Skip to content

Commit 4569bdd

Browse files
pjuarezdfeorlenravindk89
authored
Operator Console OpenID configuration (#1949)
* Operator Console OpenID configuration Add example configuration by environment variables to enable OpenID in Operator Console. Added also a README.md document explaining the different options. Signed-off-by: pjuarezd <pjuarezd@users.noreply.github.com> * add line at the end of the file Signed-off-by: pjuarezd <pjuarezd@users.noreply.github.com> * Apply Andrea's suggestions and add kustomization execution example Signed-off-by: pjuarezd <pjuarezd@users.noreply.github.com> * Update examples/kustomization/operator-external-idp-oid/README.md Co-authored-by: Andrea Longo <feorlen@users.noreply.github.com> * Update examples/kustomization/operator-external-idp-oid/README.md Co-authored-by: Andrea Longo <feorlen@users.noreply.github.com> * Update examples/kustomization/operator-external-idp-oid/README.md Co-authored-by: Andrea Longo <feorlen@users.noreply.github.com> * Update examples/kustomization/operator-external-idp-oid/README.md Co-authored-by: Ravind Kumar <ravindk89@gmail.com> * remove commented env variable Signed-off-by: pjuarezd <pjuarezd@users.noreply.github.com> --------- Signed-off-by: pjuarezd <pjuarezd@users.noreply.github.com> Co-authored-by: Andrea Longo <feorlen@users.noreply.github.com> Co-authored-by: Ravind Kumar <ravindk89@gmail.com>
1 parent 1509ccb commit 4569bdd

