{"id":70867,"date":"2020-02-22T06:40:58","date_gmt":"2020-02-22T03:40:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes"},"modified":"2020-03-03T16:14:36","modified_gmt":"2020-03-03T13:14:36","slug":"prikruchivaem-ldap-avtorizacziyu-k-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","title":{"rendered":"Vi kopplar LDAP-autorisering till Kubernetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Vi<\/p>\n

<\/p>\n

En liten instruktion om hur man med hj\u00e4lp av Keycloak kan koppla Kubernetes till din LDAP-server och konfigurera import av anv\u00e4ndare och grupper. Detta g\u00f6r det m\u00f6jligt att st\u00e4lla in RBAC f\u00f6r dina anv\u00e4ndare och anv\u00e4nda auth-proxy f\u00f6r att skydda Kubernetes Dashboard och andra applikationer som inte kan autentisera sig sj\u00e4lva.<\/p>\n

<\/a><\/noindex><\/p>\n

Installation av Keycloak<\/h2>\n

<\/p>\n

Anta att du redan har en LDAP-server. Det kan vara Active Directory, FreeIPA, OpenLDAP eller n\u00e5got annat. Om du inte har en LDAP-server kan du i princip skapa anv\u00e4ndare direkt i Keycloaks gr\u00e4nssnitt eller anv\u00e4nda offentliga oidc-leverant\u00f6rer (Google, Github, Gitlab), resultatet blir n\u00e4stan detsamma.<\/p>\n

<\/p>\n

F\u00f6rst installerar vi sj\u00e4lva Keycloak, installationen kan g\u00f6ras separat eller direkt i Kubernetes-klustret. Om du har flera Kubernetes-kluster \u00e4r det oftast enklare att installera det separat. \u00c5 andra sidan kan du alltid anv\u00e4nda den officiella helm-diagrammet<\/a><\/noindex> och installera det direkt i ditt kluster.<\/p>\n

<\/p>\n

F\u00f6r att lagra data till Keycloak beh\u00f6ver du en databas. Som standard anv\u00e4nds h2<\/code> (alla data lagras lokalt), men du kan ocks\u00e5 anv\u00e4nda postgres<\/code>, mysql<\/code> eller mariadb<\/code>.
\nOm du \u00e4nd\u00e5 har best\u00e4mt dig f\u00f6r att installera Keycloak separat hittar du mer detaljerade instruktioner i den officiella dokumentationen<\/a><\/noindex>.<\/p>\n

<\/p>\n

Konfigurering av federation<\/h2>\n

<\/p>\n

F\u00f6rst skapar vi en ny realm. En realm \u00e4r rummet f\u00f6r v\u00e5r applikation. Varje applikation kan ha sin egen realm med olika anv\u00e4ndare och autentiseringens inst\u00e4llningar. Master realm anv\u00e4nds av Keycloak sj\u00e4lvt och det \u00e4r fel att anv\u00e4nda det till n\u00e5got annat.<\/p>\n

<\/p>\n

Klicka p\u00e5 L\u00e4gg till realm<\/strong><\/p>\n

<\/p>\n

Alternativ
\nV\u00e4rde<\/p>\n

Namn<\/strong>
\nkubernetes<\/code><\/p>\n

Visningsnamn<\/strong>
\nKubernetes<\/code><\/p>\n

HTML Visningsnamn<\/strong>
\n<img src="https:\/\/kubernetes.io\/images\/nav_logo.svg" width="400" ><\/code><\/p>\n

<\/p>\n

Kubernetes kontrollerar som standard om anv\u00e4ndarens e-post \u00e4r verifierad eller inte. Eftersom vi anv\u00e4nder v\u00e5r egen LDAP-server kommer denna kontroll n\u00e4stan alltid att returnera false<\/code>. L\u00e5t oss st\u00e4nga av visningen av denna parameter i Kubernetes:<\/p>\n

<\/p>\n

Klienter<\/strong> —> Email<\/strong> —> Mappers<\/strong> —> E-post verifierad<\/strong> (Ta bort)<\/p>\n

