{"id":70867,"date":"2020-02-22T06:40:58","date_gmt":"2020-02-22T03:40:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes"},"modified":"2020-03-03T16:14:36","modified_gmt":"2020-03-03T13:14:36","slug":"prikruchivaem-ldap-avtorizacziyu-k-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","title":{"rendered":"Integr\u0103m autentificarea LDAP \u00een Kubernetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Integr\u0103m autentificarea LDAP \u00een Kubernetes\" src=\"\/wp-content\/uploads\/2020\/02\/2b0f0a4921e049a78a015e7693d697cf.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>O scurt\u0103 instruc\u021biune despre cum s\u0103 folosi\u021bi Keycloak pentru a conecta Kubernetes cu serverul dvs. LDAP \u0219i a configura importul utilizatorilor \u0219i grupurilor. Acest lucru va permite configurarea RBAC pentru utilizatorii dvs. \u0219i utilizarea auth-proxy pentru a proteja Kubernetes Dashboard \u0219i alte aplica\u021bii care nu pot efectua autorizarea singure.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2 id=\"ustanovka-keycloak\">Instalarea Keycloak<\/h2>\n<p><\/p>\n<p>Presupunem c\u0103 ave\u021bi deja un server LDAP. Acesta poate fi Active Directory, FreeIPA, OpenLDAP sau altceva. Dac\u0103 nu ave\u021bi un server LDAP, pute\u021bi crea utilizatori direct \u00een interfa\u021ba Keycloak sau utiliza furnizori publici oidc (Google, Github, Gitlab); rezultatul va fi aproape acela\u0219i.<\/p>\n<p><\/p>\n<p>\u00cen primul r\u00e2nd, s\u0103 instal\u0103m Keycloak. Instalarea poate fi efectuat\u0103 fie separat, fie direct \u00een clusterul Kubernetes; de obicei, dac\u0103 ave\u021bi mai multe clustere Kubernetes, ar fi mai simplu s\u0103-l instala\u021bi separat. Pe de alt\u0103 parte, pute\u021bi utiliza \u00eentotdeauna <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/charts\/tree\/master\/stable\/keycloak\">chartul oficial helm<\/a><\/noindex> \u0219i s\u0103-l instala\u021bi direct \u00een clusterul dvs.<\/p>\n<p><\/p>\n<p>Pentru stocarea datelor Keycloak, ve\u021bi avea nevoie de o baz\u0103 de date. Implicit, se folose\u0219te <code>h2<\/code> (toate datele sunt stocate local), dar este posibil s\u0103 folosi\u021bi de asemenea <code>postgres<\/code>, <code>mysql<\/code> sau <code>mariadb<\/code>.<br \/>\nDac\u0103 a\u021bi decis s\u0103 instala\u021bi Keycloak separat, ve\u021bi g\u0103si instruc\u021biuni mai detaliate \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/www.keycloak.org\/docs\/latest\/getting_started\/index.html\">documenta\u021bia oficial\u0103<\/a><\/noindex>.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-federacii\">Configurarea federa\u021biei<\/h2>\n<p><\/p>\n<p>\u00cen primul r\u00e2nd, s\u0103 cre\u0103m un nou realm. Realm-ul este spa\u021biul aplica\u021biei noastre. Fiecare aplica\u021bie poate avea propriul s\u0103u realm cu utilizatori \u0219i set\u0103ri de autorizare diferite. Realm-ul Master este utilizat de Keycloak \u0219i nu ar trebui folosit pentru altceva.<\/p>\n<p><\/p>\n<p>Facem clic pe <strong>Adaug\u0103 domeniu<\/strong><\/p>\n<p><\/p>\n<p>Op\u021biune<br \/>\nValue<\/p>\n<p><strong>Name<\/strong><br \/>\n<code>kubernetes<\/code><\/p>\n<p><strong>Numele afi\u0219at<\/strong><br \/>\n<code>Kubernetes<\/code><\/p>\n<p><strong>Numele de afi\u015fare HTML<\/strong><br \/>\n<code>&lt;img src=&quot;https:\/\/kubernetes.io\/images\/nav_logo.svg&quot; width=&quot;400&quot; &gt;<\/code><\/p>\n<p><\/p>\n<p>Kubernetes verific\u0103 din default dac\u0103 email-ul utilizatorului a fost confirmat sau nu. Deoarece folosim un server LDAP propriu, aceast\u0103 verificare va returna aproape \u00eentotdeauna <code>false<\/code>. S\u0103 dezactiv\u0103m acest parametru \u00een Kubernetes:<\/p>\n<p><\/p>\n<p><strong>Sfer\u0103 de clien\u021bi<\/strong> \u2192 <strong>Email<\/strong> \u2192 <strong>Mapperi<\/strong> \u2192 <strong>Email verificat<\/strong> (\u0218terge)<\/p>\n<p><\/p>\n<p>Acum s\u0103 configur\u0103m federa\u021bia, pentru aceasta mergem la:<\/p>\n<p><\/p>\n<p><strong>Federa\u021bia utilizatorului<\/strong> \u2192 <strong>Ad\u0103uga\u021bi furnizorul\u2026<\/strong> \u2192 <strong>ldap<\/strong><\/p>\n<p><\/p>\n<p>Voi da un exemplu de configurare pentru FreeIPA:<\/p>\n<p><\/p>\n<p>Op\u021biune<br \/>\nValue<\/p>\n<p><strong>Numele de afi\u015fare Console<\/strong><br \/>\n<code>freeipa.example.org<\/code><\/p>\n<p><strong>Furnizor<\/strong><br \/>\n<code>Red Hat Directory Server<\/code><\/p>\n<p><strong>Atribut LDAP UUID<\/strong><br \/>\n<code>ipauniqueid<\/code><\/p>\n<p><strong>URL de conexiune<\/strong><br \/>\n<code>ldaps:\/\/freeipa.example.org<\/code><\/p>\n<p><strong>DN Utilizatori<\/strong><br \/>\n<code>cn=users,cn=accounts,dc=example,dc=org<\/code><\/p>\n<p><strong>Bind DN<\/strong><br \/>\n<code>uid=keycloak-svc,cn=users,cn=accounts,dc=example,dc=org<\/code><\/p>\n<p><strong>Credential de conectare<\/strong><br \/>\n<code>&lt;password&gt;<\/code><\/p>\n<p><strong>Permite autentificarea Kerberos:<\/strong><br \/>\n<code>on<\/code><\/p>\n<p><strong>Realm Kerberos:<\/strong><br \/>\n<code>EXAMPLE.ORG<\/code><\/p>\n<p><strong>Server Principal:<\/strong><br \/>\n<code>HTTP\/freeipa.example.org@EXAMPLE.ORG<\/code><\/p>\n<p><strong>KeyTab:<\/strong><br \/>\n<code>\/etc\/krb5.keytab<\/code><\/p>\n<p><\/p>\n<p>Utilizatorul <code>keycloak-svc<\/code> trebuie creat anterior pe serverul nostru LDAP.<\/p>\n<p><\/p>\n<p>\u00cen cazul Active Directory, este suficient s\u0103 alegi <strong>Furnizor: Active Directory<\/strong> iar set\u0103rile necesare se vor completa automat \u00een formular.<\/p>\n<p><\/p>\n<p>Facem clic pe <strong>Salveaz\u0103<\/strong><\/p>\n<p><\/p>\n<p>Acum mergem la:<\/p>\n<p><\/p>\n<p><strong>Federa\u021bia utilizatorului<\/strong> \u2192 <strong>freeipa.example.org<\/strong> \u2192 <strong>Mapperi<\/strong> \u2192 <strong>First Name<\/strong><\/p>\n<p><\/p>\n<p>Op\u021biune<br \/>\nValue<\/p>\n<p><strong>Atribut LDAP<\/strong><br \/>\n<code>givenName<\/code><\/p>\n<p><\/p>\n<p>Acum vom activa maparea grupurilor:<\/p>\n<p><\/p>\n<p><strong>Federa\u021bia utilizatorului<\/strong> \u2192 <strong>freeipa.example.org<\/strong> \u2192 <strong>Mapperi<\/strong> \u2192 <strong>Creeaz\u0103<\/strong><\/p>\n<p><\/p>\n<p>Op\u021biune<br \/>\nValue<\/p>\n<p><strong>Name<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><strong>Tipul mapper-ului<\/strong><br \/>\n<code>group-ldap-mapper<\/code><\/p>\n<p><strong>DN-uri de grup LDAP<\/strong><br \/>\n<code>cn=groups,cn=accounts,dc=example,dc=org<\/code><\/p>\n<p><strong>Strategia de recuperare a grupurilor utilizatorilor<\/strong><br \/>\n<code>GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE<\/code><\/p>\n<p><\/p>\n<p>Asta finalizeaz\u0103 configurarea federa\u021biei, acum vom trece la configurarea clientului.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-klienta\">Configurarea clientului<\/h2>\n<p><\/p>\n<p>Vom crea un nou client (aplica\u021bia care va ob\u021bine utilizatorii din Keycloak). Trecem la:<\/p>\n<p><\/p>\n<p><strong>Clien\u021bi<\/strong> \u2192 <strong>Creeaz\u0103<\/strong><\/p>\n<p><\/p>\n<p>Op\u021biune<br \/>\nValue<\/p>\n<p><strong>ID-ul Clientului<\/strong><br \/>\n<code>kubernetes<\/code><\/p>\n<p><strong>Tip de acces<\/strong><br \/>\n<code>confiden\u021bial<\/code><\/p>\n<p><strong>URL r\u0103d\u0103cin\u0103<\/strong><br \/>\n<code>http:\/\/kubernetes.example.org\/<\/code><\/p>\n<p><strong>URI-uri de redirec\u021bionare valide<\/strong><br \/>\n<code>http:\/\/kubernetes.example.org\/*<\/code><\/p>\n<p><strong>URL de administrare<\/strong><br \/>\n<code>http:\/\/kubernetes.example.org\/<\/code><\/p>\n<p><\/p>\n<p>De asemenea, vom crea