ProHoster > Blog > Pulega > Fa'amaoni i Kubernetes fa'aaoga GitHub OAuth ma Dex
Fa'amaoni i Kubernetes fa'aaoga GitHub OAuth ma Dex
Ou te tuʻuina atu ia te oe se aʻoaʻoga mo le faʻatupuina o avanoa i se vaega Kubernetes e faʻaaoga ai Dex, dex-k8s-authenticator ma GitHub.
Fa'alotoifale meme mai le gagana Rusia Kubernetes talatalanoaga i totonu uālesi
Faatomuaga
Matou te fa'aogaina Kubernetes e fatu ai si'osi'omaga malosi mo le atina'e ma le 'au QA. O lea matou te mananaʻo e tuʻuina atu ia i latou le avanoa i le fuifui mo le dashboard ma kubectl. E le pei o OpenShift, vanilla Kubernetes e leai se faʻamaoniga faʻale-aganuʻu, o lea matou te faʻaogaina meafaigaluega lona tolu mo lenei mea.
I lenei faatulagaga matou te faʻaaogaina:
dex-k8s-faamaoni - 'upega tafaʻilagi mo le fausiaina o kubectl config
GitHub - ona o loʻo matou faʻaaogaina GitHub i la matou kamupani
Na matou taumafai e faʻaoga Google OIDC, ae paga lea na matou le manuia e amata i latou i vaega, o lea o le tuʻufaʻatasia ma GitHub e fetaui lelei ma i matou. A aunoa ma le fa'afanua vaega, o le a le mafai ona faia ni faiga fa'avae RBAC e fa'atatau i vaega.
O lea la, e fa'afefea ona galue a tatou faiga fa'atagaina Kubernetes i se fa'aaliga vaaia:
Faiga fa'atagaina
O nisi faʻamatalaga ma faʻamatalaga i lea itu:
O lo'o fa'aoga le tagata fa'aoga i le dex-k8s-authenticator (login.k8s.example.com)
dex-k8s-authenticator lafo atu le talosaga ia Dex (dex.k8s.example.com)
Dex toe fa'asaga i le GitHub login page
GitHub fa'atupuina fa'amatalaga fa'atagaina talafeagai ma toe fa'afo'i atu i Dex
Dex pasi fa'amatalaga maua ile dex-k8s-authenticator
E maua e le tagata fa'aoga se fa'ailoga OIDC mai GitHub
dex-k8s-authenticator faʻaopoopo le faʻailoga i le kubeconfig
Kubectl pasi le faailoga ile KubeAPIServer
KubeAPIServer toe fa'afo'i avanoa ile kubectl e fa'atatau ile fa'ailoga ua pasia
E maua e le tagata fa'aoga le avanoa mai le kubectl
Galuega sauniuni
Ioe, ua uma ona fa'apipi'i le fa'aputuga Kubernetes (k8s.example.com), ma e sau foʻi ma HELM na faʻapipiʻiina muamua. E iai foʻi la matou faʻalapotopotoga i le GitHub (super-org).
Afai e leai sau HELM, fa'apipi'i faigofie lava.
Muamua e tatau ona tatou seti GitHub.
Alu i le itulau fa'atulagaina o fa'alapotopotoga, (https://github.com/organizations/super-org/settings/applications) ma fai se talosaga fou (Authorized OAuth App):
Fausia se talosaga fou ile GitHub
Faatumu fanua i URL talafeagai, mo se faʻataʻitaʻiga:
Itulauaiga URL: https://dex.k8s.example.com
Fa'atagaga toe fo'i i tua URL: https://dex.k8s.example.com/callback
Faʻaeteete i soʻotaga, e taua le aua neʻi leiloa faʻamaʻi.
I le tali atu i se pepa faʻatumu, GitHub o le a gaosia Client ID и Client secret, teu i se nofoaga saogalemu, o le a aoga ia i tatou (mo se faataitaiga, tatou te faaaogaina Vault mo le teuina o mealilo):
Alu i le itulau saini (https://login.k8s.example.com) ma saini e faʻaaoga lau tala GitHub:
Itulau ulufale
Fa'asinomaga itulau ulufale ile GitHub
Mulimuli i fa'atonuga na faia e maua ai le avanoa
A maeʻa kopi-pasi mai le itulau uepi, e mafai ona matou faʻaogaina le kubectl e faʻatautaia a matou punaoa faʻapipiʻi:
kubectl get po
NAME READY STATUS RESTARTS AGE
mypod 1/1 Running 0 3d
kubectl delete po mypod
Error from server (Forbidden): pods "mypod" is forbidden: User "[email protected]" cannot delete pods in the namespace "default"
Ma e aoga, o tagata GitHub uma i la matou faʻalapotopotoga e mafai ona vaʻaia punaoa ma faʻaoga i totonu o pods, ae leai ni a latou aia e sui ai.