{"id":70867,"date":"2020-02-22T06:40:58","date_gmt":"2020-02-22T03:40:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes"},"modified":"2020-03-03T16:14:36","modified_gmt":"2020-03-03T13:14:36","slug":"prikruchivaem-ldap-avtorizacziyu-k-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","title":{"rendered":"LDAP-authentik\u00e1ci\u00f3t kapcsolunk a Kuberneteshez","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"LDAP-authentik\u00e1ci\u00f3t kapcsolunk a Kuberneteshez\" src=\"\/wp-content\/uploads\/2020\/02\/2b0f0a4921e049a78a015e7693d697cf.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Egy r\u00f6vid \u00fatmutat\u00f3 arr\u00f3l, hogyan lehet a Keycloak seg\u00edts\u00e9g\u00e9vel \u00f6sszekapcsolni a Kubernetes-t a LDAP szerver\u00e9vel, \u00e9s be\u00e1ll\u00edtani a felhaszn\u00e1l\u00f3k \u00e9s csoportok import\u00e1l\u00e1s\u00e1t. Ez lehet\u0151v\u00e9 teszi az RBAC konfigur\u00e1l\u00e1s\u00e1t a felhaszn\u00e1l\u00f3k sz\u00e1m\u00e1ra \u00e9s az auth-proxy haszn\u00e1lat\u00e1t a Kubernetes Dashboard \u00e9s m\u00e1s alkalmaz\u00e1sok v\u00e9delm\u00e9re, amelyek nem tudj\u00e1k \u00f6n\u00e1ll\u00f3an kezelni az autoriz\u00e1ci\u00f3t.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2 id=\"ustanovka-keycloak\">Keycloak telep\u00edt\u00e9se<\/h2>\n<p><\/p>\n<p>Tegy\u00fck fel, hogy m\u00e1r van LDAP szervere. Ez lehet Active Directory, FreeIPA, OpenLDAP vagy b\u00e1rmi m\u00e1s. Ha nincs LDAP szervere, akkor alapvet\u0151en felhaszn\u00e1l\u00f3kat hozhat l\u00e9tre k\u00f6zvetlen\u00fcl a Keycloak fel\u00fclet\u00e9n, vagy haszn\u00e1lhat nyilv\u00e1nos oidc szolg\u00e1ltat\u00f3kat (Google, Github, Gitlab), az eredm\u00e9ny majdnem ugyanaz lesz.<\/p>\n<p><\/p>\n<p>El\u0151sz\u00f6r is telep\u00edts\u00fck mag\u00e1t a Keycloak-ot, a telep\u00edt\u00e9s v\u00e9gezhet\u0151 \u00f6n\u00e1ll\u00f3an is, vagy k\u00f6zvetlen\u00fcl a Kubernetes klaszterbe. \u00c1ltal\u00e1ban, ha t\u00f6bb Kubernetes klasztere van, c\u00e9lszer\u0171bb k\u00fcl\u00f6n telep\u00edteni. M\u00e1sr\u00e9szt mindig haszn\u00e1lhatja <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/charts\/tree\/master\/stable\/keycloak\">a hivatalos helm chart-ot<\/a><\/noindex> \u00e9s telep\u00edtheti k\u00f6zvetlen\u00fcl a klaszter\u00e9be.<\/p>\n<p><\/p>\n<p>A Keycloak adatok t\u00e1rol\u00e1s\u00e1hoz adatb\u00e1zisra lesz sz\u00fcks\u00e9ge. Alap\u00e9rtelmez\u00e9sk\u00e9nt <code>h2<\/code> (minden adat helyben t\u00e1rolva), de haszn\u00e1lhat <code>postgres<\/code>, <code>mysql<\/code> vagy <code>mariadb<\/code>.<br \/>\nHa m\u00e9gis k\u00fcl\u00f6n szeretn\u00e9 telep\u00edteni a Keycloak-ot, r\u00e9szletesebb \u00fatmutat\u00f3t tal\u00e1l itt <noindex><a rel=\"nofollow\" href=\"https:\/\/www.keycloak.org\/docs\/latest\/getting_started\/index.html\">hivatalos dokument\u00e1ci\u00f3ban<\/a><\/noindex>.