un scope pentru grupuri:<\/p>\n<p><\/p>\n<p><strong>Scope-uri Client<\/strong> \u2192 <strong>Creeaz\u0103<\/strong><\/p>\n<p><\/p>\n<p>Op\u021biune<br \/>\nValue<\/p>\n<p><strong>\u0218ablon<\/strong><br \/>\n<code>F\u0103r\u0103 \u0219ablon<\/code><\/p>\n<p><strong>Name<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><strong>Calea complet\u0103 a grupului<\/strong><br \/>\n<code>false<\/code><\/p>\n<p><\/p>\n<p>\u0218i s\u0103 configur\u0103m mapperul pentru ele:<\/p>\n<p><\/p>\n<p><strong>Scope-uri Client<\/strong> \u2192 <strong>groups<\/strong> \u2192 <strong>Mapperi<\/strong> \u2192 <strong>Creeaz\u0103<\/strong><\/p>\n<p><\/p>\n<p>Op\u021biune<br \/>\nValue<\/p>\n<p><strong>Name<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><strong>Tipul Mapper-ului<\/strong><br \/>\n<code>Apartenen\u021ba la grup<\/code><\/p>\n<p><strong>Numele revendic\u0103rii token-ului<\/strong><br \/>\n<code>groups<\/code><\/p>\n<p><\/p>\n<p>Acum trebuie s\u0103 activ\u0103m maparea grupurilor \u00een scope-ul nostru de client:<\/p>\n<p><\/p>\n<p><strong>Clien\u021bi<\/strong> \u2192 <strong>kubernetes<\/strong> \u2192 <strong>Scope-uri Client<\/strong> \u2192 <strong>Scope-uri implicite de client<\/strong><\/p>\n<p><\/p>\n<p>Alegem <strong>groups<\/strong> \u00een <strong>Available Client Scopes<\/strong>, d\u0103m clic pe <strong>Adaug\u0103 selec\u021bionate<\/strong><\/p>\n<p><\/p>\n<p>Acum s\u0103 configur\u0103m autentificarea aplica\u021biei noastre, trecem la:<\/p>\n<p><\/p>\n<p><strong>Clien\u021bi<\/strong> \u2192 <strong>kubernetes<\/strong><\/p>\n<p><\/p>\n<p>Op\u021biune<br \/>\nValue<\/p>\n<p><strong>Autorizare activat\u0103<\/strong><br \/>\n<code>DA<\/code><\/p>\n<p><\/p>\n<p>Vom ap\u0103sa <strong>salveaz\u0103<\/strong> \u0219i astfel se finalizeaz\u0103 configurarea clientului, acum pe tab-ul<\/p>\n<p><\/p>\n<p><strong>Clien\u021bi<\/strong> \u2192 <strong>kubernetes<\/strong> \u2192 <strong>Creden\u021biale<\/strong><\/p>\n<p><\/p>\n<p>ve\u021bi putea ob\u021bine <strong>Secret<\/strong> pe care \u00eel vom folosi mai departe.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-kubernetes\">Kubernetes Setup<\/h2>\n<p><\/p>\n<p>Configurarea Kubernetes pentru autorizarea OIDC este destul de trivial\u0103 \u0219i nu este ceva foarte complicat. Tot ce trebuie s\u0103 face\u021bi este s\u0103 plasa\u021bi certificatul CA al serverului OIDC \u00een <code>\/etc\/kubernetes\/pki\/oidc-ca.pem<\/code> \u0219i s\u0103 ad\u0103uga\u021bi op\u021biunile necesare pentru kube-apiserver.<br \/>\nPentru asta, actualiza\u021bi <code>\/etc\/kubernetes\/manifests\/kube-apiserver.yaml<\/code> pe toate masterele dvs.:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">...\nspec:\n  containers:\n  - command:\n    - kube-apiserver\n...\n    - --oidc-ca-file=\\\/etc\\\/kubernetes\\\/pki\\\/oidc-ca.pem\n    - --oidc-client-id=kubernetes\n    - --oidc-groups-claim=groups\n    - --oidc-issuer-url=https:\\\/\\\/keycloak.example.org\\\/auth\\\/realms\\\/kubernetes\n    - --oidc-username-claim=email\n...<\/code><\/pre>\n<p><\/p>\n<p>\u0218i, de asemenea, actualiza\u021bi configura\u021bia kubeadm \u00een cluster, pentru a nu pierde aceste set\u0103ri la actualizare:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">kubectl edit -n kube-system configmaps kubeadm-config<\/code><\/pre>\n<p><\/p>\n<pre><code class=\"plaintext\">...\ndata:\n  ClusterConfiguration: |\n    apiServer:\n      extraArgs:\n        oidc-ca-file: \\\/etc\\\/kubernetes\\\/pki\\\/oidc-ca.pem\n        oidc-client-id: kubernetes\n        oidc-groups-claim: groups\n        oidc-issuer-url: https:\\\/\\\/keycloak.example.org\\\/auth\\\/realms\\\/kubernetes\n        oidc-username-claim: email\n...<\/code><\/pre>\n<p><\/p>\n<p>Asta finalizeaz\u0103 configurarea Kubernetes. Pute\u021bi repeta aceste ac\u021biuni \u00een toate cluster-ele dvs. Kubernetes.