{"id":70867,"date":"2020-02-22T06:40:58","date_gmt":"2020-02-22T03:40:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes"},"modified":"2020-03-03T16:14:36","modified_gmt":"2020-03-03T13:14:36","slug":"prikruchivaem-ldap-avtorizacziyu-k-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","title":{"rendered":"P\u0159ipojujeme LDAP autorizaci k Kubernetes.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"P\u0159ipojujeme LDAP autorizaci k Kubernetes.\" src=\"\/wp-content\/uploads\/2020\/02\/2b0f0a4921e049a78a015e7693d697cf.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Kr\u00e1tk\u00e1 p\u0159\u00edru\u010dka o tom, jak pomoc\u00ed Keycloak propojit Kubernetes s va\u0161\u00edm LDAP serverem a nastavit import u\u017eivatel\u016f a skupin. To umo\u017en\u00ed nastavit RBAC pro va\u0161e u\u017eivatele a pou\u017e\u00edvat auth-proxy k zabezpe\u010den\u00ed Kubernetes Dashboardu a dal\u0161\u00edch aplikac\u00ed, kter\u00e9 nejsou samostatn\u011b schopny prov\u00e1d\u011bt autorizaci.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2 id=\"ustanovka-keycloak\">Instalace Keycloak<\/h2>\n<p><\/p>\n<p>P\u0159edpokl\u00e1d\u00e1me, \u017ee ji\u017e m\u00e1te LDAP server. M\u016f\u017ee to b\u00fdt Active Directory, FreeIPA, OpenLDAP nebo n\u011bco jin\u00e9ho. Pokud LDAP server nem\u00e1te, m\u016f\u017eete u\u017eivatele vytv\u00e1\u0159et p\u0159\u00edmo v rozhran\u00ed Keycloak, nebo pou\u017e\u00edt ve\u0159ejn\u00e9 OIDC poskytovatele (Google, Github, Gitlab), v\u00fdsledek bude t\u00e9m\u011b\u0159 stejn\u00fd.<\/p>\n<p><\/p>\n<p>Nejprve nainstalujeme samotn\u00fd Keycloak, instalace m\u016f\u017ee b\u00fdt provedena jak samostatn\u011b, tak p\u0159\u00edmo v Kubernetes clusteru, obvykle je jednodu\u0161\u0161\u00ed nainstalovat ho samostatn\u011b, pokud m\u00e1te v\u00edce Kubernetes cluster\u016f. Na druhou stranu m\u016f\u017eete v\u017edy pou\u017e\u00edt <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/charts\/tree\/master\/stable\/keycloak\">ofici\u00e1ln\u00ed helm chart<\/a><\/noindex> a nainstalovat ho p\u0159\u00edmo do va\u0161eho clusteru.<\/p>\n<p><\/p>\n<p>Pro ukl\u00e1d\u00e1n\u00ed dat Keycloak budete pot\u0159ebovat datab\u00e1zi. Ve v\u00fdchoz\u00edm nastaven\u00ed se pou\u017e\u00edv\u00e1 <code>h2<\/code> (v\u0161echna data jsou ulo\u017eena lok\u00e1ln\u011b), ale je tak\u00e9 mo\u017en\u00e9 pou\u017e\u00edt <code>Postgres<\/code>, <code>mysql<\/code> nebo <code>mariadb<\/code>.<br \/>\nPokud se p\u0159ece jen rozhodnete nainstalovat Keycloak samostatn\u011b, podrobn\u011bj\u0161\u00ed pokyny najdete v <noindex><a rel=\"nofollow\" href=\"https:\/\/www.keycloak.org\/docs\/latest\/getting_started\/index.html\">ofici\u00e1ln\u00ed dokumentaci<\/a><\/noindex>.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-federacii\">Nastaven\u00ed federace<\/h2>\n<p><\/p>\n<p>Nejprve vytvo\u0159\u00edme nov\u00fd realm. Realm je prostor na\u0161\u00ed aplikace. Ka\u017ed\u00e1 aplikace m\u016f\u017ee m\u00edt sv\u016fj vlastn\u00ed realm s r\u016fzn\u00fdmi u\u017eivateli a nastaven\u00edm autorizace. Master realm pou\u017e\u00edv\u00e1 samotn\u00fd Keycloak a nen\u00ed spr\u00e1vn\u00e9 ho pou\u017e\u00edvat k n\u011b\u010demu jin\u00e9mu.