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-federacii\">F\u00f6der\u00e1ci\u00f3 be\u00e1ll\u00edt\u00e1sa<\/h2>\n<p><\/p>\n<p>El\u0151sz\u00f6r is, hozzunk l\u00e9tre egy \u00faj realm-et. A realm az alkalmaz\u00e1sunk ter\u00fclete. Minden alkalmaz\u00e1s saj\u00e1t realm-mel rendelkezhet k\u00fcl\u00f6nb\u00f6z\u0151 felhaszn\u00e1l\u00f3kkal \u00e9s autoriz\u00e1ci\u00f3s be\u00e1ll\u00edt\u00e1sokkal. A Master realm-t a Keycloak saj\u00e1t maga haszn\u00e1lja, \u00e9s nem helyes m\u00e1sra haszn\u00e1lni.<\/p>\n<p><\/p>\n<p>Kattintunk <strong>Realm hozz\u00e1ad\u00e1sa<\/strong><\/p>\n<p><\/p>\n<p>Opci\u00f3<br \/>\n\u00c9rt\u00e9k<\/p>\n<p><strong>N\u00e9v<\/strong><br \/>\n<code>kubernetes<\/code><\/p>\n<p><strong>Megjelen\u00edt\u00e9si n\u00e9v<\/strong><br \/>\n<code>Kubernetes<\/code><\/p>\n<p><strong>HTML megjelen\u00edt\u00e9si n\u00e9v<\/strong><br \/>\n<code>&lt;img src=&quot;https:\/\/kubernetes.io\/images\/nav_logo.svg&quot; width=&quot;400&quot; &gt;<\/code><\/p>\n<p><\/p>\n<p>A Kubernetes alap\u00e9rtelmez\u00e9s szerint ellen\u0151rzi, hogy a felhaszn\u00e1l\u00f3nak van-e meger\u0151s\u00edtett e-mail c\u00edme vagy sem. Mivel saj\u00e1t LDAP szervert haszn\u00e1lunk, ez az ellen\u0151rz\u00e9s szinte mindig <code>hamis<\/code>lesz. N\u00e9zz\u00fck meg, hogyan kapcsolhatjuk ki ezt a param\u00e9tert a Kubernetes-ben:<\/p>\n<p><\/p>\n<p><strong>Kliencskop\u00e1k<\/strong> \u2192 <strong>Email<\/strong> \u2192 <strong>Lek\u00e9pez\u0151k<\/strong> \u2192 <strong>E-mail meger\u0151s\u00edtve<\/strong> (T\u00f6rl\u00e9s)<\/p>\n<p><\/p>\n<p>Most be\u00e1ll\u00edtjuk a f\u00f6der\u00e1ci\u00f3t, ehhez l\u00e9pj\u00fcnk a k\u00f6vetkez\u0151re:<\/p>\n<p><\/p>\n<p><strong>Felhaszn\u00e1l\u00f3i f\u00f6der\u00e1ci\u00f3<\/strong> \u2192 <strong>Szolg\u00e1ltat\u00f3 hozz\u00e1ad\u00e1sa\u2026<\/strong> \u2192 <strong>ldap<\/strong><\/p>\n<p><\/p>\n<p>P\u00e9ldak\u00e9nt bemutatok egy be\u00e1ll\u00edt\u00e1st a FreeIPA sz\u00e1m\u00e1ra:<\/p>\n<p><\/p>\n<p>Opci\u00f3<br \/>\n\u00c9rt\u00e9k<\/p>\n<p><strong>Konzol megjelen\u00edt\u00e9si n\u00e9v<\/strong><br \/>\n<code>freeipa.example.org<\/code><\/p>\n<p><strong>Sz\u00e1ll\u00edt\u00f3<\/strong><br \/>\n<code>Red Hat Directory Server<\/code><\/p>\n<p><strong>UUID LDAP attrib\u00fatum<\/strong><br \/>\n<code>ipauniqueid<\/code><\/p>\n<p><strong>Kapcsolati URL<\/strong><br \/>\n<code>ldaps:\/\/freeipa.example.org<\/code><\/p>\n<p><strong>Felhaszn\u00e1l\u00f3k DN<\/strong><br \/>\n<code>cn=users,cn=accounts,dc=example,dc=org<\/code><\/p>\n<p><strong>Bind DN<\/strong><br \/>\n<code>uid=keycloak-svc,cn=users,cn=accounts,dc=example,dc=org<\/code><\/p>\n<p><strong>Bind Credential<\/strong><br \/>\n<code>&lt;password&gt;<\/code><\/p>\n<p><strong>Kerberos hiteles\u00edt\u00e9si enged\u00e9lyez\u00e9se:<\/strong><br \/>\n<code>on<\/code><\/p>\n<p><strong>Kerberos Realm:<\/strong><br \/>\n<code>EXAMPLE.ORG<\/code><\/p>\n<p><strong>Szerver principal:<\/strong><br \/>\n<code>HTTP\/freeipa.example.org@EXAMPLE.ORG<\/code><\/p>\n<p><strong>KeyTab:<\/strong><br \/>\n<code>\/etc\/krb5.keytab<\/code><\/p>\n<p><\/p>\n<p>A felhaszn\u00e1l\u00f3t <code>keycloak-svc<\/code> el\u0151re l\u00e9tre kell hozni a LDAP szerver\u00fcnk\u00f6n.