How to secure Sitecore GraphQL?

 

Authentication Options:

1. Expose GraphQL via Azure APIM and allow APIM to connect to GraphQL using Sitecore API Key

2. Use Azure Active Directory B2C JWT Token

   1. OAuth 2.0 Client Credential Grant Flow [Get direct authorization]

   2. OAuth 2.0 Authorize Code Grant Flow[Get Auth Code- Using Auth Code Get Access-Token ]

3. Use Sitecore Identity Server JWT Token

4. Sitecore Authentication (cookie base)

1. Authentication

Why Option #1- Expose GraphQL via Azure APIM is preferred solution

1. Sitecore API Key will need to be created within Sitecore and enable GraphQL endpoints.

2. Expose sitecore graphQL end point via Azure APIM.

3. Consuming client will need to provide the Azure APIM subscription key as part of the request Authorization request header.

4. The APIM behind the scene will pass the sitecore API key to Sitecore graphQL server.

5. Each Sitecore API Key will have sitecore custom role assigned, which will enable us to implement content level authorization.

6. Can take advantage of security and request throttling features that APIM provides out of box.

2. Authorization

Sitecore out of box role based permission/authorization can be used to grant/deny access to specific part of sitecore content tree. High level steps:

1. Create a new sitecore role and assign the grant/deny access to sitecore content tree.

2. And assign this newly created role to the sitecore API key that we have created above as part of Authentication [Go to sitecore content tree-> Settings--> Services--> API Keys--> Any GraphQL item--> Under Item section Data-->In Impersonation user --> Enter Sitecore role created in pt1]

Deny Mutation (Create/Update/Delete) & Subscriptions

By default Mutation & Subscriptions are enabled on Sitecore.Services.GraphQL.Content.Config

In order to fix this either patch or create a new context aware graphQL end point and disable Mutation/Subscription

References:

OAuth 2.0 Client Credential Grant Flow [Get direct authorization]

https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow OAuth 2.0 Authorize Code Grant Flow[Get Auth Code- Using Auth Code Get Access-Token ]

https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow

How to use Azure Devops CI CD to automate the code change straight into AKS Pods ?

 I don't want to go through the cycle of pulling images and creating pods, replicas and services? I just want to publish and push my code changed files to target location of PODS

If you want to publish and push your code changes directly to the target location within AKS pods, you can follow a different approach. Instead of rebuilding images and creating new pods, you can leverage Kubernetes features to achieve this. Here’s how:

1. Using ConfigMaps or Secrets:

   • Kubernetes provides ConfigMaps and Secrets to manage configuration data and sensitive information.

   • Create a ConfigMap or Secret containing your code files (or relevant configuration files).

   • Mount this ConfigMap or Secret as a volume inside your existing pods.

   • Whenever you update the ConfigMap or Secret, the changes will be automatically reflected in the mounted volume within the pods.

2. Volume Mounts:

   • Modify your existing pod deployment YAML to include a volume mount for your code files.

   • For example:

     apiVersion: v1 kind: Pod metadata: name: my-app-pod spec: containers: - name: my-app-container image: my-app-image volumeMounts: - name: code-volume mountPath: /app volumes: - name: code-volume configMap: name: my-configmap

   • In this example, the my-configmap contains your code files, and they are mounted at /app within the pod.

3. Watch for Changes:

   • Use a tool like inotify or fsnotify inside your pod to watch for changes in the mounted directory.

   • When a file changes, trigger the necessary actions (e.g., restart your application, reload configuration, etc.).

4. Git Sync Sidecar Container:

   • Deploy a sidecar container alongside your main application container.

   • The sidecar container continuously syncs your code from a Git repository (e.g., GitHub) into a shared volume.

   • Your main application container reads the code from this shared volume.

   • This approach allows you to update the code by simply pushing changes to your Git repository.

Remember that these approaches allow you to update code files without rebuilding images or creating new pods. Choose the one that best fits your requirements and constraints. Happy coding! 😊

If you need further assistance or have additional questions, feel free to ask! 🚀

How to deploy incremental code change straight into AKS Pod?

 How to develop code inside a running pod without redeploying an image?

My problem is, that once I want to try a code change, I always need to build a new image, push it to a registry, patch a Kubernetes Operator CRD, let it redeploy, let it reconcile, wait for the new pod to startup and see if the change worked once traffic is routed to the new instance. That's quite time consuming.

I want something that has mount drive like docker desktop, every .net solution build package or publish artifacts should checked for changed file and push to the target AKS POD namespace hosted website.

Developing code inside a running pod without redeploying the entire image can indeed be time-consuming and cumbersome, especially in restricted environments. Fortunately, there are some tools and techniques that can help streamline this process. Let’s explore a few options:

1. Skaffold:

   • Skaffold is a popular tool for local development with Kubernetes. It automates the build, push, and deployment process, allowing you to iterate quickly.

   • You can set up Skaffold to watch your local code and automatically rebuild and redeploy your application whenever changes are detected.

   • Skaffold works well with Kubernetes clusters, including OpenShift¹.

2. Telepresence:

   • Telepresence allows you to “teleport” your development machine into the Kubernetes cluster. It creates a proxy pod that forwards traffic between your local environment and the cluster.

   • With Telepresence, you can develop locally while interacting with services running inside the cluster. It provides a seamless experience for debugging and testing.

   • Keep in mind that Telepresence doesn’t sync code directly inside a pod but enables efficient development by connecting your local environment to the cluster¹.

3. DevSpace:

   • DevSpace is another tool that simplifies local development with Kubernetes.

   • It allows you to sync files between your local machine and a running pod. You can edit code locally, and DevSpace will automatically update the pod with your changes.

   • DevSpace integrates well with Visual Studio Code (VSCode) and other IDEs¹.

4. Code-Server:

   • If you prefer to use VSCode for development, consider using Code-Server. It’s a web-based version of VSCode that you can run inside a pod.

   • Code-Server allows you to edit code directly within the pod, eliminating the need for frequent image rebuilds and deployments.

   • Pair it with tools like Skaffold or DevSpace for an efficient development workflow¹.

Remember that each tool has its own trade-offs, and the best choice depends on your specific requirements and constraints. Experiment with a few options to find the one that fits your workflow best. Happy coding! 😊

If you want to know how exactly it happens, please refer to this fragment of the official Kubernetes documentation on postStart handlers.

 

Create self signed SSL certificate to host sitecore CD CM in IIS with https

Open powershell in admin mode

1. Run below set of commands

New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname "sitecorewebsite.cd" -FriendlyName "sitecorewebsite.cd" -NotAfter (Get-Date).AddYears(5)

2. copy and note down the Thumbprint value generated from above powershell Command

3. Run below command

Export-Certificate -Cert cert:\localMachine\my\<paste- copied-thumbprint-of-cert-value> -FilePath "C:\certificates\sitecorewebsite.cd.pfx"

Make sure self signed ssl cert created for right website name for e.g sitecorewebsite.cd

4. Go to c:/certificate and lookup for generated certificate name as sitecorewebsite.cd.pfx

5. Next step is to add the above generated certificate to a trusted certificate authority

6. Go to run and type mmc.exe

7. Select file-->Add/Remove-snap-in

8. Double click on certificates, Choose the ‘Computer account' option, then 'Local computer’ & Click Finish

9. The cert that you exported should already be visible in the 'Personal' store of your Local Computer

10. Copy the cert from personal store and paste it in Trusted Root Certificates Authorities

11. Go to IIS and navigate your site, add binding https and select the certificate from the dropdown. Restart IIS and you should be able to browse your site with https.