🥇Tinosimbisa ActiveDirectory mvumo kuKubernetes uchishandisa Keycloak

Ichi chinyorwa chakanyorwa kuti chiwedzere pane zvatove aripo, asi inotaura nezve maficha echisumbu neMicrosoft ActiveDirectory, uye zvakare inozadzisa iyo.

Muchikamu chino ini ndichakuudza nzira yekuisa uye kugadzirisa:

keycloak iri open source project. Iyo inopa imwe poindi yekupinda yezvikumbiro. Inoshanda nemaprotocol akawanda, anosanganisira LDAP uye OpenID yatiri kufarira.
keycloak murindi wepagedhi - reverse proxy application iyo inokutendera kuti ubatanidze mvumo kuburikidza neKeycloak.
gangway -chishandiso chinogadzira gadziriso yekubectl iyo iwe yaunogona kupinda nayo uye ubatanidze kuKubernetes API kuburikidza neOpenID.

Mashandisiro anoita mvumo muKubernetes.

Tinogona kubata kodzero dzevashandisi / boka tichishandisa RBAC, boka rezvinyorwa zvakatogadzirwa nezve izvi, ini handisi kuzogara pane izvi zvakadzama. Dambudziko nderekuti unogona kushandisa RBAC kudzora kodzero dzevashandisi, asi Kubernetes hapana chaanoziva nezvevashandisi. Zvinoitika kuti isu tinoda mushandisi wekutumira nzira muKubernetes. Kuti tiite izvi, tichawedzera mupi weKuberntes OpenID, iyo ichataura kuti mushandisi akadaro aripo, uye Kubernetes pachake achamupa kodzero.

Kugadzirira kwe

Iwe unozoda Kubernetes cluster kana minikube
Active Directory
Domains:
keycloak.example.org
kubernetes-dashboard.example.org
gangway.example.org
Chitupa chemadomasi kana chitupa chekuzvisaina

Ini handisi kuzogara pamusoro pekugadzira chitupa chekuzvisaina, iwe unofanirwa kugadzira zvitupa zviviri, uyu ndiwo mudzi (Chiremera Chiremera) uye mutengi wemusango we * .example.org domain

Mushure mekugamuchira / kuburitsa zvitupa, mutengi anofanira kuwedzerwa kuKubernetes, nekuda kweizvi isu tinozvigadzirira chakavanzika:

kubectl create secret tls tls-keycloak --cert=example.org.crt --key=example.org.pem

Tevere, isu tichaishandisa kune yedu Ingress controller.

Keycloak Installation

Ndakasarudza kuti nzira iri nyore ndeye kushandisa yakagadzirira-yakagadzirwa mhinduro kune iyi, iyo helm machati.

Isa repository uye uvandudze iyo:

helm repo add codecentric https://codecentric.github.io/helm-charts
helm repo update

Gadzira keycloak.yml faira ine zvinotevera zvirimo:

keycloak.yml

keycloak:
  # Имя администратора
  username: "test_admin"
  # Пароль администратор  
  password: "admin"
  # Эти флаги нужны что бы позволить загружать в Keycloak скрипты прямо через web морду. Это нам 
  понадобиться что бы починить один баг, о котором ниже.
  extraArgs: "-Dkeycloak.profile.feature.script=enabled -Dkeycloak.profile.feature.upload_scripts=enabled" 
  # Включаем ingress, указываем имя хоста и сертификат который мы предварительно сохранили в secrets
  ingress:
    enabled: true 
    path: /
    annotations:
      kubernetes.io/ingress.class: nginx
      ingress.kubernetes.io/affinity: cookie
    hosts:
      - keycloak.example.org
    tls:
    - hosts:
        - keycloak.example.org
      secretName: tls-keycloak
  # Keycloak для своей работы требует базу данных, в тестовых целях я разворачиваю Postgresql прямо в Kuberntes, в продакшене так лучше не делать!
  persistence:
    deployPostgres: true
    dbVendor: postgres

postgresql:
  postgresUser: keycloak
  postgresPassword: ""
  postgresDatabase: keycloak
  persistence:
    enabled: true

Federation setup

Zvadaro, enda kune web interface keycloak.example.org

Dzvanya mukona yekuruboshwe Add realm

Key
ukoshi

zita
kubernetes

Ratidza zita
Kubernetes

Dzima ongororo ye email yemushandisi:
Client scopes -> Email -> Mappers -> Email yakasimbiswa (Delete)

Isu takamisa mubatanidzwa kupinza vashandisi kubva kuActiveDirectory, ini ndichasiya zviratidziro pazasi, ndinofunga zvichave zvakajeka.

Mubatanidzwa wevashandisi -> Wedzera mupi… -> ldap

Federation setup

Kana zvese zvakanaka, saka mushure mekudzvanya bhatani Batanidza vashandisi vese iwe uchaona meseji pamusoro pekubudirira kupinza kwevashandisi.