<\/p>\n<p><\/p>\n<p>Active Directory eset\u00e9n elegend\u0151 egyszer\u0171en kiv\u00e1lasztani <strong>Sz\u00e1ll\u00edt\u00f3: Active Directory<\/strong> \u00e9s a sz\u00fcks\u00e9ges be\u00e1ll\u00edt\u00e1sok automatikusan kit\u00f6lt\u0151dnek az \u0171rlapon.<\/p>\n<p><\/p>\n<p>Kattintunk <strong>Ment\u00e9s<\/strong><\/p>\n<p><\/p>\n<p>Most l\u00e9pj\u00fcnk a k\u00f6vetkez\u0151re:<\/p>\n<p><\/p>\n<p><strong>Felhaszn\u00e1l\u00f3i f\u00f6der\u00e1ci\u00f3<\/strong> \u2192 <strong>freeipa.example.org<\/strong> \u2192 <strong>Lek\u00e9pez\u0151k<\/strong> \u2192 <strong>Keresztn\u00e9v<\/strong><\/p>\n<p><\/p>\n<p>Opci\u00f3<br \/>\n\u00c9rt\u00e9k<\/p>\n<p><strong>LDAP attrib\u00fatum<\/strong><br \/>\n<code>givenName<\/code><\/p>\n<p><\/p>\n<p>Most kapcsoljuk be a csoportt\u00e9rk\u00e9pez\u00e9st:<\/p>\n<p><\/p>\n<p><strong>Felhaszn\u00e1l\u00f3i f\u00f6der\u00e1ci\u00f3<\/strong> \u2192 <strong>freeipa.example.org<\/strong> \u2192 <strong>Lek\u00e9pez\u0151k<\/strong> \u2192 <strong>L\u00e9trehoz\u00e1s<\/strong><\/p>\n<p><\/p>\n<p>Opci\u00f3<br \/>\n\u00c9rt\u00e9k<\/p>\n<p><strong>N\u00e9v<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><strong>T\u00e9rk\u00e9pez\u0151 t\u00edpus<\/strong><br \/>\n<code>group-ldap-mapper<\/code><\/p>\n<p><strong>LDAP Csoportok DN<\/strong><br \/>\n<code>cn=groups,cn=accounts,dc=example,dc=org<\/code><\/p>\n<p><strong>Felhaszn\u00e1l\u00f3i Csoportok Lek\u00e9rdez\u00e9si Strat\u00e9gi\u00e1ja<\/strong><br \/>\n<code>GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE<\/code><\/p>\n<p><\/p>\n<p>Ezzel befejezt\u00fck a sz\u00f6vets\u00e9gi be\u00e1ll\u00edt\u00e1st, l\u00e9pj\u00fcnk tov\u00e1bb az \u00fcgyf\u00e9l be\u00e1ll\u00edt\u00e1s\u00e1ra.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-klienta\">Kliens be\u00e1ll\u00edt\u00e1sa<\/h2>\n<p><\/p>\n<p>Hozzunk l\u00e9tre egy \u00faj \u00fcgyfelet (alkalmaz\u00e1s, amely felhaszn\u00e1l\u00f3kat fog szerezni a Keycloak-b\u00f3l). L\u00e9pj\u00fcnk:<\/p>\n<p><\/p>\n<p><strong>\u00dcgyfelek<\/strong> \u2192 <strong>L\u00e9trehoz\u00e1s<\/strong><\/p>\n<p><\/p>\n<p>Opci\u00f3<br \/>\n\u00c9rt\u00e9k<\/p>\n<p><strong>Client ID<\/strong><br \/>\n<code>kubernetes<\/code><\/p>\n<p><strong>Hozz\u00e1f\u00e9r\u00e9si t\u00edpus<\/strong><br \/>\n<code>bizalmas<\/code><\/p>\n<p><strong>Gy\u00f6k\u00e9r URL<\/strong><br \/>\n<code>http:\/\/kubernetes.example.org\/<\/code><\/p>\n<p><strong>\u00c9rv\u00e9nyes \u00c1tir\u00e1ny\u00edt\u00f3 URI-k<\/strong><br \/>\n<code>http:\/\/kubernetes.example.org\/*<\/code><\/p>\n<p><strong>Admin URL<\/strong><br \/>\n<code>http:\/\/kubernetes.example.org\/<\/code><\/p>\n<p><\/p>\n<p>Most l\u00e9trehozunk egy scope-ot a csoportok sz\u00e1m\u00e1ra:<\/p>\n<p><\/p>\n<p><strong>\u00dcgyf\u00e9l Scoped<\/strong> \u2192 <strong>L\u00e9trehoz\u00e1s<\/strong><\/p>\n<p><\/p>\n<p>Opci\u00f3<br \/>\n\u00c9rt\u00e9k<\/p>\n<p><strong>Sablon<\/strong><br \/>\n<code>Nincs