Skip to content

Commit 3792a3b

Browse files
NimRegevNimRegev
committed
Update with new content from classic
Ported new content added in Classic
1 parent ec0436a commit 3792a3b

File tree

2 files changed

+131
-18
lines changed

2 files changed

+131
-18
lines changed

‎_docs/administration/user-self-management/user-settings.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ caption="Generating a key for the API"
9999
max-width="80%"
100100
%}
101101

102+
> The UI shows the first few characters in the second part of the key, after the `.`, and not the characters at the beginning of the key.
102103
103104
## Related articles
104105

‎_docs/integrations/kubernetes.md‎

Lines changed: 130 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -111,8 +111,8 @@ An alternative method of adding an Azure cluster is by using a service principal
111111

112112
{% include image.html
113113
lightbox="true"
114-
file="/images/kubernetes/integrations/add-cluster/connect-azure-spn.png"
115-
url="/images/kubernetes/integrations/add-cluster/connect-azure-spn.png"
114+
file="/images/integrations/kubernetes/add-cluster/connect-azure-spn.png"
115+
url="/images/integrations/kubernetes/add-cluster/connect-azure-spn.png"
116116
alt="Azure Service principal details"
117117
caption="Azure Service principal details"
118118
max-width="60%"
@@ -143,8 +143,8 @@ To add a DO cluster select *DigitalOcean* from the *Add provider* menu in your [
143143

144144
{% include image.html
145145
lightbox="true"
146-
file="/images/kubernetes/integrations/add-cluster/authorize-do.png"
147-
url="/images/kubernetes/integrations/add-cluster/authorize-do.png"
146+
file="/images/integrations/kubernetes/add-cluster/authorize-do.png"
147+
url="/images/integrations/kubernetes/add-cluster/authorize-do.png"
148148
alt="Authorizing DigitalOcean Integration"
149149
caption="Authorizing DigitalOcean Integration"
150150
max-width="35%"
@@ -154,8 +154,8 @@ Click on the checkbox next to your account name and select the *Authorize applic
154154

155155
{% include image.html
156156
lightbox="true"
157-
file="/images/kubernetes/integrations/add-cluster/do-authorized.png"
158-
url="/images/kubernetes/integrations/add-cluster/do-authorized.png"
157+
file="/images/integrations/kubernetes/add-cluster/do-authorized.png"
158+
url="/images/integrations/kubernetes/add-cluster/do-authorized.png"
159159
alt="DigitalOcean is now authorized"
160160
caption="DigitalOcean is now authorized"
161161
max-width="70%"
@@ -165,8 +165,8 @@ Next, expand the DigitalOcean row from the triangle icon on the right and click
165165

166166
{% include image.html
167167
lightbox="true"
168-
file="/images/kubernetes/add-cluster/add-do-cluster.png"
169-
url="/images/kubernetes/add-cluster/add-do-cluster.png"
168+
file="/images/integrations/kubernetes/add-cluster/add-do-cluster.png"
169+
url="/images/integrations/kubernetes/add-cluster/add-do-cluster.png"
170170
alt="Selecing the DigitalOcean cluster"
171171
caption="Selecing the DigitalOcean cluster"
172172
max-width="40%"
@@ -277,9 +277,9 @@ echo $(kubectl get secret -o go-template='{{index .data "token" }}' $(kubectl ge
277277

278278
Once the cluster been added successfully you can go to the `Kubernetes` tab to start working with the services of your cluster.
279279

280-
#### The proper/secure way
280+
#### Kubernetes <=1.23: The proper/secure way
281281

282-
For production environments you should create a service account and/or role for Codefresh access.
282+
For production environments, create a service account and/or role for Codefresh access.
283283
The minimum permissions Codefresh needs to work with the cluster are the following:
284284

285285
`codefresh-role.yml`
@@ -296,7 +296,7 @@ rules:
296296
{% endraw %}
297297
{% endhighlight %}
298298

299-
Note that these permissions will only allow Codefresh to read the cluster resources and populate the respective dashboards. You need to give more privileges for actual deployments. For more information see the [Kubernetes RBAC documentation page](https://kubernetes.io/docs/reference/access-authn-authz/rbac/){:target="\_blank"}.
299+
>These permissions only allow Codefresh to read the cluster resources and populate the respective dashboards. For actual deployments, you need to give more privileges. For more information see the [Kubernetes RBAC documentation page](https://kubernetes.io/docs/reference/access-authn-authz/rbac/){:target="\_blank"}.
300300
301301
Here is an example with role + service account + binding.
302302

@@ -333,26 +333,27 @@ subjects:
333333
{% endraw %}
334334
{% endhighlight %}
335335

336-
Select the appropriate cluster if you have more than one:
336+
<br />
337337