Tevere tinofanira kumepu mapoka edu

Mushandisi wemubatanidzwa --> ldap_localhost -> Mamepu -> Gadzira

Kugadzira mepu

Client setup

Izvo zvinodikanwa kugadzira mutengi, maererano neKeycloak, ichi chikumbiro chinozobvumidzwa kubva kwaari. Ini ndicharatidza zvakakosha mapoinzi mune iyo skrini mune tsvuku.

Vatengi -> Gadzira

Client setup

Ngatigadzire scoupe yemapoka:

Client Scopes -> Gadzira

Gadzira nzvimbo

Uye uvagadzirire mepu:

Client Scopes —> mapoka —> Mappers —> Gadzira

Mapper

Wedzera mamepu emapoka edu kune Default Client Scopes:

Vatengi -> kubernetes -> Client Scopes -> Default Client Scopes
Sarudza mapoka в Inowanikwa Client Scopes, Press Wedzera zvakasarudzwa

Isu tinotora chakavanzika (uye nyora kune iyo tambo) yatichashandisa kubvumidza muKeycloak:

Clients -> kubernetes -> Credentials -> Chakavanzika
Izvi zvinopedzisa kuseta, asi ndakakanganisa apo, mushure mekubudirira kwemvumo, ndakagamuchira kukanganisa 403. Bug report.

Gadzirisa:

Client Scopes —> mabasa —> Mappers —> Gadzira

Mappers

Script kodhi

// add current client-id to token audience
token.addAudience(token.getIssuedFor());

// return token issuer as dummy result assigned to iss again
token.getIssuer();

Kugadzirisa Kubernetes

Isu tinofanirwa kutsanangura kuti chitupa chedu chemidzi kubva kune saiti chiri papi, uye panowanikwa mupi weOIDC.
Kuti uite izvi, gadzirisa iyo faira /etc/kubernetes/manifests/kube-apiserver.yaml

kube-apiserver.yaml


...
spec:
  containers:
  - command:
    - kube-apiserver
...
    - --oidc-ca-file=/var/lib/minikube/certs/My_Root.crt
    - --oidc-client-id=kubernetes
    - --oidc-groups-claim=groups
    - --oidc-issuer-url=https://keycloak.example.org/auth/realms/kubernetes
    - --oidc-username-claim=email
...

Gadziridza kubeadm config musumbu:

kubeadmconfig

kubectl edit -n kube-system configmaps kubeadm-config


...
data:
  ClusterConfiguration: |
    apiServer:
      extraArgs:
        oidc-ca-file: /var/lib/minikube/certs/My_Root.crt
        oidc-client-id: kubernetes
        oidc-groups-claim: groups
        oidc-issuer-url: https://keycloak.example.org/auth/realms/kubernetes
        oidc-username-claim: email
...

Kuseta auth-proxy

Iwe unogona kushandisa keycloak muchengeti wegedhi kuchengetedza yako webhu application. Pamusoro pekuti iyi reverse proxy inobvumidza mushandisi asati aratidza peji, inozopfuudza ruzivo nezvewe kune yekupedzisira application mumusoro. Saka, kana application yako ikatsigira OpenID, ipapo mushandisi anobva apihwa mvumo. Funga nezvemuenzaniso weKubernetes Dashboard

Kuisa Kubernetes Dashboard


helm install stable/kubernetes-dashboard --name dashboard -f values_dashboard.yaml

values_dashboard.yaml

enableInsecureLogin: true
service:
  externalPort: 80
rbac:
  clusterAdminRole: true
  create: true
serviceAccount:
  create: true
  name: 'dashboard-test'

Kuseta kodzero dzekuwana:

Ngatigadzirei ClusterRoleBinding iyo inopa cluster admin kodzero (yakajairwa ClusterRole cluster-admin) yevashandisi muboka reDataOPS.


kubectl apply -f rbac.yaml

rbac.yaml


apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dataops_group
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: DataOPS

Isa keycloak gedhi:


helm repo add gabibbo97 https://gabibbo97.github.io/charts/
helm repo update
helm install gabibbo97/keycloak-gatekeeper --version 2.1.0 --name keycloak-gatekeeper -f values_proxy.yaml

values_proxy.yaml



# Включаем ingress
ingress:
  enabled: true
  annotations:
    kubernetes.io/ingress.class: nginx
  path: /
  hosts:
    - kubernetes-dashboard.example.org
  tls:
   - secretName: tls-keycloak
     hosts:
       - kubernetes-dashboard.example.org

# Говорим где мы будем авторизовываться у OIDC провайдера
discoveryURL: "https://keycloak.example.org/auth/realms/kubernetes"
# Имя клиента которого мы создали в Keycloak
ClientID: "kubernetes"
# Secret который я просил записать
ClientSecret: "c6ec03b8-d0b8-4cb6-97a0-03becba1d727"
# Куда перенаправить в случае успешной авторизации. Формат <SCHEMA>://<SERVICE_NAME>.><NAMESAPCE>.<CLUSTER_NAME>
upstreamURL: "http://dashboard-kubernetes-dashboard.default.svc.cluster.local"
# Пропускаем проверку сертификата, если у нас самоподписанный
skipOpenidProviderTlsVerify: true
# Настройка прав доступа, пускаем на все path если мы в группе DataOPS
rules:
  - "uri=/*|groups=DataOPS"

