External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-02-25 15:06:06 -03:30
Code Issues Packages Projects Releases Wiki Activity

Granular authentication Control

Browse Source 
It is now possible to deactivate selected authentication methods
(basic auth, token auth) inside the cluster by adding
removing the required arguments to the Kube API Server and generating
the secrets accordingly.

The x509 authentification is currently not optional because disabling it
would affect the kubectl clients deployed on the master nodes.
This commit is contained in:
Vincent Schwarzer
2017-02-27 14:15:50 +01:00
parent 3feab1cb2d
commit 026da060f2
5 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
inventory/group_vars/k8s-cluster.yml
View File

@@ -58,9 +58,16 @@ kube_users:
role: admin
## It is possible to activate / deactivate selected authentication methods (basic auth, static token auth)
#kube_oidc_auth: false
#kube_basic_auth: false
#kube_token_auth: false
## Variables for OpenID Connect Configuration https://kubernetes.io/docs/admin/authentication/
## To use OpenID you have to deploy additional an OpenID Provider (e.g Dex, Keycloak, ...)
# kube_oidc_auth: false
# kube_oidc_url: https:// ...
# kube_oidc_client_id: kubernetes
## Optional settings for OIDC
@@ -69,7 +76,6 @@ kube_users:
# kube_oidc_groups_claim: groups
# Choose network plugin (calico, weave or flannel)
# Can also be set to 'cloud', which lets the cloud provider setup appropriate routing
kube_network_plugin: calico