338+
**How to**
339+
340+
1. Select the appropriate cluster if you have more than one:
338341
`Choose cluster`
339342
{% highlight shell %}
340343
{% raw %}
341344
kubectl config use-context <my-cluster-name>
342345
{% endraw %}
343346
{% endhighlight %}
344-
345-
Create the Codefresh user/role:
346-
347+
{:start="2"}
348+
1. Create the Codefresh user/role:
347349
`Apply Codefresh access rules`
348350
{% highlight shell %}
349351
{% raw %}
350352
kubectl apply -f codefresh-role-sa-bind.yml
351353
{% endraw %}
352354
{% endhighlight %}
353-
354-
Finally run the following commands and copy-paste the result to each Codefresh field in the UI:
355-
355+
{:start="3"}
356+
1. Finally run the following commands and copy-paste the result to each Codefresh field in the UI:
356357
`Host IP`
357358
{% highlight shell %}
358359
{% raw %}
@@ -374,6 +375,117 @@ echo $(kubectl get secret -n kube-system -o go-template='{{index .data "token" }
374375
{% endraw %}
375376
{% endhighlight %}
376377

378+
<br />
379+
380+
#### Kubernetes >=1.24: The proper/secure way
381+
382+
For production environments, create a service account and/or role for Codefresh access.
383+
384+
Codefresh needs these minimum permissions to work with the cluster:
385+
386+
`codefresh-role.yml`
387+
{% highlight yaml %}
388+
{% raw %}
389+
kind: ClusterRole
390+
apiVersion: rbac.authorization.k8s.io/v1
391+
metadata:
392+
name: codefresh-role
393+
rules:
394+
- apiGroups: [“”]
395+
resources: [“*”]
396+
verbs: [“list”, “watch”, “get”]
397+
{% endraw %}
398+
{% endhighlight %}
399+
400+
>These permissions only allow Codefresh to read the cluster resources and populate the respective dashboards. For actual deployments, you need to give more privileges. For more information see the [Kubernetes RBAC documentation page](https://kubernetes.io/docs/reference/access-authn-authz/rbac/){:target="\_blank"}.
401+
402+
Here is an example with role + service account + binding.
403+
404+
`codefresh-role-sa-bind.yml`
405+
{% highlight yaml %}
406+
{% raw %}
407+
kind: ClusterRole
408+
apiVersion: rbac.authorization.k8s.io/v1
409+
metadata:
410+
name: codefresh-role
411+
rules:
412+
- apiGroups: [ “*”]
413+
resources: [“*”]
414+
verbs: [“get”, “list”, “watch”, “create”, “update”, “patch”, “delete”]
415+
—
416+
apiVersion: v1
417+
kind: ServiceAccount
418+
metadata:
419+
name: codefresh-user
420+
namespace: kube-system
421+
—
422+
apiVersion: rbac.authorization.k8s.io/v1
423+
kind: ClusterRoleBinding
424+
metadata:
425+
name: codefresh-user
426+
roleRef:
427+
apiGroup: rbac.authorization.k8s.io
428+
kind: ClusterRole
429+
name: codefresh-role
430+
subjects:
431+
- kind: ServiceAccount
432+
name: codefresh-user
433+
namespace: kube-system
434+
—
435+
apiVersion: v1
436+
kind: Secret
437+
type: kubernetes.io/service-account-token
438+
metadata:
439+
name: codefresh-user-token
440+
namespace: kube-system
441+
annotations:
442+
kubernetes.io/service-account.name: “codefresh-user”
443+
444+
{% endraw %}
445+
{% endhighlight %}
446+
447+
<br />
448+
449+
**How to**
450+
451+
1. If you have more than one cluster, select the appropriate cluster:
452+
`Choose cluster`
453+
{% highlight shell %}
454+
{% raw %}
455+
kubectl config use-context <my-cluster-name>
456+
{% endraw %}
457+
{% endhighlight %}
458+
{:start="2"}
459+
1. Create the Codefresh user/role:
460+
`Apply Codefresh access rules`
461+
{% highlight shell %}
462+
{% raw %}
463+
kubectl apply -f codefresh-role-sa-bind.yml
464+
{% endraw %}
465+
{% endhighlight %}
466+
{:start="3"}
467+
1. Finally run the following commands, and copy-paste the results to the respective Codefresh field in the UI:
468+
`Host IP`
469+
{% highlight shell %}
470+
{% raw %}
471+
export CURRENT_CONTEXT=$(kubectl config current-context) && export CURRENT_CLUSTER=$(kubectl config view -o go-template=“{{\$curr_context := \”$CURRENT_CONTEXT\” }}{{range .contexts}}{{if eq .name \$curr_context}}{{.context.cluster}}{{end}}{{end}}”) && echo $(kubectl config view -o go-template=“{{\$cluster_context := \”$CURRENT_CLUSTER\”}}{{range .clusters}}{{if eq .name \$cluster_context}}{{.cluster.server}}{{end}}{{end}}”)
472+
{% endraw %}
473+
{% endhighlight %}
474+
475+
`Certificate`
476+
{% highlight shell %}
477+
{% raw %}
478+
echo $(kubectl get secret -n kube-system -o go-template=‘{{index .data “ca.crt” }}’ codefresh-user-token)
479+
{% endraw %}
480+
{% endhighlight %}
481+
482+
`Token`
483+
{% highlight shell %}
484+
{% raw %}
485+
echo $(kubectl get secret -n kube-system -o go-template=‘{{index .data “token” }}’ codefresh-user-token)
486+
{% endraw %}
487+
{% endhighlight %}
488+
377489
#### Restrict Codefresh access to a specific namespace
378490

379491
In most cases, you want to allow Codefresh to access all namespaces inside the cluster. This is the most convenient option as it will make

0 commit comments

Comments
 (0)