Mo ṣafihan ikẹkọ kan si akiyesi rẹ fun ṣiṣẹda iraye si iṣupọ Kubernetes nipa lilo Dex, dex-k8s-authenticator ati GitHub.
Meme agbegbe lati Kubernetes-ede Rọsia iwiregbe ni Telegram
Ifihan
A lo Kubernetes lati ṣẹda awọn agbegbe ti o ni agbara fun idagbasoke ati ẹgbẹ QA. Nitorinaa a fẹ lati fun wọn ni iraye si iṣupọ fun dasibodu mejeeji ati kubectl. Ko dabi OpenShift, vanilla Kubernetes ko ni ijẹrisi abinibi, nitorinaa a lo awọn irinṣẹ ẹnikẹta fun eyi.
Ninu iṣeto yii a lo:
dex-k8s-ododo - ohun elo wẹẹbu fun ti ipilẹṣẹ kubectl konfigi
A gbiyanju lati lo Google OIDC, sugbon laanu a kuna lati bẹrẹ wọn pẹlu awọn ẹgbẹ, nitorina isọdọkan pẹlu GitHub baamu wa daradara. Laisi aworan agbaye, kii yoo ṣee ṣe lati ṣẹda awọn ilana RBAC ti o da lori awọn ẹgbẹ.
Nitorinaa, bawo ni ilana aṣẹ Kubernetes wa ṣe n ṣiṣẹ ni aṣoju wiwo:
Ilana aṣẹ
Awọn alaye diẹ sii ati aaye nipasẹ aaye:
Olumulo wọle sinu dex-k8s-authenticator (login.k8s.example.com)
dex-k8s-authenticator dari ibeere naa si Dex (dex.k8s.example.com)
Dex àtúnjúwe si GitHub oju-iwe wiwọle
GitHub ṣe ipilẹṣẹ alaye aṣẹ pataki ati da pada si Dex
Dex kọja alaye ti o gba si dex-k8s-authenticator
Olumulo gba aami OIDC lati GitHub
dex-k8s-authenticator afikun àmi to kubeconfig
kubectl kọja ami si KubeAPIServer
KubeAPIServer pada awọn iraye si kubectl da lori ami ti o kọja
Olumulo n wọle lati kubectl
Awọn iṣe igbaradi
Nitoribẹẹ, a ti fi iṣupọ Kubernetes tẹlẹ sori ẹrọ (k8s.example.com), ati pe o tun wa pẹlu HELM ti a ti fi sii tẹlẹ. A tun ni agbari lori GitHub (super-org).
Ti o ko ba ni HELM, fi sii irorun.
Ni akọkọ a nilo lati ṣeto GitHub.
Lọ si oju-iwe eto eto, (https://github.com/organizations/super-org/settings/applications) ati ṣẹda ohun elo tuntun (Aṣẹ OAuth App):
Ṣiṣẹda ohun elo tuntun lori GitHub
Fọwọsi awọn aaye pẹlu awọn URL pataki, fun apẹẹrẹ:
URL oju-iwe akọkọ: https://dex.k8s.example.com
URL ipe pada fun aṣẹ: https://dex.k8s.example.com/callback
Ṣọra pẹlu awọn ọna asopọ, o ṣe pataki lati ma padanu awọn slashes.
Ni idahun si fọọmu ti o pari, GitHub yoo ṣe ipilẹṣẹ Client ID и Client secret, pa wọn mọ ni ibi aabo, wọn yoo wulo fun wa (fun apẹẹrẹ, a lo Ile ifinkan pamo fun titoju awọn asiri):
Lọ si oju-iwe iwọle (https://login.k8s.example.com) ati buwolu wọle nipa lilo akọọlẹ GitHub rẹ:
Oju-iwe wiwọle
Oju-iwe iwọle ti darí si GitHub
Tẹle awọn ilana ti ipilẹṣẹ lati jèrè wiwọle
Lẹhin ti daakọ-sọ lati oju-iwe wẹẹbu, a le lo kubectl lati ṣakoso awọn orisun iṣupọ wa:
kubectl get po
NAME READY STATUS RESTARTS AGE
mypod 1/1 Running 0 3d
kubectl delete po mypod
Error from server (Forbidden): pods "mypod" is forbidden: User "[email protected]" cannot delete pods in the namespace "default"
Ati pe o ṣiṣẹ, gbogbo awọn olumulo GitHub ninu agbari wa le rii awọn orisun ati wọle sinu awọn adarọ-ese, ṣugbọn wọn ko ni awọn ẹtọ lati yi wọn pada.