<\/p>\n

Nu st\u00e4ller vi in federation, g\u00e5 till:<\/p>\n

<\/p>\n

Anv\u00e4ndarfederation<\/strong> —> Add provider…<\/strong> —> ldap<\/strong><\/p>\n

<\/p>\n

H\u00e4r \u00e4r ett exempel p\u00e5 konfiguration f\u00f6r FreeIPA:<\/p>\n

<\/p>\n

Alternativ
\nV\u00e4rde<\/p>\n

Konsol Visningsnamn<\/strong>
\nfreeipa.example.org<\/code><\/p>\n

Leverant\u00f6r<\/strong>
\nRed Hat Directory Server<\/code><\/p>\n

UUID LDAP-attribut<\/strong>
\nipauniqueid<\/code><\/p>\n

Anslutnings-URL<\/strong>
\nldaps:\/\/freeipa.example.org<\/code><\/p>\n

Anv\u00e4ndares DN<\/strong>
\ncn=users,cn=accounts,dc=example,dc=org<\/code><\/p>\n

Bind DN<\/strong>
\nuid=keycloak-svc,cn=users,cn=accounts,dc=example,dc=org<\/code><\/p>\n

Bindningsuppgift<\/strong>
\n<password><\/code><\/p>\n

Till\u00e5t Kerberos-autentisering:<\/strong>
\non<\/code><\/p>\n

Kerberos Realm:<\/strong>
\nEXAMPLE.ORG<\/code><\/p>\n

Server Principal:<\/strong>
\nHTTP\/freeipa.example.org@EXAMPLE.ORG<\/code><\/p>\n

KeyTab:<\/strong>
\n\/etc\/krb5.keytab<\/code><\/p>\n

<\/p>\n

Anv\u00e4ndaren keycloak-svc<\/code> m\u00e5ste skapas i f\u00f6rv\u00e4g p\u00e5 v\u00e5r LDAP-server.<\/p>\n

<\/p>\n

I fallet med Active Directory r\u00e4cker det att bara v\u00e4lja Leverant\u00f6r: Active Directory<\/strong> och n\u00f6dv\u00e4ndiga inst\u00e4llningar fylls automatiskt i formul\u00e4ret.<\/p>\n

<\/p>\n

Klicka p\u00e5 Save<\/strong><\/p>\n

<\/p>\n

Nu g\u00e5r vi till:<\/p>\n

<\/p>\n

Anv\u00e4ndarfederation<\/strong> —> freeipa.example.org<\/strong> —> Mappers<\/strong> —> F\u00f6rnamn<\/strong><\/p>\n

<\/p>\n

Alternativ
\nV\u00e4rde<\/p>\n

Ldap-attribut<\/strong>
\ngivenName<\/code><\/p>\n

<\/p>\n

L\u00e5t oss nu aktivera gruppmappning:<\/p>\n

<\/p>\n

Anv\u00e4ndarfederation<\/strong> —> freeipa.example.org<\/strong> —> Mappers<\/strong> —> Skapa<\/strong><\/p>\n

<\/p>\n

Alternativ
\nV\u00e4rde<\/p>\n

Namn<\/strong>
\ngrupper<\/code><\/p>\n

Mapper typ<\/strong>
\ngroup-ldap-mapper<\/code><\/p>\n

LDAP-grupper DN<\/strong>
\ncn=groups,cn=accounts,dc=example,dc=org<\/code><\/p>\n

Anv\u00e4ndargruppers h\u00e4mtstrategi<\/strong>
\nGET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE<\/code><\/p>\n

<\/p>\n

Nu \u00e4r konfigurationen av federationen klar, l\u00e5t oss g\u00e5 vidare till klientkonfigurationen.<\/p>\n

<\/p>\n

Konfigurera klienten<\/h2>\n

<\/p>\n

Vi skapar en ny klient (applikation som kommer att h\u00e4mta anv\u00e4ndare fr\u00e5n Keycloak). G\u00e5 till:<\/p>\n

<\/p>\n

Klienter<\/strong> —> Skapa<\/strong><\/p>\n

<\/p>\n

Alternativ
\nV\u00e4rde<\/p>\n

Klient-ID<\/strong>
\nkubernetes<\/code><\/p>\n

\u00c5tkomsttyp<\/strong>
\nconfidenrial<\/code><\/p>\n

Rot-URL<\/strong>
\nhttp:\/\/kubernetes.example.org\/<\/code><\/p>\n

Giltiga omdirigerings-URIs<\/strong>
\nhttp:\/\/kubernetes.example.org\/*<\/code><\/p>\n

