From 78c2801d1b8fbc31ed22a2f583dd0f8e4f971a44 Mon Sep 17 00:00:00 2001 From: Eric Chiang Date: Wed, 9 Aug 2017 13:16:03 -0700 Subject: [PATCH] docs/admin: encourage out-of-tree auth-N/Z integrations Remove the custom modules description in the authorization and authentication docs. While we could add more later, we probably don't want to advertise them to end users. Also note that the authentication webhook and authenticating proxy can be used to integrate with unsupported auth protocols. --- docs/admin/authentication.md | 12 ++++-------- docs/admin/authorization/index.md | 21 --------------------- 2 files changed, 4 insertions(+), 29 deletions(-) diff --git a/docs/admin/authentication.md b/docs/admin/authentication.md index 324330cf39..220f418c43 100644 --- a/docs/admin/authentication.md +++ b/docs/admin/authentication.md @@ -60,6 +60,10 @@ The API server does not guarantee the order authenticators run in. The `system:authenticated` group is included in the list of groups for all authenticated users. +Integrations with other authentication protocols (LDAP, SAML, Kerberos, alternate x509 schemes, etc) +can be accomplished using an [authenticating proxy](#authenticating-proxy) or the +[authentication webhook](#webhook-token-authentication). + ### X509 Client Certs Client certificate authentication is enabled by passing the `--client-ca-file=SOMEFILE` @@ -685,14 +689,6 @@ rules: resourceNames: ["view", "development"] ``` -## Plugin Development - -We plan for the Kubernetes API server to issue tokens after the user has been -(re)authenticated by a *bedrock* authentication provider external to Kubernetes. -We also plan to make it easy to develop modules that interface between -Kubernetes and a bedrock authentication provider (e.g. github.com, google.com, -enterprise directory, kerberos, etc.) - ## APPENDIX ### Creating Certificates diff --git a/docs/admin/authorization/index.md b/docs/admin/authorization/index.md index 61ad340eb4..c1d456f626 100644 --- a/docs/admin/authorization/index.md +++ b/docs/admin/authorization/index.md @@ -65,27 +65,6 @@ of the `bind` verb on `roles` and `clusterroles` resources in the `rbac.authoriz ..* As of 1.6 RBAC mode is in beta. ..* To enable RBAC, start the apiserver with `--authorization-mode=RBAC`. * **Webhook** - A WebHook is an HTTP callback: an HTTP POST that occurs when something happens; a simple event-notification via HTTP POST. A web application implementing WebHooks will POST a message to a URL when certain things happen. To learn more about using the Webhook mode, see [Webhook Mode](/docs/admin/authorization/webhook/). - * **Custom Modules** - You can create custom modules for using with Kubernetes. To learn more, see **Custom Modules** below. - -### Custom Modules -Other implementations can be developed fairly easily. The APIserver calls the Authorizer interface: - -```go -type Authorizer interface { - Authorize(a Attributes) error -} -``` - -to determine whether or not to allow each API action. - -An authorization plugin is a module that implements this interface. -Authorization plugin code goes in `pkg/auth/authorizer/$MODULENAME`. - -An authorization module can be completely implemented in go, or can call out -to a remote authorization service. Authorization modules can implement -their own caching to reduce the cost of repeated authorization calls with the -same or similar arguments. Developers should then consider the interaction -between caching and revocation of permissions. #### Checking API Access