Commits on Oct 25, 2018

1. Restrict Oauth authentication by domain suffix …

   With Google-based Oauth, we need to additionally restrict the user in
   some way - we don't want to allow just _any_ Google account to access
   the prometheus/kibana consoles.
   
   This change adds a flag to specify an email domain, and oauth2 proxy
   will only allow users from this domain.  This flag is marked as
   *required* on GKE.
   
   NB: This effectively restricts kubeprod to only supporting GSuite
   accounts (@gmail.com is not useful), which is conceptually similar to
   the AKS setup which allows only members from a particular Azure
   tenant.  Allowing a whitelist of specific (non-GSuite) Gmail accounts
   instead is probably desirable, but postponed for a future change.

   

   anguslees committed Oct 25, 2018
   Configuration menu

   • View commit details
   • Copy full SHA for 6bee76e
   • Browse repository at this point

   Copy the full SHA

   6bee76e View commit details

   Browse the repository at this point in the history