{"id":70867,"date":"2020-02-22T06:40:58","date_gmt":"2020-02-22T03:40:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes"},"modified":"2020-03-03T16:14:36","modified_gmt":"2020-03-03T13:14:36","slug":"prikruchivaem-ldap-avtorizacziyu-k-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","title":{"rendered":"Integrando a autentica\u00e7\u00e3o LDAP ao Kubernetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Integrando<\/p>\n

<\/p>\n

Um pequeno guia sobre como usar o Keycloak para vincular o Kubernetes ao seu servidor LDAP e configurar a importa\u00e7\u00e3o de usu\u00e1rios e grupos. Isso permitir\u00e1 configurar o RBAC para seus usu\u00e1rios e usar o auth-proxy para proteger o Kubernetes Dashboard e outros aplicativos que n\u00e3o conseguem autenticar por conta pr\u00f3pria.<\/p>\n

<\/a><\/noindex><\/p>\n

Instala\u00e7\u00e3o do Keycloak<\/h2>\n

<\/p>\n

Supondo que voc\u00ea j\u00e1 tenha um servidor LDAP. Isso pode ser um Active Directory, FreeIPA, OpenLDAP ou qualquer outra coisa. Se voc\u00ea n\u00e3o tiver um servidor LDAP, poder\u00e1, em princ\u00edpio, criar usu\u00e1rios diretamente na interface do Keycloak ou usar provedores OIDC p\u00fablicos (Google, Github, Gitlab), o resultado ser\u00e1 quase o mesmo.<\/p>\n

<\/p>\n

Primeiramente, vamos instalar o Keycloak. A instala\u00e7\u00e3o pode ser feita separadamente ou diretamente no cluster Kubernetes. Normalmente, se voc\u00ea tiver v\u00e1rios clusters Kubernetes, seria mais f\u00e1cil instal\u00e1-lo separadamente. Por outro lado, voc\u00ea sempre pode usar o chart helm oficial<\/a><\/noindex> e instal\u00e1-lo diretamente em seu cluster.<\/p>\n

<\/p>\n

Para armazenar os dados do Keycloak, voc\u00ea precisar\u00e1 de um banco de dados. Por padr\u00e3o, utiliza-se h2<\/code> (todos os dados s\u00e3o armazenados localmente), mas \u00e9 tamb\u00e9m poss\u00edvel usar postgres<\/code>, mysql<\/code> ou mariadb<\/code>.
\nSe voc\u00ea decidiu instalar o Keycloak separadamente, encontrar\u00e1 instru\u00e7\u00f5es mais detalhadas em documenta\u00e7\u00e3o oficial<\/a><\/noindex>.<\/p>\n

<\/p>\n

Configura\u00e7\u00e3o da federa\u00e7\u00e3o<\/h2>\n

<\/p>\n

Primeiramente, vamos criar um novo realm. Um realm \u00e9 o espa\u00e7o do nosso aplicativo. Cada aplicativo pode ter seu pr\u00f3prio realm com diferentes usu\u00e1rios e configura\u00e7\u00f5es de autentica\u00e7\u00e3o. O realm Master \u00e9 usado pelo pr\u00f3prio Keycloak e n\u00e3o \u00e9 apropriado utiliz\u00e1-lo para mais nada.<\/p>\n

<\/p>\n

Clique em Adicionar realm<\/strong><\/p>\n

<\/p>\n

Op\u00e7\u00e3o
\nValor<\/p>\n

Nome<\/strong>
\nkubernetes<\/code><\/p>\n

Nome de exibi\u00e7\u00e3o<\/strong>
\nKubernetes<\/code><\/p>\n

Nome de exibi\u00e7\u00e3o em HTML<\/strong>
\n<img src="https:\/\/kubernetes.io\/images\/nav_logo.svg" width="400" ><\/code><\/p>\n

<\/p>\n

O Kubernetes, por padr\u00e3o, verifica se o e-mail do usu\u00e1rio est\u00e1 confirmado ou n\u00e3o. Como estamos usando nosso pr\u00f3prio servidor LDAP, essa verifica\u00e7\u00e3o quase sempre retornar\u00e1 falso<\/code>. Vamos desabilitar a apresenta\u00e7\u00e3o desse par\u00e2metro no Kubernetes:<\/p>\n