sablon<\/code><\/p>\n<p><strong>N\u00e9v<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><strong>Teljes csoport \u00fatvonal<\/strong><br \/>\n<code>hamis<\/code><\/p>\n<p><\/p>\n<p>\u00c9s konfigur\u00e1lunk egy mappert sz\u00e1mukra:<\/p>\n<p><\/p>\n<p><strong>\u00dcgyf\u00e9l Scoped<\/strong> \u2192 <strong>groups<\/strong> \u2192 <strong>Lek\u00e9pez\u0151k<\/strong> \u2192 <strong>L\u00e9trehoz\u00e1s<\/strong><\/p>\n<p><\/p>\n<p>Opci\u00f3<br \/>\n\u00c9rt\u00e9k<\/p>\n<p><strong>N\u00e9v<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><strong>T\u00e9rk\u00e9pez\u0151 t\u00edpus<\/strong><br \/>\n<code>Csoporttags\u00e1g<\/code><\/p>\n<p><strong>Token Ig\u00e9ny N\u00e9v<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><\/p>\n<p>Most enged\u00e9lyezn\u00fcnk kell a csoportok t\u00e9rk\u00e9pez\u00e9s\u00e9t az \u00fcgyf\u00e9l scope-unkban:<\/p>\n<p><\/p>\n<p><strong>\u00dcgyfelek<\/strong> \u2192 <strong>kubernetes<\/strong> \u2192 <strong>\u00dcgyf\u00e9l Scoped<\/strong> \u2192 <strong>Alap\u00e9rtelmezett \u00dcgyf\u00e9l Scoped<\/strong><\/p>\n<p><\/p>\n<p>Kiv\u00e1laszt\u00e1s <strong>groups<\/strong> be. <strong>El\u00e9rhet\u0151 Client Scopes<\/strong>, kattintsunk <strong>Kiv\u00e1lasztott hozz\u00e1ad\u00e1sa<\/strong><\/p>\n<p><\/p>\n<p>Most konfigur\u00e1ljuk az alkalmaz\u00e1sunk hiteles\u00edt\u00e9s\u00e9t, l\u00e9pj\u00fcnk:<\/p>\n<p><\/p>\n<p><strong>\u00dcgyfelek<\/strong> \u2192 <strong>kubernetes<\/strong><\/p>\n<p><\/p>\n<p>Opci\u00f3<br \/>\n\u00c9rt\u00e9k<\/p>\n<p><strong>Enged\u00e9lyezett jogosults\u00e1g<\/strong><br \/>\n<code>ON<\/code><\/p>\n<p><\/p>\n<p>Kattintsunk <strong>ment\u00e9s<\/strong> \u00e9s ezzel befejezt\u00fck az \u00fcgyf\u00e9l be\u00e1ll\u00edt\u00e1s\u00e1t, most a \"<\/p>\n<p><\/p>\n<p><strong>\u00dcgyfelek<\/strong> \u2192 <strong>kubernetes<\/strong> \u2192 <strong>Hiteles\u00edt\u0151 adatok<\/strong><\/p>\n<p><\/p>\n<p>f\u00fcl\u00f6n meg tudja szerezni <strong>Titkos kulcs<\/strong> amelyet a k\u00e9s\u0151bbiekben haszn\u00e1lni fogunk.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-kubernetes\">Kubernetes be\u00e1ll\u00edt\u00e1sa<\/h2>\n<p><\/p>\n<p>A Kubernetes be\u00e1ll\u00edt\u00e1sa OIDC-hiteles\u00edt\u00e9ssel meglehet\u0151sen egyszer\u0171, \u00e9s nem jelent komoly kih\u00edv\u00e1st. Mindez annyit ig\u00e9nyel, hogy a CA-tan\u00fas\u00edtv\u00e1nyt az OIDC-szerver\u00e9nek elhelyezz\u00fck a <code>\/etc\/kubernetes\/pki\/oidc-ca.pem<\/code> majd hozz\u00e1adjuk a sz\u00fcks\u00e9ges opci\u00f3kat a kube-apiserverhez.<br \/>\nEhhez friss\u00edtse a <code>\/etc\/kubernetes\/manifests\/kube-apiserver.yaml<\/code> minden mester\u00e9ben:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">...\nspec:\n  containers:\n  - command:\n    - kube-apiserver\n...\n    - --oidc-ca-file=\\\/etc\\\/kubernetes\\\/pki\\\/oidc-ca.pem\n    - --oidc-client-id=kubernetes\n    - --oidc-groups-claim=groups\n    - --oidc-issuer-url=https:\\\/\\\/keycloak.example.org\\\/auth\\\/realms\\\/kubernetes\n    - --oidc-username-claim=email\n...