<\/p>\n<p><\/p>\n<p>Klikneme <strong>P\u0159idat realm<\/strong><\/p>\n<p><\/p>\n<p>Mo\u017enost<br \/>\nHodnota<\/p>\n<p><strong>N\u00e1zev<\/strong><br \/>\n<code>kubernetes<\/code><\/p>\n<p><strong>Zobrazovan\u00fd n\u00e1zev<\/strong><br \/>\n<code>Kubernetes<\/code><\/p>\n<p><strong>HTML Zobrazovan\u00fd n\u00e1zev<\/strong><br \/>\n<code>&lt;img src=&quot;https:\/\/kubernetes.io\/images\/nav_logo.svg&quot; width=&quot;400&quot; &gt;<\/code><\/p>\n<p><\/p>\n<p>Kubernetes ve v\u00fdchoz\u00edm nastaven\u00ed kontroluje, zda m\u00e1 u\u017eivatel ov\u011b\u0159en\u00fd email. Proto\u017ee pou\u017e\u00edv\u00e1me vlastn\u00ed LDAP server, bude tato kontrola t\u00e9m\u011b\u0159 v\u017edy vracet <code>false<\/code>. Poj\u010fme zak\u00e1zat zobrazen\u00ed t\u00e9to mo\u017enosti v Kubernetes:<\/p>\n<p><\/p>\n<p><strong>Klientsk\u00e9 rozsahy<\/strong> \u2192 <strong>E-mail<\/strong> \u2192 <strong>Mappery<\/strong> \u2192 <strong>Ov\u011b\u0159en\u00ed emailu<\/strong> (Smazat)<\/p>\n<p><\/p>\n<p>Nyn\u00ed nastav\u00edme federaci, k tomu p\u0159ejdeme na:<\/p>\n<p><\/p>\n<p><strong>U\u017eivatelsk\u00e1 federace<\/strong> \u2192 <strong>P\u0159idat poskytovatele...<\/strong> \u2192 <strong>ldap<\/strong><\/p>\n<p><\/p>\n<p>Uvedu p\u0159\u00edklad nastaven\u00ed pro FreeIPA:<\/p>\n<p><\/p>\n<p>Mo\u017enost<br \/>\nHodnota<\/p>\n<p><strong>Zobrazovan\u00fd n\u00e1zev konzole<\/strong><br \/>\n<code>freeipa.example.org<\/code><\/p>\n<p><strong>Dodavatel<\/strong><br \/>\n<code>Red Hat Directory Server<\/code><\/p>\n<p><strong>UUID LDAP atribut<\/strong><br \/>\n<code>ipauniqueid<\/code><\/p>\n<p><strong>URL p\u0159ipojen\u00ed<\/strong><br \/>\n<code>ldaps:\/\/freeipa.example.org<\/code><\/p>\n<p><strong>U\u017eivatel\u00e9 DN<\/strong><br \/>\n<code>cn=users,cn=accounts,dc=example,dc=org<\/code><\/p>\n<p><strong>Bind DN<\/strong><br \/>\n<code>uid=keycloak-svc,cn=users,cn=accounts,dc=example,dc=org<\/code><\/p>\n<p><strong>Bind Credential<\/strong><br \/>\n<code>&lt;password&gt;<\/code><\/p>\n<p><strong>Povolit Kerberos autentizaci:<\/strong><br \/>\n<code>on<\/code><\/p>\n<p><strong>Kerberos Realm:<\/strong><br \/>\n<code>EXAMPLE.ORG<\/code><\/p>\n<p><strong>Server Principal:<\/strong><br \/>\n<code>HTTP\/freeipa.example.org@EXAMPLE.ORG<\/code><\/p>\n<p><strong>KeyTab:<\/strong><br \/>\n<code>\/etc\/krb5.keytab<\/code><\/p>\n<p><\/p>\n<p>U\u017eivatel <code>keycloak-svc<\/code> mus\u00ed b\u00fdt p\u0159edem vytvo\u0159en na na\u0161em LDAP serveru.<\/p>\n<p><\/p>\n<p>V p\u0159\u00edpad\u011b Active Directory sta\u010d\u00ed jednodu\u0161e vybrat <strong>Dodavatel: Active Directory<\/strong> a pot\u0159ebn\u00e1 nastaven\u00ed se automaticky vypln\u00ed do formul\u00e1\u0159e.<\/p>\n<p><\/p>\n<p>Klikneme <strong>Ulo\u017eit<\/strong><\/p>\n<p><\/p>\n<p>Te\u010f p\u0159ejdeme:<\/p>\n<p><\/p>\n<p><strong>U\u017eivatelsk\u00e1 federace<\/strong> \u2192 <strong>freeipa.example.org<\/strong> \u2192 <strong>Mappery<\/strong> \u2192 <strong>Jm\u00e9no<\/strong><\/p>\n<p><\/p>\n<p>Mo\u017enost<br \/>\nHodnota<\/p>\n<p><strong>Ldap atribut<\/strong><br \/>\n<code>givenName<\/code><\/p>\n<p><\/p>\n<p>Te\u010f zapneme mapov\u00e1n\u00ed skupin:<\/p>\n<p><\/p>\n<p><strong>U\u017eivatelsk\u00e1 federace<\/strong> \u2192 <strong>freeipa.example.org<\/strong> \u2192 <strong>Mappery<\/strong> \u2192 <strong>Vytvo\u0159it<\/strong><\/p>\n<p><\/p>\n<p>Mo\u017enost<br \/>\nHodnota<\/p>\n<p><strong>N\u00e1zev<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><strong>Typ mapperu<\/strong><br \/>\n<code>group-ldap-mapper<\/code><\/p>\n<p><strong>DN LDAP skupin<\/strong><br \/>\n<code>cn=groups,cn=accounts,dc=example,dc=org<\/code><\/p>\n<p><strong>Strategie z\u00edsk\u00e1v\u00e1n\u00ed u\u017eivatelsk\u00fdch skupin<\/strong><br \/>\n<code>GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE<\/code><\/p>\n<p><\/p>\n<p>S nastaven\u00edm federace m\u00e1me hotovo, p\u0159ejdeme k nastaven\u00ed klienta.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-klienta\">Nastaven\u00ed klienta<\/h2>\n<p><\/p>\n<p>Vytvo\u0159\u00edme nov\u00e9ho klienta (aplikaci, kter\u00e1 bude z\u00edsk\u00e1vat u\u017eivatele z Keycloak). P\u0159ejdeme:<\/p>\n<p><\/p>\n<p><strong>Klienti<\/strong> \u2192 <strong>Vytvo\u0159it<\/strong><\/p>\n<p><\/p>\n<p>Mo\u017enost<br \/>\nHodnota<\/p>\n<p><strong>Client ID<\/strong><br \/>\n<code>kubernetes<\/code><\/p>\n<p><strong>Typ p\u0159\u00edstupu<\/strong><br \/>\n<code>confidenrial<\/code><\/p>\n<p><strong>Ko\u0159enov\u00e1 URL<\/strong><br \/>\n<code>http:\/\/kubernetes.example.org\/<\/code><\/p>\n<p><strong>Platn\u00e9 p\u0159esm\u011brovac\u00ed URI<\/strong><br \/>\n<code>http:\/\/kubernetes.example.org\/*<\/code><\/p>\n<p><strong>Admin URL<\/strong><br \/>\n<code>http:\/\/kubernetes.example.org\/<\/code><\/p>\n<p><\/p>\n<p>Tak\u00e9 vytvo\u0159\u00edme rozsah pro skupiny:<\/p>\n<p><\/p>\n<p><strong>Rozsahy klient\u016f<\/strong> \u2192 <strong>Vytvo\u0159it<\/strong><\/p>\n<p><\/p>\n<p>Mo\u017enost<br \/>\nHodnota<\/p>\n<p><strong>\u0160ablona<\/strong><br \/>\n<code>\u017d\u00e1dn\u00e1 \u0161ablona<\/code><\/p>\n<p><strong>N\u00e1zev<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><strong>Cel\u00e1 cesta skupiny<\/strong><br \/>\n<code>false<\/code><\/p>\n<p><\/p>\n<p>A nastav\u00edme pro n\u011b mapper:<\/p>\n<p><\/p>\n<p><strong>Rozsahy klient\u016f<\/strong> \u2192 <strong>groups<\/strong> \u2192 <strong>Mappery<\/strong> \u2192 <strong>Vytvo\u0159it<\/strong><\/p>\n<p><\/p>\n<p>Mo\u017enost<br \/>\nHodnota<\/p>\n<p><strong>N\u00e1zev<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><strong>Typ mapperu<\/strong><br \/>\n<code>\u010clenstv\u00ed ve skupin\u011b<\/code><\/p>\n<p><strong>N\u00e1zev tokenu claim<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><\/p>\n<p>Te\u010f mus\u00edme zapnout mapov\u00e1n\u00ed skupin v na\u0161em rozsahu klienta:<\/p>\n<p><\/p>\n<p><strong>Klienti<\/strong> \u2192 <strong>kubernetes<\/strong> \u2192 <strong>Rozsahy klient\u016f<\/strong> \u2192 <strong>V\u00fdchoz\u00ed klientsk\u00e9 rozsahy<\/strong><\/p>\n<p><\/p>\n<p>Vyberte <strong>groups<\/strong> v <strong>Dostupn\u00e9 klientsk\u00e9 rozsahy<\/strong>, klikn\u011bte na <strong>P\u0159idat vybran\u00e9<\/strong><\/p>\n<p><\/p>\n<p>Te\u010f nastav\u00edme autentizaci na\u0161\u00ed aplikace, p\u0159ejdeme:<\/p>\n<p><\/p>\n<p><strong>Klienti<\/strong> \u2192 <strong>kubernetes<\/strong><\/p>\n<p><\/p>\n<p>Mo\u017enost<br \/>\nHodnota<\/p>\n<p><strong>Povolen\u00e1 autorizace<\/strong><br \/>\n<code>NA<\/code><\/p>\n<p><\/p>\n<p>Klikneme na <strong>ulo\u017eit<\/strong> a t\u00edm je nastaven\u00ed klienta dokon\u010deno, nyn\u00ed na kart\u011b<\/p>\n<p><\/p>\n<p><strong>Klienti<\/strong> \u2192 <strong>kubernetes<\/strong> \u2192 <strong>Ov\u011b\u0159en\u00ed<\/strong><\/p>\n<p><\/p>\n<p>budete moci z\u00edskat <strong>Secret<\/strong> kter\u00fd budeme pou\u017e\u00edvat d\u00e1le.