<\/p>\n

Escopos de cliente<\/strong> \u2192 Email<\/strong> \u2192 Mappers<\/strong> \u2192 Email verificado<\/strong> (Excluir)<\/p>\n

<\/p>\n

Agora vamos configurar a federa\u00e7\u00e3o, para isso, vamos para:<\/p>\n

<\/p>\n

Federa\u00e7\u00e3o de usu\u00e1rios<\/strong> \u2192 Adicionar provedor\u2026<\/strong> \u2192 ldap<\/strong><\/p>\n

<\/p>\n

Vou dar um exemplo de configura\u00e7\u00e3o para FreeIPA:<\/p>\n

<\/p>\n

Op\u00e7\u00e3o
\nValor<\/p>\n

Nome de exibi\u00e7\u00e3o do console<\/strong>
\nfreeipa.exemplo.org<\/code><\/p>\n

Fornecedor<\/strong>
\nRed Hat Directory Server<\/code><\/p>\n

Atributo UUID LDAP<\/strong>
\nipauniqueid<\/code><\/p>\n

URL de conex\u00e3o<\/strong>
\nldaps:\/\/freeipa.example.org<\/code><\/p>\n

DN dos usu\u00e1rios<\/strong>
\ncn=usu\u00e1rios,cn=accounts,dc=exemplo,dc=org<\/code><\/p>\n

DN de liga\u00e7\u00e3o<\/strong>
\nuid=keycloak-svc,cn=users,cn=accounts,dc=exemplo,dc=org<\/code><\/p>\n

Credencial de liga\u00e7\u00e3o<\/strong>
\n<senha><\/code><\/p>\n

Permitir autentica\u00e7\u00e3o Kerberos:<\/strong>
\nativado<\/code><\/p>\n

Reino Kerberos:<\/strong>
\nEXAMPLE.ORG<\/code><\/p>\n

Principal do servidor:<\/strong>
\nHTTP\/freeipa.exemplo.org@EXAMPLE.ORG<\/code><\/p>\n

KeyTab:<\/strong>
\n\/etc\/krb5.keytab<\/code><\/p>\n

<\/p>\n

O usu\u00e1rio keycloak-svc<\/code> precisa ser criado previamente em nosso servidor LDAP.<\/p>\n

<\/p>\n

No caso do Active Directory, basta selecionar Fornecedor: Active Directory<\/strong> e as configura\u00e7\u00f5es necess\u00e1rias ser\u00e3o preenchidas automaticamente no formul\u00e1rio.<\/p>\n

<\/p>\n

Clique em Salvar<\/strong><\/p>\n

<\/p>\n

Agora vamos para:<\/p>\n

<\/p>\n

Federa\u00e7\u00e3o de usu\u00e1rios<\/strong> \u2192 freeipa.exemplo.org<\/strong> \u2192 Mappers<\/strong> \u2192 Primeiro Nome<\/strong><\/p>\n

<\/p>\n

Op\u00e7\u00e3o
\nValor<\/p>\n

Atributo Ldap<\/strong>
\ngivenName<\/code><\/p>\n

<\/p>\n

Agora vamos ativar o mapeamento de grupos:<\/p>\n

<\/p>\n

Federa\u00e7\u00e3o de usu\u00e1rios<\/strong> \u2192 freeipa.exemplo.org<\/strong> \u2192 Mappers<\/strong> \u2192 Criar<\/strong><\/p>\n

<\/p>\n

Op\u00e7\u00e3o
\nValor<\/p>\n

Nome<\/strong>
\ngrupos<\/code><\/p>\n

Tipo de Mapeador<\/strong>
\ngroup-ldap-mapper<\/code><\/p>\n

LDAP Groups DN<\/strong>
\ncn=groups,cn=accounts,dc=example,dc=org<\/code><\/p>\n

Estrat\u00e9gia de Recupera\u00e7\u00e3o de Grupos de Usu\u00e1rios<\/strong>
\nGET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE<\/code><\/p>\n

<\/p>\n

Com isso, a configura\u00e7\u00e3o da federa\u00e7\u00e3o est\u00e1 completa, vamos para a configura\u00e7\u00e3o do cliente.<\/p>\n