File tree

4 files changed

+144
-0
lines changed

4 files changed

+144
-0
lines changed

‎examples/kustomization/operator-external-idp-oid/README.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Operator Console SSO with OpenID
2+
3+
Operator Console supports authentication with a Kubernetes Service Account Json Web Token (JWT) or OpenID. This guide explains how to configure OpenID authentication for Operator Console using the [OpenID Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth).
4+
5+
Note: only one authentication method can be enabled at the same time, either JWT or OpenID.
6+
7+
The `kustomization.yaml` file provided in this directory installs Operator and applies the basic configurations to enable OpenID authentication for Operator Console. Modify its environment variable values as needed for your deployment and provide the CA certificate in `console-deployment.yaml` and `console-tls-secret.yaml`.
8+
9+
```shell
10+
kubectl apply -k examples/kustomization/operator-external-idp-oid/
11+
```
12+
13+
### IDP Server
14+
15+
Specify the OpenID server URL in the Operator Console Deployment by setting the `CONSOLE_IDP_URL` environment variable. This value should point to the appropriate OpenID Endpoint configuration, for example: `https://your-extenal-idp.com/.well-known/openid-configuration`.
16+
17+
Also provide the Certificate Authority (CA) that signed the certificate the IDP server presents. You can do this by mounting a secret containing the certificate `ca.crt`. For example:
18+
19+
For a CA certificate resembling the following:
20+
21+
```yaml
22+
apiVersion: v1
23+
kind: Secret
24+
metadata:
25+
name: idp-ca-tls
26+
namespace: minio-operator
27+
type: Opaque
28+
stringData:
29+
ca.crt: |
30+
<CA public certificate content in plain text here>
31+
```
32+
33+
Mount the secret in the Deployment as follows:
34+
35+
```yaml
36+
apiVersion: apps/v1
37+
kind: Deployment
38+
metadata:
39+
name: console
40+
namespace: minio-operator
41+
spec:
42+
template:
43+
spec:
44+
containers:
45+
- name: console
46+
volumeMounts:
47+
- mountPath: /tmp/certs/CAs
48+
name: idp-certificate
49+
volumes:
50+
- name: idp-certificate
51+
projected:
52+
sources:
53+
- secret:
54+
items:
55+
- key: ca.crt
56+
path: idp.crt
57+
name: idp-ca-tls
58+
...
59+
```
60+
61+
### Client credentials
62+
63+
Operator Console is a standalone application that identifies itself to the OpenID server using *client credentials*. The client credentials are set in the Operator Console with the following environment variables:
64+
- `CONSOLE_IDP_CLIENT_ID` (client id)
65+
- `CONSOLE_IDP_SECRET` (client secret)
66+
67+
### Access Management
68+
69+
All users in the OIDC realm have access to the Operator Console upon successful authentication.
70+
71+
To restrict access, create a new OIDC realm and use the client ID/Secret for that realm when configuring OIDC.
72+
73+
### Scopes:
74+
75+
In OAuth2, scopes defines the specific actions that an application (client) is allowed to perform. If the `Client` has assigned scopes to the OpenID server to allow login in Operator Console, such scopes need to be set to Operator Console in the `CONSOLE_IDP_SCOPES` environment variable. This value should be a comma delimited string. If no value is provided, the default is `openid,profile,email`.
76+
77+
### Callback URL
78+
OpenID uses a "call back" URL to redirect back to the application once the authentication succeeds. This callback URL is set in Operator Console with the `CONSOLE_IDP_CALLBACK` environment variable.
79+
80+
A Callback URL can also be constructed dynamically. To do this, set `CONSOLE_IDP_CALLBACK_DYNAMIC` environment variable to `on` instead of setting a `CONSOLE_IDP_CALBACK`.
81+
82+
The constructed URL resembles following: `$protocol://$host/oauth_callback`
83+
84+
- `$protocol` is either `https` or `http`, depending on whether the Operator Console has TLS enabled.
85+
- `$host` is determined from the `HOST` header (URL) where the end user is sending the login request to Operator Console. For example, for the login URL `https://operator.mydomain.com/login`, `$host` is `operator.mydomain.com`.
86+
87+
Setting `CONSOLE_IDP_CALLBACK` can be useful if you need to specify a custom domain for the Operator Console, or if the Operator Console is behind a reverse proxy or load balancer and the `HOST` header is not available.
88+
The page located at `/oauth_callback` handles the redirect after a successful login.
89+
90+
Make sure the `CONSOLE_IDP_CALLBACK` URL contains the correct path, for example `https://minio-operator.mydomain.com/oauth_callback`.
91+
92+
### Token expiration
93+
94+
The default OpenID login token duration is 3600 seconds (1 hour). You can set a longer duration with the
95+
`CONSOLE_IDP_TOKEN_EXPIRATION` environment variable.

‎examples/kustomization/operator-external-idp-oid/console-deployment.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: console
5+
namespace: minio-operator
6+
spec:
7+
template:
8+
spec:
9+
containers:
10+
- name: console
11+
env:
12+
- name: CONSOLE_IDP_URL
13+
value: https://myidpserver.com/realms/realmname/.well-known/openid-configuration
14+
- name: CONSOLE_IDP_CLIENT_ID
15+
value: "" # Client registered in Open ID
16+
- name: CONSOLE_IDP_SECRET
17+
value: "" #Client secret in Open ID
18+
- name: CONSOLE_IDP_CALLBACK_DYNAMIC
19+
value: "on"
20+
volumeMounts:
21+
- mountPath: /tmp/certs/CAs
22+
name: idp-certificate
23+
volumes:
24+
- name: idp-certificate
25+
projected:
26+
sources:
27+
- secret:
28+
items:
29+
- key: ca.crt
30+
path: idp.crt
31+
name: idp-ca-tls

‎examples/kustomization/operator-external-idp-oid/console-tls-secret.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: idp-ca-tls
5+
namespace: minio-operator
6+
type: Opaque
7+
stringData:
8+
ca.crt: |
9+
<CA public certificate content in plain text>

‎examples/kustomization/operator-external-idp-oid/kustomization.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
resources:
5+
- ../../../resources
6+
- console-tls-secret.yaml
7+
8+
patchesStrategicMerge:
9+
- console-deployment.yaml

0 commit comments

Comments
 (0)