Admin-URL<\/strong>
\nhttp:\/\/kubernetes.example.org\/<\/code><\/p>\n

<\/p>\n

Vi skapar ocks\u00e5 ett scope f\u00f6r grupper:<\/p>\n

<\/p>\n

Klientomf\u00e5ng<\/strong> —> Skapa<\/strong><\/p>\n

<\/p>\n

Alternativ
\nV\u00e4rde<\/p>\n

Mall<\/strong>
\nIngen mall<\/code><\/p>\n

Namn<\/strong>
\ngrupper<\/code><\/p>\n

Full gruppv\u00e4g<\/strong>
\nfalse<\/code><\/p>\n

<\/p>\n

Och vi konfigurerar mappare f\u00f6r dem:<\/p>\n

<\/p>\n

Klientomf\u00e5ng<\/strong> —> grupper<\/strong> —> Mappers<\/strong> —> Skapa<\/strong><\/p>\n

<\/p>\n

Alternativ
\nV\u00e4rde<\/p>\n

Namn<\/strong>
\ngrupper<\/code><\/p>\n

Mapper-typ<\/strong>
\nGruppmedlemskap<\/code><\/p>\n

Token kravnamn<\/strong>
\ngrupper<\/code><\/p>\n

<\/p>\n

Nu beh\u00f6ver vi aktivera gruppmappningen i v\u00e5rt klientomf\u00e5ng:<\/p>\n

<\/p>\n

Klienter<\/strong> —> kubernetes<\/strong> —> Klientomf\u00e5ng<\/strong> —> Standard klientomf\u00e5ng<\/strong><\/p>\n

<\/p>\n

V\u00e4lj grupper<\/strong> p\u00e5 Tillg\u00e4ngliga klientomf\u00e5ng<\/strong>, tryck p\u00e5 L\u00e4gg till valda<\/strong><\/p>\n

<\/p>\n

Nu konfigurerar vi autentiseringen av v\u00e5r applikation, g\u00e5 vidare till:<\/p>\n

<\/p>\n

Klienter<\/strong> —> kubernetes<\/strong><\/p>\n

<\/p>\n

Alternativ
\nV\u00e4rde<\/p>\n

Beh\u00f6righet aktiverad<\/strong>
\nP\u00c5<\/code><\/p>\n

<\/p>\n

Klicka p\u00e5 spara<\/strong> och nu \u00e4r klientkonfigurationen avslutad, g\u00e5 till fliken<\/p>\n

<\/p>\n

Klienter<\/strong> —> kubernetes<\/strong> —> Referenser<\/strong><\/p>\n

<\/p>\n

d\u00e4r kan du f\u00e5 Hemmelighet<\/strong> som vi kommer att anv\u00e4nda fram\u00f6ver.<\/p>\n

<\/p>\n

Konfigurering av Kubernetes<\/h2>\n

<\/p>\n

Konfiguration av Kubernetes f\u00f6r OIDC-autentisering \u00e4r ganska trivial och inget komplicerat. Det du beh\u00f6ver g\u00f6ra \u00e4r att l\u00e4gga CA-certifikat f\u00f6r din OIDC-server i \/etc\/kubernetes\/pki\/oidc-ca.pem<\/code> och l\u00e4gga till n\u00f6dv\u00e4ndiga alternativ f\u00f6r kube-apiserver.
\nF\u00f6r detta, uppdatera \/etc\/kubernetes\/manifests\/kube-apiserver.yaml<\/code> p\u00e5 alla dina noder:<\/p>\n