<\/p>\n

Configura\u00e7\u00e3o do Cliente<\/h2>\n

<\/p>\n

Vamos criar um novo cliente (aplicativo que receber\u00e1 usu\u00e1rios do Keycloak). Vamos para:<\/p>\n

<\/p>\n

Clientes<\/strong> \u2192 Criar<\/strong><\/p>\n

<\/p>\n

Op\u00e7\u00e3o
\nValor<\/p>\n

ID do Cliente<\/strong>
\nkubernetes<\/code><\/p>\n

Tipo de Acesso<\/strong>
\nconfidenrial<\/code><\/p>\n

URL Raiz<\/strong>
\nhttp:\/\/kubernetes.example.org\/<\/code><\/p>\n

URIs de Redirecionamento V\u00e1lidos<\/strong>
\nhttp:\/\/kubernetes.example.org\/*<\/code><\/p>\n

URL do Admin<\/strong>
\nhttp:\/\/kubernetes.example.org\/<\/code><\/p>\n

<\/p>\n

Tamb\u00e9m criaremos um escopo para grupos:<\/p>\n

<\/p>\n

Escopos do Cliente<\/strong> \u2192 Criar<\/strong><\/p>\n

<\/p>\n

Op\u00e7\u00e3o
\nValor<\/p>\n

Modelo<\/strong>
\nSem modelo<\/code><\/p>\n

Nome<\/strong>
\ngrupos<\/code><\/p>\n

Caminho completo do grupo<\/strong>
\nfalso<\/code><\/p>\n

<\/p>\n

E vamos configurar o mapeador para eles:<\/p>\n

<\/p>\n

Escopos do Cliente<\/strong> \u2192 grupos<\/strong> \u2192 Mappers<\/strong> \u2192 Criar<\/strong><\/p>\n

<\/p>\n

Op\u00e7\u00e3o
\nValor<\/p>\n

Nome<\/strong>
\ngrupos<\/code><\/p>\n

Tipo de Mapeador<\/strong>
\nMembro do Grupo<\/code><\/p>\n

Nome da Reivindica\u00e7\u00e3o do Token<\/strong>
\ngrupos<\/code><\/p>\n

<\/p>\n

Agora precisamos ativar o mapeamento de grupos em nosso escopo de cliente:<\/p>\n

<\/p>\n

Clientes<\/strong> \u2192 kubernetes<\/strong> \u2192 Escopos do Cliente<\/strong> \u2192 Escopos Padr\u00e3o do Cliente<\/strong><\/p>\n

<\/p>\n

Escolhendo grupos<\/strong> em Escopos de Cliente Dispon\u00edveis<\/strong>, clicamos em Adicionar selecionados<\/strong><\/p>\n

<\/p>\n

Agora vamos configurar a autentica\u00e7\u00e3o do nosso aplicativo, vamos para:<\/p>\n

<\/p>\n

Clientes<\/strong> \u2192 kubernetes<\/strong><\/p>\n

<\/p>\n

Op\u00e7\u00e3o
\nValor<\/p>\n

Autoriza\u00e7\u00e3o Habilitada<\/strong>
\nATIVADO<\/code><\/p>\n

<\/p>\n

Clicaremos em salvar<\/strong> e assim a configura\u00e7\u00e3o do cliente est\u00e1 conclu\u00edda, agora na aba<\/p>\n

<\/p>\n

Clientes<\/strong> \u2192 kubernetes<\/strong> \u2192 Credenciais<\/strong><\/p>\n

<\/p>\n

voc\u00ea poder\u00e1 obter Segredo<\/strong> que usaremos posteriormente.<\/p>\n

<\/p>\n

Configura\u00e7\u00e3o do Kubernetes<\/h2>\n

<\/p>\n

A configura\u00e7\u00e3o do Kubernetes para autoriza\u00e7\u00e3o OIDC \u00e9 bastante trivial e n\u00e3o \u00e9 muito complicada. Tudo que voc\u00ea precisa fazer \u00e9 colocar o certificado CA do seu servidor OIDC em \/etc\/kubernetes\/pki\/oidc-ca.pem<\/code> e adicionar as op\u00e7\u00f5es necess\u00e1rias para kube-apiserver.
\nPara isso, atualize \/etc\/kubernetes\/manifests\/kube-apiserver.yaml<\/code> em todos os seus mestres:<\/p>\n