Mushure meizvozvo, paunoedza kuenda kubernetes-dashboard.example.org, isu tichaendeswa kuKeycloak uye kana ikabudirira mvumo tichasvika kuDashboard yatopinda.

gangway installation

Kuti zvive nyore, iwe unogona kuwedzera gangway iyo inogadzira iyo config faira ye kubectl, nerubatsiro rwatichapinda muKubernetes pasi pemushandisi wedu.


helm install --name gangway stable/gangway -f values_gangway.yaml

values_gangway.yaml


gangway:
  # Произвольное имя кластера
  clusterName: "my-k8s"
  # Где у нас OIDC провайдер
  authorizeURL: "https://keycloak.example.org/auth/realms/kubernetes/protocol/openid-connect/auth"
  tokenURL: "https://keycloak.example.org/auth/realms/kubernetes/protocol/openid-connect/token"
  audience: "https://keycloak.example.org/auth/realms/kubernetes/protocol/openid-connect/userinfo"
  # Теоритически сюда можно добавить groups которые мы замапили
  scopes: ["openid", "profile", "email", "offline_access"]
  redirectURL: "https://gangway.example.org/callback"
  # Имя клиента
  clientID: "kubernetes"
  # Секрет
  clientSecret: "c6ec03b8-d0b8-4cb6-97a0-03becba1d727"
  # Если оставить дефолтное значние, то за имя пользователя будет братья <b>Frist name</b> <b>Second name</b>, а при "sub" его логин
  usernameClaim: "sub"
  # Доменное имя или IP адресс API сервера
  apiServerURL: "https://192.168.99.111:8443"

# Включаем Ingress
ingress:
  enabled: true
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/proxy-buffer-size: "64k"
  path: /
  hosts:
  - gangway.example.org
  tls:
  - secretName: tls-keycloak
    hosts:
      - gangway.example.org

# Если используем самоподписанный сертификат, то его(открытый корневой сертификат) надо указать.
trustedCACert: |-
 -----BEGIN CERTIFICATE-----
 MIIDVzCCAj+gAwIBAgIBATANBgkqhkiG9w0BAQsFADA1MQswCQYDVQQGEwJVUzEQMA4GA1UEChMHRGF0YU9QUzEUMBIGA1UEAxMLbXkgcm9vdCBrZXkwHhcNMjAwMjE0MDkxODAwWhcNMzAwMjE0MDkxODAwWjA1MQswCQYDVQQGEwJVUzEQMA4GA1UEChMHRGF0YU9QUzEUMBIGA1UEAxMLbXkgcm9vdCBrZXkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDyP749PqqIRwNSqaK6qr0Zsi03G4PTCUlgaYTPZuMrwUVPK8xX2dWWs9MPRMOdXpgr8aSTZnVfmelIlVz4D7o2vK5rfmAe9GPcK0WbwKwXyhFU0flS9sU/g46ogHFrk03SZxQAeJhMLfEmAJm8LF5HghtGDs3t4uwGsB95o+lqPLiBvxRB8ZS3jSpYpvPgXAuZWKdZUQ3UUZf0X3hGLp7uIcIwJ7i4MduOGaQEO4cePeEJy9aDAO6qV78YmHbyh9kaW+1DL/Sgq8NmTgHGV6UOnAPKHTnMKXl6KkyUz8uLBGIdVhPxrlzG1EzXresJbJenSZ+FZqm3oLqZbw54Yp5hAgMBAAGjcjBwMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHISTOU/6BQqqnOZj+1xJfxpjiG0MAsGA1UdDwQEAwIBBjARBglghkgBhvhCAQEEBAMCAAcwHgYJYIZIAYb4QgENBBEWD3hjYSBjZXJ0aWZpY2F0ZTANBgkqhkiG9w0BAQsFAAOCAQEAj7HC8ObibwOLT4ZYmISJZwub9lcE0AZ5cWkPW39j/syhdbbqjK/6jy2D3WUEbR+s1Vson5Ov7JhN5In2yfZ/ByDvBnoj7CP8Q/ZMjTJgwN7j0rgmEb3CTZvnDPAz8Ijw3FP0cjxfoZ1Z0V2F44Ry7gtLJWr06+MztXVyto3aIz1/XbMQnXYlzc3c3B5yUQIy44Ce5aLRVsAjmXNqVRmDJ2QPNLicvrhnUJsO0zFWI+zZ2hc4Ge1RotCrjfOc9hQY63jZJ17myCZ6QCD7yzMzAob4vrgmkD4q7tpGrhPY/gDcE+lUNhC7DO3l0oPy2wsnT2TEn87eyWmDiTFG9zWDew==
 -----END CERTIFICATE-----

Zvinoita seizvi. Inokutendera iwe kurodha nekukurumidza config faira uye kuigadzira uchishandisa seti yemirairo:

Source: www.habr.com

Isu tinosimbisa ActiveDirectory mvumo kuKubernetes tichishandisa Keycloak