{"id":70867,"date":"2020-02-22T06:40:58","date_gmt":"2020-02-22T03:40:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes"},"modified":"2020-03-03T16:14:36","modified_gmt":"2020-03-03T13:14:36","slug":"prikruchivaem-ldap-avtorizacziyu-k-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","title":{"rendered":"Lisame LDAP-autentimise Kubernetesesse.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Lisame<\/p>\n

<\/p>\n

L\u00fchike juhend, kuidas kasutada Keycloak'i Kubernetes'e sidumiseks teie LDAP-serveriga ning seadistada kasutajate ja r\u00fchmade importimist. See v\u00f5imaldab seadistada RBAC teie kasutajatele ning kasutada auth-proxy't, et kaitsta Kubernetes Dashboardi ja teisi rakendusi, mis ei suuda iseseisvalt autoriseerimist teostada.<\/p>\n

<\/a><\/noindex><\/p>\n

Keycloak'i paigaldamine<\/h2>\n

<\/p>\n

Oletame, et teil on juba LDAP-server. See v\u00f5ib olla Active Directory, FreeIPA, OpenLDAP v\u00f5i midagi muud. Kui teil ei ole LDAP-serverit, saate p\u00f5him\u00f5tteliselt luua kasutajaid otse Keycloak'i liideses v\u00f5i kasutada avalikke oidc-teenuse pakkujaid (Google, Github, Gitlab), tulemus on peaaegu sama.<\/p>\n

<\/p>\n

Esmalt paigaldame Keycloak'i, paigaldamine v\u00f5ib toimuda eraldi v\u00f5i otse Kubernetes'e klastri sisse; tavaliselt kui teil on mitu Kubernetes'e klastri, oleks lihtsam paigaldada see eraldi. Teisest k\u00fcljest v\u00f5ite alati kasutada ametlikku helm-chart'i<\/a><\/noindex> ja paigaldada selle otse oma klastrisse.<\/p>\n

<\/p>\n

Keycloak'i andmete salvestamiseks vajate andmebaasi. Vaikimisi kasutatakse h2<\/code> (k\u00f5ik andmed salvestatakse kohapeal), kuid samuti on v\u00f5imalik kasutada postgres<\/code>, mysql<\/code> v\u00f5i mariadb<\/code>.
\nKui te siiski otsustate installida Keycloak eraldi, leiate p\u00f5hjalikumad juhised ametlikus dokumentatsioonis<\/a><\/noindex>.<\/p>\n

<\/p>\n

F\u00f6deratsiooni seadistamine<\/h2>\n

<\/p>\n

Esimese asjana loome uue realm'i. Realm on meie rakenduse ruum. Igal rakendusel v\u00f5ib olla oma realm, millel on erinevad kasutajad ja autoriseerimise seaded. Master realm'i kasutab Keycloak ise ja selle kasutamine millegi muu jaoks pole sobiv.<\/p>\n

<\/p>\n

Vajutame Lisa realm<\/strong><\/p>\n

<\/p>\n

Valik
\nV\u00e4\u00e4rtus<\/p>\n

Nimi<\/strong>
\nkubernetes<\/code><\/p>\n

Kuva nimi<\/strong>
\nKubernetes<\/code><\/p>\n

HTML kuvana nimi<\/strong>
\n<img src="https:\/\/kubernetes.io\/images\/nav_logo.svg" width="400" ><\/code><\/p>\n

<\/p>\n

Kubernetes kontrollib, kas kasutaja email on kinnitatud. Kuna kasutame oma LDAP-serverit, siis tagastab see kontroll tavaliselt false<\/code>. L\u00fclitame selle parameetri Kubernetes'is kuvamise v\u00e4lja:<\/p>\n

<\/p>\n

Kliendi ulatused<\/strong> --> Email<\/strong> --> Mapperid<\/strong> --> Email kinnitatud<\/strong> (Kustuta)<\/p>\n

<\/p>\n

N\u00fc\u00fcd seadistame f\u00f6deratsiooni, selleks liigume j\u00e4rgmisse kohta:<\/p>\n