<\/p>\n

...\nspec:\n  containers:\n  - command:\n    - kube-apiserver\n...\n    - --oidc-ca-file=\\\/etc\\\/kubernetes\\\/pki\\\/oidc-ca.pem\n    - --oidc-client-id=kubernetes\n    - --oidc-groups-claim=groups\n    - --oidc-issuer-url=https:\\\/\\\/keycloak.example.org\\\/auth\\\/realms\\\/kubernetes\n    - --oidc-username-claim=email\n...<\/code><\/pre>\n
<\/p>\n
Och uppdatera kubeadm-konfigurationen i klustret f\u00f6r att inte f\u00f6rlora dessa inst\u00e4llningar vid uppgradering:<\/p>\n
<\/p>\n
kubectl edit -n kube-system configmaps kubeadm-config<\/code><\/pre>\n
<\/p>\n
...\ndata:\n  ClusterConfiguration: |\n    apiServer:\n      extraArgs:\n        oidc-ca-file: \\\/etc\\\/kubernetes\\\/pki\\\/oidc-ca.pem\n        oidc-client-id: kubernetes\n        oidc-groups-claim: groups\n        oidc-issuer-url: https:\\\/\\\/keycloak.example.org\\\/auth\\\/realms\\\/kubernetes\n        oidc-username-claim: email\n...<\/code><\/pre>\n
<\/p>\n
Nu \u00e4r konfigurationen av Kubernetes klar. Du kan upprepa dessa \u00e5tg\u00e4rder i alla dina Kubernetes-kluster.<\/p>\n
<\/p>\n
Inledande autentisering<\/h2>\n
<\/p>\n
Efter dessa \u00e5tg\u00e4rder kommer du att ha ett Kubernetes-kluster med konfigurerad OIDC-autentisering. Det enda problemet \u00e4r att dina anv\u00e4ndare f\u00f6r tillf\u00e4llet inte har konfigurerade klienter eller sina egna kubeconfig. F\u00f6r att l\u00f6sa detta problem beh\u00f6ver du konfigurera automatisk utf\u00e4rdande av kubeconfig f\u00f6r anv\u00e4ndare efter lyckad autentisering.<\/p>\n
<\/p>\n
F\u00f6r detta kan du anv\u00e4nda speciella webbapplikationer som m\u00f6jligg\u00f6r autentisering av anv\u00e4ndaren och sedan ladda ner en f\u00e4rdig kubeconfig. En av de mest anv\u00e4ndarv\u00e4nliga \u00e4r Kuberos<\/a><\/noindex>, den l\u00e5ter dig beskriva alla Kubernetes-kluster i en konfiguration och enkelt v\u00e4xla mellan dem.<\/p>\n
<\/p>\n
F\u00f6r att konfigurera Kuberos beh\u00f6ver du bara beskriva mallen f\u00f6r kubeconfig och k\u00f6ra med f\u00f6ljande parametrar:<\/p>\n
<\/p>\n
kuberos https:\/\/keycloak.example.org\/auth\/realms\/kubernetes kubernetes \/cfg\/secret \/cfg\/template<\/code><\/pre>\n
<\/p>\n
F\u00f6r mer detaljerad information, se Anv\u00e4ndning<\/a><\/noindex> p\u00e5 Github.<\/p>\n
<\/p>\n
Det \u00e4r ocks\u00e5 m\u00f6jligt att anv\u00e4nda kubelogin<\/a><\/noindex> om du vill autentisera direkt p\u00e5 anv\u00e4ndarens dator. I s\u00e5 fall \u00f6ppnas en webbl\u00e4sare med en autentiseringsformul\u00e4r p\u00e5 localhost.<\/p>\n
<\/p>\n
Den erh\u00e5llna kubeconfig kan kontrolleras p\u00e5 webbplatsen jwt.io<\/a><\/noindex>. Kopiera bara v\u00e4rdet users[].user.auth-provider.config.id-token<\/code> fr\u00e5n din kubeconfig till formul\u00e4ret p\u00e5 webbplatsen och f\u00e5 direkt avkodning.<\/p>\n
<\/p>\n
RBAC-konfiguration<\/h2>\n
<\/p>\n
Vid konfiguration av RBAC kan du referera till b\u00e5de anv\u00e4ndarnamn (f\u00e4lt name<\/code> i jwt-token), s\u00e5v\u00e4l som anv\u00e4ndargrupp (f\u00e4lt grupper<\/code> i jwt-token). H\u00e4r \u00e4r ett exempel p\u00e5 \u00e5tkomstinst\u00e4llningar f\u00f6r gruppen kubernetes-default-namespace-admins<\/code>:<\/p>\n
\nkubernetes-default-namespace-admins.yaml<\/b><\/p>\n
apiVersion: rbac.authorization.k8s.io\/v1\nkind: Role\nmetadata:\n  name: default-admins\n  namespace: default\nrules:\n- apiGroups:\n  - '*'\n  resources:\n  - '*'\n  verbs:\n  - '*'\n---\napiVersion: rbac.authorization.k8s.io\/v1\nkind: RoleBinding\nmetadata:\n  name: kubernetes-default-namespace-admins\n  namespace: default\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: Role\n  name: default-admins\nsubjects:\n- apiGroup: rbac.authorization.k8s.io\n  kind: Group\n  name: kubernetes-default-namespace-admins<\/code><\/pre>\n
<\/p>\n
Fler exempel p\u00e5 RBAC kan hittas i den officiella Kubernetes-dokumentationen<\/a><\/noindex><\/p>\n
<\/p>\n
Inst\u00e4llningar f\u00f6r auth-proxy<\/h2>\n
<\/p>\n
Det finns ett fantastiskt projekt keycloak-gatekeeper<\/a><\/noindex>, som g\u00f6r det m\u00f6jligt att skydda vilken applikation som helst, genom att ge anv\u00e4ndaren m\u00f6jlighet att autentisera sig mot OIDC-servern. Jag kommer att visa hur man konfigurerar det med Kubernetes Dashboard som exempel:<\/p>\n
\ndashboard-proxy.yaml<\/b><\/p>\n
apiVersion: extensions\/v1beta1\nkind: Deployment\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  replicas: 1\n  template:\n    metadata:\n      labels:\n        app: kubernetes-dashboard-proxy\n    spec:\n      containers:\n      - args:\n        - --listen=0.0.0.0:80\n        - --discovery-url=https:\/\/keycloak.example.org\/auth\/realms\/kubernetes\n        - --client-id=kubernetes\n        - --client-secret=\n        - --redirection-url=https:\/\/kubernetes-dashboard.example.org\n        - --enable-refresh-tokens=true\n        - --encryption-key=ooTh6Chei1eefooyovai5ohwienuquoh\n        - --upstream-url=https:\/\/kubernetes-dashboard.kube-system\n        - --resources=uri=\/*\n        image: keycloak\/keycloak-gatekeeper\n        name: kubernetes-dashboard-proxy\n        ports:\n        - containerPort: 80\n          livenessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n          readinessProbe:\n            httpGet:\n              path: \/oauth\/health\n              port: 80\n            initialDelaySeconds: 3\n            timeoutSeconds: 2\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: kubernetes-dashboard-proxy\nspec:\n  ports:\n  - port: 80\n    protocol: TCP\n    targetPort: 80\n  selector:\n    app: kubernetes-dashboard-proxy\n  type: ClusterIP<\/code><\/pre>\n
K\u00e4lla: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Keycloak \u043c\u043e\u0436\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u0442\u044c Kubernetes \u0441 \u0432\u0430\u0448\u0438\u043c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0438\u043c\u043f\u043e\u0440\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0433\u0440\u0443\u043f\u043f. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c RBAC \u0434\u043b\u044f \u0432\u0430\u0448\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c auth-proxy \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c Kubernetes Dashboard \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u043c\u0435\u044e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Keycloak \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u043c \u0447\u0442\u043e \u0443 \u0432\u0430\u0441 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c LDAP-\u0441\u0435\u0440\u0432\u0435\u0440. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c Active […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":70868,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-70867","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Anslut LDAP-autentisering till Kubernetes | ProHoster","description":"En kort instruktion om hur.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0438\u043a\u0440\u0443\u0447\u0438\u0432\u0430\u0435\u043c LDAP-\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u043a Kubernetes | ProHoster","og:description":"\u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/prikruchivaem-ldap-avtorizacziyu-k-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-22T03:40:58+00:00","article:modified_time":"2020-03-03T13:14:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"70867","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:12:23","updated":"2022-09-28 01:58:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/70867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=70867"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/70867\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/70868"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=70867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=70867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=70867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}