astra-connector-operator

Astra Connector Operator

Astra Connector Operator deploys and registers a private azure cluster with NetApp Astra

To deploy the operator

Create the namespace for the operator

kubectl create ns astra-connector-operator

Apply the astraconnector_operator.yaml file to the operator namespace

kubectl apply -f astraconnector_operator.yaml -n astra-connector-operator

Install the private cluster components

Create the namespace for the private cluster components

kubectl create ns astra-connector

Apply the AstraConnector CRD

Update the CRD with the right values. Refer to the table below for explanations of the CRD spec

kubectl apply -f config/samples/astraconnector_v1.yaml -n astra-connector

Check the AstraConnector status

kubectl get astraconnector astra-connector -n astra-connector
NAME              REGISTERED   ASTRACONNECTORID
astra-connector   true         22b839aa-8b85-445a-85dd-0b1f53b5ea19

Uninstall the private cluster components

• Unmanage the cluster from the Astra UI
• Remove the AstraConnector CRD

NOTE: Removing the CRD will also attempt to unregister the cluster with Astra

kubectl delete -f config/samples/astraconnector_v1.yaml -n astra-connector

Uninstall the operator

kubectl delete -f astraconnector_operator.yaml -n astra-connector-operator

Security Best Practices

Use RBAC

Use RBAC (Role Based Access Control) in Kubernetes to limit access to the connector namespace after deployment

Use a service mesh

Use a service mesh to secure communications between pods

Limit token usage for registration

The API token used for registration is only used once, and is not used after registering the connector. If the token was created specifically for registering the connector, we recommend discarding it after registration is complete. Discarding the token requires removing the token from the AstraConnector CRD, and revoking it from Astra.

Use a NetworkPolicy

Use a network policy to deny external communication to the pods in the connector namespace. The pods should only be making outbound communication.

NOTE: A network policy requires a network policy controller to enforce the policy.

Here is an example NetworkPolicy to limit the communication:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: astra-connector-network-policy
  namespace: astra-connector-namespace
spec:
  policyTypes:
  - Ingress
  - Egress
  // Only allow communication to pods from the connector namespace
  ingress:
  - from:
    namespaceSelector:
      name: astra-connector-operator
  // Allow all outgoing communication
  egress:
  - {}

CRD

Sample CRD

apiVersion: netapp.astraconnector.com/v1
kind: AstraConnector
metadata:
  name: astra-connector
spec:
  astra:
    token: <AstraApiToken>
    clusterName: ipsprintdemo
    accountId: 5831cf97-c52e-4185-ab83-db0fdd061c0e
    acceptEULA: yes

CRD details

In the CRD, all the fields in the spec section have to be updated to the correct value

imageRegistry

Example:

spec:
    ...
    imageRegistry:
        name: theotw
        secret: otw-secret

natssync-client

Natssync-Client talks to the Natssync-Server on Astra and ensures communication between Astra and the private AKS cluster

The natssync-client CRD is a map of key/value pairs

Example:

spec:
    ...
    natssync-client:
        image: theotw/natssync-client:0.9.202201132025
        cloud-bridge-url: https://integration.astra.netapp.io

nats

Example:

spec:
    ...
    nats:
        size: 3
        image: nats:2.6.1-alpine3.14

httpproxy-client

Example:

spec:
    ...
    httpproxy-client:
        image: theotw/httpproxylet:0.9.202201132025

echo-client

Example:

spec:
    ...
    echo-client:
        size: 1
        image: theotw/echo-proxylet:0.9.202201132025

astra