<\/p>\n

Kasutaja f\u00f6deratsioon<\/strong> --> Lisa pakkujat\u2026<\/strong> --> ldap<\/strong><\/p>\n

<\/p>\n

Toon n\u00e4ite FreeIPA seadistamisest:<\/p>\n

<\/p>\n

Valik
\nV\u00e4\u00e4rtus<\/p>\n

Konsoli kuvana nimi<\/strong>
\nfreeipa.example.org<\/code><\/p>\n

Tootja<\/strong>
\nRed Hat Directory Server<\/code><\/p>\n

UUID LDAP atribuut<\/strong>
\nipauniqueid<\/code><\/p>\n

\u00dchenduse URL<\/strong>
\nldaps:\/\/freeipa.example.org<\/code><\/p>\n

Kasutajate DN<\/strong>
\ncn=users,cn=accounts,dc=example,dc=org<\/code><\/p>\n

Bind DN<\/strong>
\nuid=keycloak-svc,cn=users,cn=accounts,dc=example,dc=org<\/code><\/p>\n

Bind Credential<\/strong>
\n<password><\/code><\/p>\n

Luba Kerberos autentimine:<\/strong>
\non<\/code><\/p>\n

Kerberos Realm:<\/strong>
\nEXAMPLE.ORG<\/code><\/p>\n

Server Principal:<\/strong>
\nHTTP\/freeipa.example.org@EXAMPLE.ORG<\/code><\/p>\n

KeyTab:<\/strong>
\n\/etc\/krb5.keytab<\/code><\/p>\n

<\/p>\n

Kasutaja keycloak-svc<\/code> peab meie LDAP-serveris eelnevalt looma.<\/p>\n

<\/p>\n

Active Directory puhul piisab lihtsalt valikust Tootja: Active Directory<\/strong> ja vajalikud seadistused sisestatakse vormi automaatselt.<\/p>\n

<\/p>\n

Vajutame Salvesta<\/strong><\/p>\n

<\/p>\n

Liigume edasi:<\/p>\n

<\/p>\n

Kasutaja f\u00f6deratsioon<\/strong> --> freeipa.example.org<\/strong> --> Mapperid<\/strong> --> Eesnimi<\/strong><\/p>\n

<\/p>\n

Valik
\nV\u00e4\u00e4rtus<\/p>\n

Ldap atribuut<\/strong>
\ngivenName<\/code><\/p>\n

<\/p>\n

N\u00fc\u00fcd aktiveerime grupi kaardistamise:<\/p>\n

<\/p>\n

Kasutaja f\u00f6deratsioon<\/strong> --> freeipa.example.org<\/strong> --> Mapperid<\/strong> --> Loo<\/strong><\/p>\n

<\/p>\n

Valik
\nV\u00e4\u00e4rtus<\/p>\n

Nimi<\/strong>
\ngroups<\/code><\/p>\n

Mappi t\u00fc\u00fcp<\/strong>
\ngroup-ldap-mapper<\/code><\/p>\n

LDAP grupid DN<\/strong>
\ncn=groups,cn=accounts,dc=example,dc=org<\/code><\/p>\n

Kasutajagruppide hankimise strateegia<\/strong>
\nGET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE<\/code><\/p>\n

<\/p>\n

Sellega on f\u00f6deratsiooni seadistus l\u00f5petatud, liigutame kliendi seadistusse.<\/p>\n

<\/p>\n

Kliendi seadistus<\/h2>\n

<\/p>\n

Loodame uue kliendi (rakenduse, mis saab kasutajaid Keycloakist). Liigume:<\/p>\n

<\/p>\n

Kliendid<\/strong> --> Loo<\/strong><\/p>\n

<\/p>\n

Valik
\nV\u00e4\u00e4rtus<\/p>\n

Kliendi ID<\/strong>
\nkubernetes<\/code><\/p>\n

Ligip\u00e4\u00e4su t\u00fc\u00fcp<\/strong>
\nconfidential<\/code><\/p>\n

P\u00f5hi URL<\/strong>
\nhttp:\/\/kubernetes.example.org\/<\/code><\/p>\n

Kehtivad \u00fcmbersuunamise URId<\/strong>
\nhttp:\/\/kubernetes.example.org\/*<\/code><\/p>\n