<\/p>\n

...\nspec:\n  containers:\n  - command:\n    - kube-apiserver\n...\n    - --oidc-ca-file=\\\/etc\\\/kubernetes\\\/pki\\\/oidc-ca.pem\n    - --oidc-client-id=kubernetes\n    - --oidc-groups-claim=groups\n    - --oidc-issuer-url=https:\\\/\\\/keycloak.example.org\\\/auth\\\/realms\\\/kubernetes\n    - --oidc-username-claim=email\n...<\/code><\/pre>\n
<\/p>\n
Al\u00e9m disso, atualize a configura\u00e7\u00e3o do kubeadm no cluster para n\u00e3o perder essas configura\u00e7\u00f5es durante a atualiza\u00e7\u00e3o:<\/p>\n
<\/p>\n
kubectl edit -n kube-system configmaps kubeadm-config<\/code><\/pre>\n
<\/p>\n
...\ndata:\n  ClusterConfiguration: |\n    apiServer:\n      extraArgs:\n        oidc-ca-file: \\\/etc\\\/kubernetes\\\/pki\\\/oidc-ca.pem\n        oidc-client-id: kubernetes\n        oidc-groups-claim: groups\n        oidc-issuer-url: https:\\\/\\\/keycloak.example.org\\\/auth\\\/realms\\\/kubernetes\n        oidc-username-claim: email\n...<\/code><\/pre>\n
<\/p>\n
Com isso, a configura\u00e7\u00e3o do Kubernetes est\u00e1 conclu\u00edda. Voc\u00ea pode repetir estas a\u00e7\u00f5es em todos os seus clusters Kubernetes.<\/p>\n
<\/p>\n
Autentica\u00e7\u00e3o Inicial<\/h2>\n
<\/p>\n
Ap\u00f3s essas a\u00e7\u00f5es, voc\u00ea j\u00e1 ter\u00e1 um cluster Kubernetes com a autoriza\u00e7\u00e3o OIDC configurada. A \u00fanica quest\u00e3o \u00e9 que seus usu\u00e1rios ainda n\u00e3o t\u00eam um cliente configurado, assim como seu pr\u00f3prio kubeconfig. Para resolver esse problema, voc\u00ea precisa configurar a emiss\u00e3o autom\u00e1tica do kubeconfig para os usu\u00e1rios ap\u00f3s a autentica\u00e7\u00e3o bem-sucedida.<\/p>\n
<\/p>\n
Para isso, voc\u00ea pode usar aplica\u00e7\u00f5es web espec\u00edficas que permitem a autentica\u00e7\u00e3o do usu\u00e1rio e, em seguida, baixar o kubeconfig pronto. Uma das mais convenientes \u00e9 Kuberos<\/a><\/noindex>, que permite descrever todos os clusters Kubernetes em uma configura\u00e7\u00e3o e alternar facilmente entre eles.<\/p>\n
<\/p>\n
Para configurar o Kuberos, \u00e9 suficiente descrever o template para o kubeconfig e execut\u00e1-lo com os seguintes par\u00e2metros:<\/p>\n
<\/p>\n
kuberos https:\/\/keycloak.example.org\/auth\/realms\/kubernetes kubernetes \/cfg\/secret \/cfg\/template<\/code><\/pre>\n
<\/p>\n
Para informa\u00e7\u00f5es mais detalhadas, consulte Usage<\/a><\/noindex> no GitHub.<\/p>\n
<\/p>\n
Tamb\u00e9m \u00e9 poss\u00edvel usar kubelogin<\/a><\/noindex> se voc\u00ea deseja realizar a autentica\u00e7\u00e3o diretamente no computador do usu\u00e1rio. Neste caso, o usu\u00e1rio ver\u00e1 um navegador com um formul\u00e1rio de autentica\u00e7\u00e3o no localhost.<\/p>\n
<\/p>\n
O kubeconfig obtido pode ser verificado no site jwt.io<\/a><\/noindex>. Basta copiar o valor users[].user.auth-provider.config.id-token<\/code> do seu kubeconfig para o formul\u00e1rio do site e imediatamente obter a decodifica\u00e7\u00e3o.<\/p>\n
<\/p>\n
Configura\u00e7\u00e3o do RBAC<\/h2>\n
<\/p>\n
Ao configurar o RBAC, voc\u00ea pode referir-se tanto ao nome do usu\u00e1rio (campo nome<\/code> no token jwt), quanto ao grupo de usu\u00e1rios (campo grupos<\/code> no token jwt). Aqui est\u00e1 um exemplo de configura\u00e7\u00e3o de direitos para o grupo kubernetes-default-namespace-admins<\/code>:<\/p>\n
\nkubernetes-default-namespace-admins.yaml<\/b><\/p>\n
apiVersion: rbac.authorization.k8s.io\/v1\nkind: Role\nmetadata:\n  name: default-admins\n  namespace: default\nrules:\n- apiGroups:\n  - '*'\n  resources:\n  - '*'\n  verbs:\n  - '*'\n---\napiVersion: rbac.authorization.k8s.io\/v1\nkind: RoleBinding\nmetadata:\n  name: kubernetes-default-namespace-admins\n  namespace: default\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: Role\n  name: default-admins\nsubjects:\n- apiGroup: rbac.authorization.k8s.io\n  kind: Group\n  name: kubernetes-default-namespace-admins<\/code><\/pre>\n
