||
| - Trust bundles are cryptographically signed and verified end-to-end. | ||
| - Galadriel supports SPIRE in an HA topology. | ||
| - Server and Harvester can be configured to emit metrics to an open telemetry standard. | ||
| - Harvester admins explicitly approve or deny memberships. | ||
| - Components and flows are thoroughly and continuously tested and exercised. | ||
| - There are deployment options for bare metal and Kubernetes. | ||
| ## Long-Term | ||
|
|
||
| ### Initial Proof of Concept (PoC) | ||
|
|
||
| - **Status**: Completed ([v0.1.0](https://github.com/HewlettPackard/galadriel/tree/v0.1.0/)) | ||
| - **Goal**: Exercise concepts about trust bundle exchange based on relationships. This stage corroborates the | ||
| feasibility of having a Harvester agent as a medium to manage federated relationships in SPIRE servers, the Server as | ||
| a central hub for exchange, and the relationship as a control for the exchange. |
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.