Dex,oauth2-proxy and k8s token documentation #2911
Conversation
Signed-off-by: juliusvonkohout <45896133+juliusvonkohout@users.noreply.github.com>
Signed-off-by: juliusvonkohout <45896133+juliusvonkohout@users.noreply.github.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Signed-off-by: juliusvonkohout <45896133+juliusvonkohout@users.noreply.github.com>
Signed-off-by: juliusvonkohout <45896133+juliusvonkohout@users.noreply.github.com>
Signed-off-by: juliusvonkohout <45896133+juliusvonkohout@users.noreply.github.com>
Signed-off-by: juliusvonkohout <45896133+juliusvonkohout@users.noreply.github.com>
| # tokens to be used from outside the cluster via the Istio ingress-gateway. | ||
| # | ||
| kustomize build common/oauth2-proxy/overlays/m2m-dex-only/ | kubectl apply -f - | ||
| kubectl wait --for=condition=ready pod -l 'app.kubernetes.io/name=oauth2-proxy' --timeout=180s -n oauth2-proxy | ||
|
|
||
| # Option 2: works on Kind/K3D and other clusters with the proper configuration, and allows K8s service account tokens to be used | ||
| # Option 2: works on Kind, K3D, Rancher, GKE and many other clusters with the proper configuration, and allows K8s service account tokens to be used |
There was a problem hiding this comment.
RKE 1 doesn't support .well-known/openid-configuration . So option 1 works in rancher
There was a problem hiding this comment.
I am using option 2 on rancher as well, so it definitely works :-) did you enable access in rancher to the openid configuration? Something like this i guess rancher/rancher#36444. please share how you enabled it on your cluster and tell me how the curl command worked out for you.
@tarekabouzeid please review
supersedes #2888 @choudhryfrompak