<\/p>\n
Mais exemplos de RBAC podem ser encontrados na documenta\u00e7\u00e3o oficial do Kubernetes<\/a><\/noindex><\/p>\n
<\/p>\n
Configura\u00e7\u00e3o do auth-proxy<\/h2>\n
<\/p>\n
H\u00e1 um projeto incr\u00edvel chamado keycloak-gatekeeper<\/a><\/noindex>, que permite proteger qualquer aplica\u00e7\u00e3o, fornecendo ao usu\u00e1rio a possibilidade de se autenticar em um servidor OIDC. Vou mostrar como configur\u00e1-lo usando o exemplo do Kubernetes Dashboard:<\/p>\n
\ndashboard-proxy.yaml<\/b><\/p>\n
apiVersion: extensions\/v1beta1\nkind: Deployment\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  replicas: 1\n  template:\n    metadata:\n      labels:\n        app: kubernetes-dashboard-proxy\n    spec:\n      containers:\n      - args:\n        - --listen=0.0.0.0:80\n        - --discovery-url=https:\/\/keycloak.example.org\/auth\/realms\/kubernetes\n        - --client-id=kubernetes\n        - --client-secret=\n        - --redirection-url=https:\/\/kubernetes-dashboard.example.org\n        - --enable-refresh-tokens=true\n        - --encryption-key=ooTh6Chei1eefooyovai5ohwienuquoh\n        - --upstream-url=https:\/\/kubernetes-dashboard.kube-system\n        - --resources=uri=\/*\n        image: keycloak\/keycloak-gatekeeper\n        name: kubernetes-dashboard-proxy\n        ports:\n        - containerPort: 80\n          livenessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n          readinessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  ports:\n  - port: 80\n    protocol: TCP\n    targetPort: 80\n  selector:\n    app: kubernetes-dashboard-proxy\n  type: ClusterIP<\/code><\/pre>\n
Fonte: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Keycloak \u043c\u043e\u0436\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u0442\u044c Kubernetes \u0441 \u0432\u0430\u0448\u0438\u043c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0438\u043c\u043f\u043e\u0440\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0433\u0440\u0443\u043f\u043f. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c RBAC \u0434\u043b\u044f \u0432\u0430\u0448\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c auth-proxy \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c Kubernetes Dashboard \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u043c\u0435\u044e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Keycloak \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u043c \u0447\u0442\u043e \u0443 \u0432\u0430\u0441 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c Active […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":70868,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-70867","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Integrando a autentica\u00e7\u00e3o LDAP ao Kubernetes | ProHoster","description":"Um pequeno guia sobre como.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0438\u043a\u0440\u0443\u0447\u0438\u0432\u0430\u0435\u043c LDAP-\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u043a Kubernetes | ProHoster","og:description":"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a.","og:url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-22T03:40:58+00:00","article:modified_time":"2020-03-03T13:14:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"70867","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:12:23","updated":"2022-09-28 01:58:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/70867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=70867"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/70867\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/70868"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=70867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=70867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=70867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}