<\/code><\/pre>\n<p><\/p>\n<p>\u00c9s friss\u00edtse a kubeadm konfigur\u00e1ci\u00f3t a klaszterben, hogy ne vesz\u00edtse el ezeket a be\u00e1ll\u00edt\u00e1sokat a friss\u00edt\u00e9skor:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">kubectl edit -n kube-system configmaps kubeadm-config<\/code><\/pre>\n<p><\/p>\n<pre><code class=\"plaintext\">...\ndata:\n  ClusterConfiguration: |\n    apiServer:\n      extraArgs:\n        oidc-ca-file: \\\/etc\\\/kubernetes\\\/pki\\\/oidc-ca.pem\n        oidc-client-id: kubernetes\n        oidc-groups-claim: groups\n        oidc-issuer-url: https:\\\/\\\/keycloak.example.org\\\/auth\\\/realms\\\/kubernetes\n        oidc-username-claim: email\n...<\/code><\/pre>\n<p><\/p>\n<p>Ezzel befejezt\u00fck a Kubernetes be\u00e1ll\u00edt\u00e1s\u00e1t. Ezeket az int\u00e9zked\u00e9seket megism\u00e9telheti minden Kubernetes-klaszter\u00e9ben.<\/p>\n<p><\/p>\n<h2 id=\"nachalnaya-avtorizaciya\">Kezdeti hiteles\u00edt\u00e9s<\/h2>\n<p><\/p>\n<p>Ezek ut\u00e1n m\u00e1r rendelkezni fog egy Kubernetes-klaszterrel, amely OIDC-hitel\u00edt\u00e9ssel van be\u00e1ll\u00edtva. Az egyetlen probl\u00e9ma, hogy a felhaszn\u00e1l\u00f3iak m\u00e9g nem rendelkeznek be\u00e1ll\u00edtott \u00fcgyf\u00e9llel \u00e9s saj\u00e1t kubeconfiggal. A probl\u00e9ma megold\u00e1s\u00e1hoz automatikus kubeconfig kiad\u00e1sra van sz\u00fcks\u00e9g a felhaszn\u00e1l\u00f3k sz\u00e1m\u00e1ra a sikeres hiteles\u00edt\u00e9s ut\u00e1n.<\/p>\n<p><\/p>\n<p>Ehhez speci\u00e1lis webalkalmaz\u00e1sokat haszn\u00e1lhat, amelyek lehet\u0151v\u00e9 teszik a felhaszn\u00e1l\u00f3 hiteles\u00edt\u00e9s\u00e9t, majd a k\u00e9sz kubeconfig let\u00f6lt\u00e9s\u00e9t. Az egyik a legegyszer\u0171bb \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/negz\/kuberos\">Kuberos<\/a><\/noindex>, amely lehet\u0151v\u00e9 teszi, hogy egy konfigur\u00e1ci\u00f3n bel\u00fcl minden Kubernetes-klasztert le\u00edrjon, \u00e9s k\u00f6nnyen v\u00e1ltogathasson k\u00f6z\u00f6tt\u00fck.<\/p>\n<p><\/p>\n<p>A Kuberos be\u00e1ll\u00edt\u00e1s\u00e1hoz elegend\u0151 a kubeconfig sablon le\u00edr\u00e1sa \u00e9s a k\u00f6vetkez\u0151 param\u00e9terekkel val\u00f3 futtat\u00e1s:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">kuberos https:\/\/keycloak.example.org\/auth\/realms\/kubernetes kubernetes \/cfg\/secret \/cfg\/template<\/code><\/pre>\n<p><\/p>\n<p>A r\u00e9szletesebb inform\u00e1ci\u00f3k\u00e9rt n\u00e9zze meg <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/negz\/kuberos#usage\">Felhaszn\u00e1l\u00e1s<\/a><\/noindex> a Github-on.<\/p>\n<p><\/p>\n<p>Emellett haszn\u00e1lhatja <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/int128\/kubelogin\">kubelogin<\/a><\/noindex> , ha k\u00f6zvetlen\u00fcl a felhaszn\u00e1l\u00f3 sz\u00e1m\u00edt\u00f3g\u00e9p\u00e9n szeretne bejelentkezni. Ebben az esetben a felhaszn\u00e1l\u00f3nak egy b\u00f6ng\u00e9sz\u0151ablak ny\u00edlik meg, amelyben a localhost-on kell bejelentkeznie.