-
Notifications
You must be signed in to change notification settings - Fork 864
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Integrate Dex Auth with Multi User Story #267
Comments
@krishnadurai Can you please add
|
/priority p1 |
@krishnadurai What are the next steps here? I believe the existing_arrikto.yaml config is already using Dex and ISTIO. I think one question that came up is can we generalize what's used in existing_arrikto.yaml to make it easier to compose the Dex setup with installations? (see #3739). For GCP we would like to get rid of our custom basic auth setup and just install Dex with an appropriate authenticator. Another question that has come up is where is the source code for the OIDC connector used in kubeflow_existing_arrikto.yaml? I believe the config is currently referencing a container in an Arrikto GCR container. How does key keycloak-gatekeeper interact with Dex? Is keycloak trying to do the same thing Dex is doing by creating a proxy for OpenID providers? /cc @yanniszark |
@jlewi keycloak-gatekeeper is being used as an authentication proxy for Kubeflow like what IAP does for GCP IAP config. This will also be used to add additional headers required for multi-user in the future. For now, I've been able to make this proxy work on the web UI for Authentication (login/logout) flow. I'm finalizing it to work with kfctl and HTTPS. Soon Multi-User support will follow.
keycloak-gatekeeper acts as a client application to Dex, which means - if it doesn't find the user session information - it will interact with Dex (making the user login) and set the appropriate session headers or cookie information for its endpoint. Here, Dex acts as a unifying connector to all these identification mechanisms and not a proxy.
We should hopefully be able to get there within 0.7.
We should go on to implement the cert creation as mentioned in kubeflow/kubeflow#3739 as a part of kfctl. Though I believe LoadBalancer configuration should be made configurable through istio overlays and platform based installations. WDYT? |
Refer discussion here: https://kubeflow.slack.com/archives/C7REE0EHK/p1568033731165800 |
@krishnadurai Do you want to add a link your doc? |
Here's the doc which describes the approaches to have an Auth Proxy/OIDC flow with Dex: http://bit.ly/2kxbgbE |
@jlewi @yanniszark @quanjielin I think one way of moving ahead is to define what solution we should pursue for 0.7 and then if required make changes for 1.0, since we have limited time for the release. |
@jlewi @yanniszark @quanjielin can we please move ahead on this? |
@krishnadurai what is the decision from the aforementioned doc? We have confirmed that the solution using the OIDC AuthService satisfies those requirements. =================================== User RequirementsA lot of users of existing_arrikto have made the following requests. These features are important to users operating in on-prem, airgapped environments:
To solve these we can:
=================================== I believe that Keycloak Gatekeeper currently has no way to satisfy this requirement:
|
@yanniszark As discussed in the on-prem meeting - we should go ahead with Ambassador OIDC and let us add it to the dex-auth manifest. I'll remove keycloak-gatekeeper as soon as Ambassador OIDC Authservice is in. @jlewi can we look to include the Ambassador OIDC repository in Kubeflow? |
@krishnadurai Is this #1 or #2 in your design doc? #2 Seems better to me because not every request goes through the AuthService; only ones which don't have credentials |
It is the second approach. With this approach, JWT checking is done once only by the AuthService instead of Istio. AuthService provides the added facility to start the OIDC login flow if credentials are missing or incorrect. |
Great. Can we capture in the doc the decision and also reference this issue if not already doing so. |
Sure, I'll just make a note of it there. I've made kubeflow/kubeflow#4160 to track adding Ambassador OIDC repository in Kubeflow organisation. |
Increasing this issue's priority for making it a part of manifests for 0.7 release. /priority p0 |
An update on this: We are integrating a rewrite of the ajmyyra/ambassador-auth-oidc project which features better code structure and support for sessions instead of JWT blacklists (which is safer since if you lose the blacklist JWTs may become active again). The new code lives in arrikto/oidc-authservice and will use the same license as the old one (MIT). |
/reopen |
@krishnadurai: Reopened this issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
@yanniszark I think it would be better to keep this issue open until the entire setup is working in a seamless manner. There are a few things left in that note:
Refer to the earlier comment on the PR which closed this issue: #529 (review) @jlewi I suggest we add this to the 0.7 tracker. |
What about docs and testing for this? |
@jlewi as discussed the docs and testing are pending and will be created soon. |
Using #599 to track this. /close |
@krishnadurai: Closing this issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Current Dex implementation needs to integrate well with Multi-User Story in the following areas:
Reference issue/PR:
#195
/cc @jlewi @kkasravi
/assign @krishnadurai
The text was updated successfully, but these errors were encountered: