From a0cecd07cb5fa2ab1ddbc458bb0d1fc1e41bbf4a Mon Sep 17 00:00:00 2001 From: Matthew Fisher Date: Mon, 12 Sep 2016 11:11:38 -0700 Subject: [PATCH 1/2] GCE runs the l7 cluster addon on the master --- docs/user-guide/ingress.md | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/docs/user-guide/ingress.md b/docs/user-guide/ingress.md index d80efa9bb9..1c82fb3676 100644 --- a/docs/user-guide/ingress.md +++ b/docs/user-guide/ingress.md @@ -44,13 +44,7 @@ It can be configured to give services externally-reachable urls, load balance tr Before you start using the Ingress resource, there are a few things you should understand. The Ingress is a beta resource, not available in any Kubernetes release prior to 1.1. You need an Ingress controller to satisfy an Ingress, simply creating the resource will have no effect. -On GCE/GKE there should be a [L7 cluster addon](https://github.com/kubernetes/contrib/blob/master/ingress/controllers/gce/README.md), deployed into the `kube-system` namespace: - -```shell -$ kubectl get pods --namespace=kube-system -l k8s-app=glbc -NAME READY STATUS RESTARTS AGE -l7-lb-controller-v0.6.0-chnan 2/2 Running 0 1d -``` +GCE/GKE deploys an ingress controller on the master. You can deploy any number of custom ingress controllers in a pod. You must annotate each ingress with the appropriate class, as indicated [here](https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx#running-multiple-ingress-controllers) and [here](https://github.com/kubernetes/contrib/blob/master/ingress/controllers/gce/BETA_LIMITATIONS.md#disabling-glbc). Make sure you review the [beta limitations](https://github.com/kubernetes/contrib/tree/master/ingress/controllers/gce/BETA_LIMITATIONS.md) of this controller. In environments other than GCE/GKE, you need to [deploy a controller](https://github.com/kubernetes/contrib/tree/master/ingress/controllers) as a pod. From ec9f1aedc9b4526b05b425e871cca9a49281e91a Mon Sep 17 00:00:00 2001 From: Eric Chiang Date: Mon, 12 Sep 2016 10:20:28 -0700 Subject: [PATCH 2/2] docs/admin/authentication: explicitly state the OIDC id_token is used instead of the access_token Most OAuth2 libraries use the access_token as a bearer token. This is different for Kubernetes, since the OIDC plugin uses an id_token instead (also returned in the token response). Be explicit and call out this difference. --- docs/admin/authentication.md | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/docs/admin/authentication.md b/docs/admin/authentication.md index bbceb4f818..08fde3265f 100644 --- a/docs/admin/authentication.md +++ b/docs/admin/authentication.md @@ -188,8 +188,15 @@ some OAuth2 providers, notably Azure Active Directory, Salesforce, and Google. The protocol's main extension of OAuth2 is an additional field returned with the access token called an [ID Token](https://openid.net/specs/openid-connect-core-1_0.html#IDToken). This token is a JSON Web Token (JWT) with well known fields, such as a user's -email, signed by the server. When used as a bearer token, the API server can -verify ID token's signature and determine the end users identity. +email, signed by the server. + +To identify the user, the authenticator uses the `id_token` (not the `access_token`) +from the OAuth2 [token response](https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse) +as a bearer token. + +``` +Authentication: Bearer (id_token) +``` To enable the plugin, pass the following required flags: @@ -223,12 +230,12 @@ Kubernetes does not provide an OpenID Connect Identity Provider. You can use an existing public OpenID Connect Identity Provider (such as Google, or [others](http://connect2id.com/products/nimbus-oauth-openid-connect-sdk/openid-connect-providers)). Or, you can run your own Identity Provider, such as CoreOS [dex](https://github.com/coreos/dex), [Keycloak](https://github.com/keycloak/keycloak) or CloudFoundary [UAA](https://github.com/cloudfoundry/uaa). -The provider needs to support [OpenID connect discovery]https://openid.net/specs/openid-connect-discovery-1_0.html); not all do. +The provider needs to support [OpenID connect discovery](https://openid.net/specs/openid-connect-discovery-1_0.html); not all do. Setup instructions for specific systems: -- [UAA]: http://apigee.com/about/blog/engineering/kubernetes-authentication-enterprise -- [Dex]: https://speakerdeck.com/ericchiang/kubernetes-access-control-with-dex +- [UAA](http://apigee.com/about/blog/engineering/kubernetes-authentication-enterprise) +- [Dex](https://speakerdeck.com/ericchiang/kubernetes-access-control-with-dex) ### Webhook Token Authentication