<\/p>\n<p><\/p>\n<p>A kapott kubeconfig ellen\u0151rizhet\u0151 a weboldalon <noindex><a rel=\"nofollow\" href=\"https:\/\/jwt.io\/#debugger-io\">jwt.io<\/a><\/noindex>. Csak m\u00e1solja a k\u00f6vetkez\u0151 \u00e9rt\u00e9ket <code>users[].user.auth-provider.config.id-token<\/code> a kubeconfig-j\u00e1b\u00f3l a weboldalon tal\u00e1lhat\u00f3 \u0171rlapba, \u00e9s azonnal megkapja a dek\u00f3dol\u00e1st.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-rbac\">RBAC be\u00e1ll\u00edt\u00e1sa<\/h2>\n<p><\/p>\n<p>RBAC be\u00e1ll\u00edt\u00e1sakor hivatkozhat felhaszn\u00e1l\u00f3nev\u00e9re (mez\u0151 <code>name<\/code> a jwt-tokenben), vagy felhaszn\u00e1l\u00f3i csoportra (mez\u0151 <code>groups<\/code> a jwt-tokenben). \u00cdme egy p\u00e9lda a jogok be\u00e1ll\u00edt\u00e1s\u00e1ra a csoport sz\u00e1m\u00e1ra: <code>kubernetes-default-namespace-admins<\/code>:<\/p>\n<p>\n<b class=\"spoiler_title\">kubernetes-default-namespace-admins.yaml<\/b><\/p>\n<pre><code class=\"plaintext\">apiVersion: rbac.authorization.k8s.io\/v1\nkind: Role\nmetadata:\n  name: default-admins\n  namespace: default\nrules:\n- apiGroups:\n  - '*'\n  resources:\n  - '*'\n  verbs:\n  - '*'\n---\napiVersion: rbac.authorization.k8s.io\/v1\nkind: RoleBinding\nmetadata:\n  name: kubernetes-default-namespace-admins\n  namespace: default\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: Role\n  name: default-admins\nsubjects:\n- apiGroup: rbac.authorization.k8s.io\n  kind: Group\n  name: kubernetes-default-namespace-admins<\/code><\/pre>\n<p><\/p>\n<p>Tov\u00e1bbi p\u00e9ld\u00e1k az RBAC-ra tal\u00e1lhat\u00f3k itt: <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/rbac\/\">a Kubernetes hivatalos dokument\u00e1ci\u00f3ja<\/a><\/noindex><\/p>\n<p><\/p>\n<h2 id=\"nastroyka-auth-proxy\">auth-proxy be\u00e1ll\u00edt\u00e1sa<\/h2>\n<p><\/p>\n<p>Van egy nagyszer\u0171 projekt <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/keycloak\/keycloak-gatekeeper\">keycloak-gatekeeper<\/a><\/noindex>, amely lehet\u0151v\u00e9 teszi b\u00e1rmely alkalmaz\u00e1s v\u00e9delm\u00e9t, lehet\u0151s\u00e9get adva a felhaszn\u00e1l\u00f3nak az OIDC-szerveren val\u00f3 hiteles\u00edt\u00e9sre. Megmutatom, hogyan \u00e1ll\u00edthat\u00f3 be a Kubernetes Dashboard p\u00e9ld\u00e1j\u00e1n kereszt\u00fcl:<\/p>\n<p>\n<b class=\"spoiler_title\">dashboard-proxy.yaml<\/b><\/p>\n<pre><code class=\"plaintext\">apiVersion: extensions\/v1beta1\nkind: Deployment\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  replicas: 1\n  template:\n    metadata:\n      labels:\n        app: kubernetes-dashboard-proxy\n    spec:\n      containers:\n      - args:\n        - --listen=0.0.0.0:80\n        - --discovery-url=https:\/\/keycloak.example.org\/auth\/realms\/kubernetes\n        - --client-id=kubernetes\n        - --client-secret=\n        - --redirection-url=https:\/\/kubernetes-dashboard.example.org\n        - --enable-refresh-tokens=true\n        - --encryption-key=ooTh6Chei1eefooyovai5ohwienuquoh\n        - --upstream-url=https:\/\/kubernetes-dashboard.kube-system\n        - --resources=uri=\/*\n        image: keycloak\/keycloak-gatekeeper\n        name: kubernetes-dashboard-proxy\n        ports:\n        - containerPort: 80\n          livenessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n          readinessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  ports:\n  - port: 80\n    protocol: TCP\n    targetPort: 80\n  selector:\n    app: kubernetes-dashboard-proxy\n  type: ClusterIP<\/code><\/pre>\n<p>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/441112\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Keycloak \u043c\u043e\u0436\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u0442\u044c Kubernetes \u0441 \u0432\u0430\u0448\u0438\u043c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0438\u043c\u043f\u043e\u0440\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0433\u0440\u0443\u043f\u043f. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c RBAC \u0434\u043b\u044f \u0432\u0430\u0448\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c auth-proxy \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c Kubernetes Dashboard \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u043c\u0435\u044e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Keycloak \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u043c \u0447\u0442\u043e \u0443 \u0432\u0430\u0441 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c Active [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":70868,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-70867","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0440\u0438\u043a\u0440\u0443\u0447\u0438\u0432\u0430\u0435\u043c LDAP-\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u043a Kubernetes | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-22T03:40:58+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47LDAP-hiteles\u00edt\u00e9s bek\u00f6t\u00e9se a Kubernetesbe | ProHoster","description":"Egy r\u00f6vid \u00fatmutat\u00f3 arr\u00f3l, hogyan.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0438\u043a\u0440\u0443\u0447\u0438\u0432\u0430\u0435\u043c LDAP-\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u043a Kubernetes | ProHoster","og:description":"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a.","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-22T03:40:58+00:00","article:modified_time":"2020-03-03T13:14:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"70867","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:12:23","updated":"2022-09-28 01:58:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/70867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=70867"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/70867\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/70868"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=70867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=70867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=70867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}