Admini URL<\/strong>
\nhttp:\/\/kubernetes.example.org\/<\/code><\/p>\n

<\/p>\n

Loodame ka grupiteenuse:<\/p>\n

<\/p>\n

Kliendi ulatused<\/strong> --> Loo<\/strong><\/p>\n

<\/p>\n

Valik
\nV\u00e4\u00e4rtus<\/p>\n

Mall<\/strong>
\nMalli ei ole<\/code><\/p>\n

Nimi<\/strong>
\ngroups<\/code><\/p>\n

T\u00e4ielik grupi tee<\/strong>
\nfalse<\/code><\/p>\n

<\/p>\n

Ja seadistame kaardisti nende jaoks:<\/p>\n

<\/p>\n

Kliendi ulatused<\/strong> --> groups<\/strong> --> Mapperid<\/strong> --> Loo<\/strong><\/p>\n

<\/p>\n

Valik
\nV\u00e4\u00e4rtus<\/p>\n

Nimi<\/strong>
\ngroups<\/code><\/p>\n

Mappi t\u00fc\u00fcp<\/strong>
\nGrupi liikmelisus<\/code><\/p>\n

Tokeni v\u00e4ite nimi<\/strong>
\ngroups<\/code><\/p>\n

<\/p>\n

N\u00fc\u00fcd peame rakendama grupi kaardistamise meie kliendi ulatuses:<\/p>\n

<\/p>\n

Kliendid<\/strong> --> kubernetes<\/strong> --> Kliendi ulatused<\/strong> --> Vaikimisi kliendi ulatused<\/strong><\/p>\n

<\/p>\n

Valime groups<\/strong> \u00fches Saadaval kliendi ulatused<\/strong>, klikkige Lisa valitud<\/strong><\/p>\n

<\/p>\n

N\u00fc\u00fcd seadistame meie rakenduse autentimise, liigume:<\/p>\n

<\/p>\n

Kliendid<\/strong> --> kubernetes<\/strong><\/p>\n

<\/p>\n

Valik
\nV\u00e4\u00e4rtus<\/p>\n

Autoriseerimine lubatud<\/strong>
\nKAS<\/code><\/p>\n

<\/p>\n

Kliki salvesta<\/strong> ja sellega on kliendi seadistus l\u00f5petatud, n\u00fc\u00fcd vahekaardil<\/p>\n

<\/p>\n

Kliendid<\/strong> --> kubernetes<\/strong> --> Krediidid<\/strong><\/p>\n

<\/p>\n

saate saada Saladus<\/strong> mida me hiljem kasutame.<\/p>\n

<\/p>\n

Kubernetesi seadistamine<\/h2>\n

<\/p>\n

Kubernetes'i seadistus OIDC autoriseerimiseks on piisavalt triviaalne ja ei ole midagi keerulist. K\u00f5ik, mida vajate, on oma OIDC serveri CA-sertifikaadi paigutamine \/etc\/kubernetes\/pki\/oidc-ca.pem<\/code> ja vajalikud valikud kube-apiserverile lisamine.
\nSelleks v\u00e4rskendage \/etc\/kubernetes\/manifests\/kube-apiserver.yaml<\/code> k\u00f5igis teie klastrites:<\/p>\n