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-kubernetes\">Nastaven\u00ed Kubernetes<\/h2>\n<p><\/p>\n<p>Nastaven\u00ed Kubernetes pro OIDC autorizaci je dost trivi\u00e1ln\u00ed a nen\u00ed p\u0159\u00edli\u0161 slo\u017eit\u00e9. V\u0161e, co pot\u0159ebujete, je um\u00edstit CA certifik\u00e1t va\u0161eho OIDC serveru do <code>\/etc\/kubernetes\/pki\/oidc-ca.pem<\/code> a p\u0159idat pot\u0159ebn\u00e9 mo\u017enosti pro kube-apiserver.<br \/>\nK tomu aktualizujte <code>\/etc\/kubernetes\/manifests\/kube-apiserver.yaml<\/code> na v\u0161ech va\u0161ich majstrtech:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">...\nspec:\n  containers:\n  - command:\n    - kube-apiserver\n...\n    - --oidc-ca-file=\\\/etc\\\/kubernetes\\\/pki\\\/oidc-ca.pem\n    - --oidc-client-id=kubernetes\n    - --oidc-groups-claim=groups\n    - --oidc-issuer-url=https:\\\/\\\/keycloak.example.org\\\/auth\\\/realms\\\/kubernetes\n    - --oidc-username-claim=email\n...<\/code><\/pre>\n<p><\/p>\n<p>Tak\u00e9 aktualizujte kubeadm konfiguraci v clusteru, abyste neztratili tato nastaven\u00ed p\u0159i aktualizaci:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">kubectl edit -n kube-system configmaps kubeadm-config<\/code><\/pre>\n<p><\/p>\n<pre><code class=\"plaintext\">...\ndata:\n  ClusterConfiguration: |\n    apiServer:\n      extraArgs:\n        oidc-ca-file: \\\/etc\\\/kubernetes\\\/pki\\\/oidc-ca.pem\n        oidc-client-id: kubernetes\n        oidc-groups-claim: groups\n        oidc-issuer-url: https:\\\/\\\/keycloak.example.org\\\/auth\\\/realms\\\/kubernetes\n        oidc-username-claim: email\n...<\/code><\/pre>\n<p><\/p>\n<p>S nastaven\u00edm Kubernetes m\u00e1me hotovo. M\u016f\u017eete opakovat tyto akce ve v\u0161ech va\u0161ich Kubernetes clusterech.<\/p>\n<p><\/p>\n<h2 id=\"nachalnaya-avtorizaciya\">Po\u010d\u00e1te\u010dn\u00ed autorizace<\/h2>\n<p><\/p>\n<p>Po t\u011bchto kroc\u00edch ji\u017e budete m\u00edt Kubernetes cluster se nastavenou OIDC autorizac\u00ed. Jedin\u00fd probl\u00e9m je, \u017ee va\u0161i u\u017eivatel\u00e9 zat\u00edm nemaj\u00ed nastaven\u00e9ho klienta ani vlastn\u00ed kubeconfig. Abychom tento probl\u00e9m vy\u0159e\u0161ili, je nutn\u00e9 nastavit automatick\u00e9 vyd\u00e1v\u00e1n\u00ed kubeconfig u\u017eivatel\u016fm po \u00fasp\u011b\u0161n\u00e9 autorizaci.<\/p>\n<p><\/p>\n<p>K tomu m\u016f\u017eete pou\u017e\u00edt speci\u00e1ln\u00ed webov\u00e9 aplikace, kter\u00e9 umo\u017e\u0148uj\u00ed autentizaci u\u017eivatele a pot\u00e9 st\u00e1hnout hotov\u00fd kubeconfig. Jedna z nejpohodln\u011bj\u0161\u00edch je <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/negz\/kuberos\">Kuberos<\/a><\/noindex>, umo\u017e\u0148uje v jednom konfigu popsat v\u0161echny Kubernetes clustery a snadno mezi nimi p\u0159ep\u00ednat.