<\/p>\n<p><\/p>\n<h2 id=\"nachalnaya-avtorizaciya\">Autorizare ini\u021bial\u0103<\/h2>\n<p><\/p>\n<p>Dup\u0103 aceste ac\u021biuni, ve\u021bi avea deja un cluster Kubernetes cu autorizarea OIDC configurat\u0103. Singurul aspect este c\u0103 utilizatorii dvs. nu au un client configurat sau propriul kubeconfig. Pentru a rezolva aceast\u0103 problem\u0103, trebuie s\u0103 configura\u021bi emiterea automat\u0103 a kubeconfig-ului utilizatorilor dup\u0103 autorizarea cu succes.<\/p>\n<p><\/p>\n<p>Pentru aceasta, pute\u021bi folosi aplica\u021bii web speciale, care permit autentificarea utilizatorului \u0219i apoi desc\u0103rcarea kubeconfig-ului finalizat. Una dintre cele mai convenabile este <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/negz\/kuberos\">Kuberos<\/a><\/noindex>, care permite descrierea tuturor cluster-elor Kubernetes \u00eentr-o singur\u0103 configura\u021bie \u0219i comutarea u\u0219oar\u0103 \u00eentre ele.<\/p>\n<p><\/p>\n<p>Pentru a configura Kuberos, este suficient s\u0103 descrie\u021bi un \u0219ablon pentru kubeconfig \u0219i s\u0103 rula\u021bi cu urm\u0103toarele parametri:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">kuberos https:\/\/keycloak.example.org\/auth\/realms\/kubernetes kubernetes \/cfg\/secret \/cfg\/template<\/code><\/pre>\n<p><\/p>\n<p>Pentru informa\u021bii mai detaliate, consulta\u021bi <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/negz\/kuberos#usage\">Utilizare<\/a><\/noindex> pe Github.<\/p>\n<p><\/p>\n<p>De asemenea, este posibil s\u0103 utiliza\u021bi <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/int128\/kubelogin\">kubelogin<\/a><\/noindex> dac\u0103 dori\u021bi s\u0103 efectua\u021bi autentificarea direct pe computerul utilizatorului. \u00cen acest caz, utilizatorului i se va deschide un browser cu un formular de autentificare pe localhost.<\/p>\n<p><\/p>\n<p>Kubeconfig-ul ob\u021binut poate fi verificat pe site-ul <noindex><a rel=\"nofollow\" href=\"https:\/\/jwt.io\/#debugger-io\">jwt.io<\/a><\/noindex>. Pur \u0219i simplu copia\u021bi valoarea <code>users[].user.auth-provider.config.id-token<\/code> din kubeconfig-ul dumneavoastr\u0103 \u00een formularul de pe site \u0219i ve\u021bi ob\u021bine imediat decriptarea.<\/p>\n<p><\/p>\n<h2 id=\"nastroyka-rbac\">Configurarea RBAC<\/h2>\n<p><\/p>\n<p>La configurarea RBAC, se poate face referire at\u00e2t la numele utilizatorului (c\u00e2mpul <code>name<\/code> din jwt-token), c\u00e2t \u0219i la grupul de utilizatori (c\u00e2mpul <code>groups<\/code> din jwt-token). Iat\u0103 un exemplu de configurare a drepturilor pentru grupul <code>kubernetes-default-namespace-admins<\/code>:<\/p>\n<p>\n<b class=\"spoiler_title\">kubernetes-default-namespace-admins.yaml<\/b><\/p>\n<pre><code class=\"plaintext\">apiVersion: rbac.authorization.k8s.io\/v1\nkind: Role\nmetadata:\n  name: default-admins\n  namespace: default\nrules:\n- apiGroups:\n  - '*'\n  resources:\n  - '*'\n  verbs:\n  - '*'\n---\napiVersion: rbac.authorization.k8s.io\/v1\nkind: RoleBinding\nmetadata:\n  name: kubernetes-default-namespace-admins\n  namespace: default\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: Role\n  name: default-admins\nsubjects:\n- apiGroup: rbac.authorization.k8s.io\n  kind: Group\n  name: kubernetes-default-namespace-admins<\/code><\/pre>\n<p><\/p>\n<p>Mai multe exemple pentru RBAC pot fi g\u0103site \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/rbac\/\">documenta\u021biei oficiale Kubernetes<\/a><\/noindex><\/p>\n<p><\/p>\n<h2 id=\"nastroyka-auth-proxy\">Configurarea auth-proxy<\/h2>\n<p><\/p>\n<p>Exist\u0103 un proiect excelent <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/keycloak\/keycloak-gatekeeper\">keycloak-gatekeeper<\/a><\/noindex>, care permite s\u0103 proteja\u021bi orice