<\/p>\n

...\nspec:\n  containers:\n  - command:\n    - kube-apiserver\n...\n    - --oidc-ca-file=\/etc\/kubernetes\/pki\/oidc-ca.pem\n    - --oidc-client-id=kubernetes\n    - --oidc-groups-claim=groups\n    - --oidc-issuer-url=https:\/\/keycloak.example.org\/auth\/realms\/kubernetes\n    - --oidc-username-claim=email\n...<\/code><\/pre>\n
<\/p>\n
Ja uuendage ka kubeadm konfiguratsiooni klastris, et neid seadeid v\u00e4rskenduse k\u00e4igus mitte kaotada:<\/p>\n
<\/p>\n
kubectl edit -n kube-system configmaps kubeadm-config<\/code><\/pre>\n
<\/p>\n
...\ndata:\n  ClusterConfiguration: |\n    apiServer:\n      extraArgs:\n        oidc-ca-file: \/etc\/kubernetes\/pki\/oidc-ca.pem\n        oidc-client-id: kubernetes\n        oidc-groups-claim: groups\n        oidc-issuer-url: https:\/\/keycloak.example.org\/auth\/realms\/kubernetes\n        oidc-username-claim: email\n...<\/code><\/pre>\n
<\/p>\n
Kubernetesi seadistamine on n\u00fc\u00fcd l\u00f5petatud. V\u00f5ite samu toiminguid korrata k\u00f5igis teie Kubernetesi klastrites.<\/p>\n
<\/p>\n
Algseltautentimine<\/h2>\n
<\/p>\n
P\u00e4rast neid toiminguid on teil Kubernetesi klaster, millel on seadistatud OIDC-autentimine. Ainult \u00fcks asi on see, et teie kasutajatel pole veel seadistatud klienti ega oma kubeconfig'i. Selle probleemi lahendamiseks tuleb automaatselt anda kasutajatele kubeconfig p\u00e4rast eduka autentimise.<\/p>\n
<\/p>\n
Selleks v\u00f5ib kasutada spetsiaalseid veebirakendusi, mis v\u00f5imaldavad autentida kasutajat ja seej\u00e4rel alla laadida valmis kubeconfig'i. \u00dcks mugavamaid on Kuberos<\/a><\/noindex>, see v\u00f5imaldab \u00fches konfiguratsioonis kirjeldada k\u00f5iki Kubernetes-klastreid ja lihtsalt nende vahel vahetada.<\/p>\n
<\/p>\n
Kuberos'i seadistamiseks tuleb lihtsalt kirjeldada template'i kubeconfig'i jaoks ja k\u00e4ivitada j\u00e4rgmiste parameetritega:<\/p>\n
<\/p>\n
kuberos https:\/\/keycloak.example.org\/auth\/realms\/kubernetes kubernetes \/cfg\/secret \/cfg\/template<\/code><\/pre>\n
<\/p>\n
Rohkem \u00fcksikasjade saamiseks vaadake Kasutus<\/a><\/noindex> GitHubist.<\/p>\n
<\/p>\n
Samuti on v\u00f5imalik kasutada kubelogin<\/a><\/noindex> kui soovite autentimist teostada otse kasutaja arvutis. Sellisel juhul avaneb kasutajal brauseriaken, kus on sisselogimisvorm localhostil.<\/p>\n
<\/p>\n
Saadud kubeconfig'i saab kontrollida veebisaidil jwt.io<\/a><\/noindex>. Lihtsalt kopeerige v\u00e4\u00e4rtus users[].user.auth-provider.config.id-token<\/code> oma kubeconfig'ist vormi veebisaidil ja saate kohe dekr\u00fcpteerimise.<\/p>\n
<\/p>\n
RBAC-i seadistamine<\/h2>\n
<\/p>\n
RBAC-i seadistamisel on v\u00f5imalik viidata nii kasutajanimele (v\u00e4lja name<\/code> jwt-tokenis), kui ka kasutajagruppidele (v\u00e4lja groups<\/code> jwt-tokenis). Siin on n\u00e4idis \u00f5iguste seadistamiseks grupile kubernetes-default-namespace-admins<\/code>:<\/p>\n
\nkubernetes-default-namespace-admins.yaml<\/b><\/p>\n
apiVersion: rbac.authorization.k8s.io\/v1\nkind: Role\nmetadata:\n  name: default-admins\n  namespace: default\nrules:\n- apiGroups:\n  - '*'\n  resources:\n  - '*'\n  verbs:\n  - '*'\n---\napiVersion: rbac.authorization.k8s.io\/v1\nkind: RoleBinding\nmetadata:\n  name: kubernetes-default-namespace-admins\n  namespace: default\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: Role\n  name: default-admins\nsubjects:\n- apiGroup: rbac.authorization.k8s.io\n  kind: Group\n  name: kubernetes-default-namespace-admins<\/code><\/pre>\n
<\/p>\n
RBACi rohkem n\u00e4iteid leiate Kubernetes ametlikest dokumentidest<\/a><\/noindex><\/p>\n
<\/p>\n
auth-proxy seadistamine<\/h2>\n
<\/p>\n
On olemas suurep\u00e4rane projekt keycloak-gatekeeper<\/a><\/noindex>, mis v\u00f5imaldab kaitsta mis tahes rakendust, andes kasutajale v\u00f5imaluse autentida end OIDC-serveris. N\u00e4itan, kuidas seda seadistada Kubernetes Dashboardi n\u00e4itel:<\/p>\n
\ndashboard-proxy.yaml<\/b><\/p>\n
