Kubernetes - LDAP authentication with Dex
This deployment follows Dex by CoreOS & Kubernetes Documentations:
DNS entries:
Kubernetes cluster available with the following requirements:
An available LDAP server
Helm chart is available here.
kubectl create ns auth
# CA (letsencrypt) configmap
kubectl create -f ca-cm.yml
# Login App configuration
kubectl create -f loginapp-cm.yml
# Login App Ingress and SVC
kubectl create -f loginapp-ing-svc.yml
# Login App Deployment
kubectl create -f loginapp-deploy.yml
It should fail because Dex is not deployed.
We will use Kubernetes Custom Resource Definitions (https://kubernetes.io/docs/concepts/api-extension/custom-resources/) as Dex storage backend.
kubectl create -f dex-crd.yml
# Dex configuration
kubectl create -f dex-cm.yml
# Dex ingress and service
kubectl create -f dex-ing-svc.yml
# Dex deployment
kubectl create -f dex-deploy.yml
Now it should work: try https://login.k8s.example.org, login and retrieve k8s configuration.
kubectl --token=token get pods -n auth
Error from server (Forbidden): pods is forbidden: User "<oidc-issuer-url>#<name>" cannot list pods in the namespace "auth"
User prefix can be updated with the --oidc-username-prefix apiserver option.
kubectl create -f crb-all-auth.yml
Try again:
kubectl --token=$token get po
NAME READY STATUS RESTARTS AGE
dex-6f6568d499-m89z6 1/1 Running 0 7m
loginapp-6474748f4b-gb5kb 1/1 Running 0 8m
loginapp-6474748f4b-prq25 1/1 Running 0 8m
loginapp-6474748f4b-vnvnb 1/1 Running 0 8m