<\/p>\n<p><\/p>\n<p>Pro nastaven\u00ed Kuberos sta\u010d\u00ed popsat \u0161ablonu pro kubeconfig a spustit s t\u011bmito parametry:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">kuberos https:\/\/keycloak.example.org\/auth\/realms\/kubernetes kubernetes \/cfg\/secret \/cfg\/template<\/code><\/pre>\n<p><\/p>\n<p>Pro podrobn\u011bj\u0161\u00ed informace se pod\u00edvejte na <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/negz\/kuberos#usage\">Pou\u017eit\u00ed<\/a><\/noindex> na Githubu.<\/p>\n<p><\/p>\n<p>Je tak\u00e9 mo\u017en\u00e9 pou\u017e\u00edt <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/int128\/kubelogin\">kubelogin<\/a><\/noindex> pokud chcete prov\u00e1d\u011bt autentizaci p\u0159\u00edmo na po\u010d\u00edta\u010di u\u017eivatele. V tomto p\u0159\u00edpad\u011b se u\u017eivateli otev\u0159e prohl\u00ed\u017ee\u010d s formul\u00e1\u0159em pro autentizaci na localhost.<\/p>\n<p><\/p>\n<p>Z\u00edskan\u00fd kubeconfig m\u016f\u017eete zkontrolovat na str\u00e1nk\u00e1ch <noindex><a rel=\"nofollow\" href=\"https:\/\/jwt.io\/#debugger-io\">jwt.io<\/a><\/noindex>. Sta\u010d\u00ed zkop\u00edrovat hodnotu <code>users[].user.auth-provider.config.id-token<\/code> z va\u0161eho kubeconfigu do formul\u00e1\u0159e na webu a okam\u017eit\u011b z\u00edsk\u00e1te de\u0161ifrov\u00e1n\u00ed.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-rbac\">Nastaven\u00ed RBAC<\/h2>\n<p><\/p>\n<p>P\u0159i nastaven\u00ed RBAC se m\u016f\u017eete odkazovat jak na jm\u00e9no u\u017eivatele (pole <code>name<\/code> v jwt tokenu), tak na skupinu u\u017eivatel\u016f (pole <code>groups<\/code> v jwt tokenu). Zde je p\u0159\u00edklad nastaven\u00ed pr\u00e1v pro skupinu <code>kubernetes-default-namespace-admins<\/code>:<\/p>\n<p>\n<b class=\"spoiler_title\">kubernetes-default-namespace-admins.yaml<\/b><\/p>\n<pre><code class=\"plaintext\">apiVersion: rbac.authorization.k8s.io\/v1\nkind: Role\nmetadata:\n  name: default-admins\n  namespace: default\nrules:\n- apiGroups:\n  - '*'\n  resources:\n  - '*'\n  verbs:\n  - '*'\n---\napiVersion: rbac.authorization.k8s.io\/v1\nkind: RoleBinding\nmetadata:\n  name: kubernetes-default-namespace-admins\n  namespace: default\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: Role\n  name: default-admins\nsubjects:\n- apiGroup: rbac.authorization.k8s.io\n  kind: Group\n  name: kubernetes-default-namespace-admins<\/code><\/pre>\n<p><\/p>\n<p>V\u00edce p\u0159\u00edklad\u016f pro RBAC naleznete v <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/rbac\/\">ofici\u00e1ln\u00ed dokumentaci Kubernetes<\/a><\/noindex><\/p>\n<p><\/p>\n<h2 id=\"nastroyka-auth-proxy\">Nastaven\u00ed auth-proxy<\/h2>\n<p><\/p>\n<p>Existuje skv\u011bl\u00fd projekt <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/keycloak\/keycloak-gatekeeper\">keycloak-gatekeeper<\/a><\/noindex>, kter\u00fd umo\u017e\u0148uje zabezpe\u010dit jakoukoli aplikaci, a d\u00e1v\u00e1 u\u017eivateli mo\u017enost se autentizovat na OIDC serveru. Uk\u00e1\u017eu, jak ho nastavit na p\u0159\u00edkladu Kubernetes Dashboard:<\/p>\n<p>\n<b class=\"spoiler_title\">dashboard-proxy.yaml<\/b><\/p>\n<pre><code class=\"plaintext\">apiVersion: extensions\/v1beta1\nkind: Deployment\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  replicas: 1\n  template:\n    metadata:\n      labels:\n        app: kubernetes-dashboard-proxy\n    spec:\n      containers:\n      - args:\n        - --listen=0.0.0.0:80\n        - --discovery-url=https:\/\/keycloak.example.org\/auth\/realms\/kubernetes\n        - --client-id=kubernetes\n        - --client-secret=\n        - --redirection-url=https:\/\/kubernetes-dashboard.example.org\n        - --enable-refresh-tokens=true\n        - --encryption-key=ooTh6Chei1eefooyovai5ohwienuquoh\n        - --upstream-url=https:\/\/kubernetes-dashboard.kube-system\n        - --resources=uri=\/*\n        image: keycloak\/keycloak-gatekeeper\n        name: kubernetes-dashboard-proxy\n        ports:\n        - containerPort: 80\n          livenessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n          readinessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  ports:\n  - port: 80\n    protocol: TCP\n    targetPort: 80\n  selector:\n    app: kubernetes-dashboard-proxy\n  type: ClusterIP<\/code><\/pre>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/441112\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Keycloak \u043c\u043e\u0436\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u0442\u044c Kubernetes \u0441 \u0432\u0430\u0448\u0438\u043c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0438\u043c\u043f\u043e\u0440\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0433\u0440\u0443\u043f\u043f. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c RBAC \u0434\u043b\u044f \u0432\u0430\u0448\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c auth-proxy \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c Kubernetes Dashboard \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u043c\u0435\u044e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Keycloak \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u043c \u0447\u0442\u043e \u0443 \u0432\u0430\u0441 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c Active [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":70868,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-70867","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0440\u0438\u043a\u0440\u0443\u0447\u0438\u0432\u0430\u0435\u043c LDAP-\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u043a Kubernetes | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-22T03:40:58+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u0159ipojen\u00ed LDAP autorizace k Kubernetes | ProHoster","description":"Kr\u00e1tk\u00fd n\u00e1vod, jak na to.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0438\u043a\u0440\u0443\u0447\u0438\u0432\u0430\u0435\u043c LDAP-\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u043a Kubernetes | ProHoster","og:description":"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-22T03:40:58+00:00","article:modified_time":"2020-03-03T13:14:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"70867","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:12:23","updated":"2022-09-28 01:58:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/70867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=70867"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/70867\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/70868"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=70867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=70867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=70867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}