apiVersion: extensions\/v1beta1\nkind: Deployment\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  replicas: 1\n  template:\n    metadata:\n      labels:\n        app: kubernetes-dashboard-proxy\n    spec:\n      containers:\n      - args:\n        - --listen=0.0.0.0:80\n        - --discovery-url=https:\/\/keycloak.example.org\/auth\/realms\/kubernetes\n        - --client-id=kubernetes\n        - --client-secret=\n        - --redirection-url=https:\/\/kubernetes-dashboard.example.org\n        - --enable-refresh-tokens=true\n        - --encryption-key=ooTh6Chei1eefooyovai5ohwienuquoh\n        - --upstream-url=https:\/\/kubernetes-dashboard.kube-system\n        - --resources=uri=\/*\n        image: keycloak\/keycloak-gatekeeper\n        name: kubernetes-dashboard-proxy\n        ports:\n        - containerPort: 80\n          livenessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n          readinessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  ports:\n  - port: 80\n    protocol: TCP\n    targetPort: 80\n  selector:\n    app: kubernetes-dashboard-proxy\n  type: ClusterIP<\/code><\/pre>\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Keycloak \u043c\u043e\u0436\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u0442\u044c Kubernetes \u0441 \u0432\u0430\u0448\u0438\u043c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0438\u043c\u043f\u043e\u0440\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0433\u0440\u0443\u043f\u043f. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c RBAC \u0434\u043b\u044f \u0432\u0430\u0448\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c auth-proxy \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c Kubernetes Dashboard \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u043c\u0435\u044e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Keycloak \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u043c \u0447\u0442\u043e \u0443 \u0432\u0430\u0441 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c Active […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":70868,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-70867","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Seome LDAP-autentimise Kubernetesega | ProHoster","description":"L\u00fchike juhend selle kohta, kuidas kasutada Keycloak'i, et siduda Kubernetes teie LDAP-serveriga ja seadistada kasutajate ja r\u00fchmade importimine. See v\u00f5imaldab seadistada RBAC teie kasutajatele ja kasutada auth-proxy'd, et kaitsta Kubernetes Dashboard'i ja muid rakendusi, mis ei oska iseseisvalt autoriseerida. Keycloak'i installimine Eeldame, et teil on juba LDAP-server. See v\u00f5ib olla Active","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0438\u043a\u0440\u0443\u0447\u0438\u0432\u0430\u0435\u043c LDAP-\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u043a Kubernetes | ProHoster","og:description":"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Keycloak \u043c\u043e\u0436\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u0442\u044c Kubernetes \u0441 \u0432\u0430\u0448\u0438\u043c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0438\u043c\u043f\u043e\u0440\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0433\u0440\u0443\u043f\u043f. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c RBAC \u0434\u043b\u044f \u0432\u0430\u0448\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c auth-proxy \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c Kubernetes Dashboard \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u043c\u0435\u044e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Keycloak \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u043c \u0447\u0442\u043e \u0443 \u0432\u0430\u0441 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c Active","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-22T03:40:58+00:00","article:modified_time":"2020-03-03T13:14:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"70867","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:12:23","updated":"2022-09-28 01:58:51"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/70867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=70867"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/70867\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/70868"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=70867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=70867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=70867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}