aplica\u021bie, oferindu-le utilizatorilor posibilitatea s\u0103 se autentifice pe serverul OIDC. Voi ar\u0103ta cum se poate configura pe exemplul Kubernetes Dashboard:<\/p>\n<p>\n<b class=\"spoiler_title\">dashboard-proxy.yaml<\/b><\/p>\n<pre><code class=\"plaintext\">apiVersion: extensions\/v1beta1\nkind: Deployment\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  replicas: 1\n  template:\n    metadata:\n      labels:\n        app: kubernetes-dashboard-proxy\n    spec:\n      containers:\n      - args:\n        - --listen=0.0.0.0:80\n        - --discovery-url=https:\/\/keycloak.example.org\/auth\/realms\/kubernetes\n        - --client-id=kubernetes\n        - --client-secret=\n        - --redirection-url=https:\/\/kubernetes-dashboard.example.org\n        - --enable-refresh-tokens=true\n        - --encryption-key=ooTh6Chei1eefooyovai5ohwienuquoh\n        - --upstream-url=https:\/\/kubernetes-dashboard.kube-system\n        - --resources=uri=*\/\n        image: keycloak\/keycloak-gatekeeper\n        name: kubernetes-dashboard-proxy\n        ports:\n        - containerPort: 80\n          livenessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n          readinessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  ports:\n  - port: 80\n    protocol: TCP\n    targetPort: 80\n  selector:\n    app: kubernetes-dashboard-proxy\n  type: ClusterIP<\/code><\/pre>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/441112\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Keycloak \u043c\u043e\u0436\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u0442\u044c Kubernetes \u0441 \u0432\u0430\u0448\u0438\u043c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0438\u043c\u043f\u043e\u0440\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0433\u0440\u0443\u043f\u043f. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c RBAC \u0434\u043b\u044f \u0432\u0430\u0448\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c auth-proxy \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c Kubernetes Dashboard \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u043c\u0435\u044e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Keycloak \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u043c \u0447\u0442\u043e \u0443 \u0432\u0430\u0441 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c Active [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":70868,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-70867","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0440\u0438\u043a\u0440\u0443\u0447\u0438\u0432\u0430\u0435\u043c LDAP-\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u043a Kubernetes | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-22T03:40:58+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cembin\u0103m autentificarea LDAP cu Kubernetes | ProHoster","description":"Un mic ghid despre cum.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0438\u043a\u0440\u0443\u0447\u0438\u0432\u0430\u0435\u043c LDAP-\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u043a Kubernetes | ProHoster","og:description":"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-22T03:40:58+00:00","article:modified_time":"2020-03-03T13:14:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"70867","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:12:23","updated":"2022-09-28 01:58:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/70867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=70867"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/70867\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/70868"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=70867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=70867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=70867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}