epostnikof/kubespray
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-03-08 11:07:43 +03:00
Code Issues Packages Projects Releases Wiki Activity

Granular authentication Control

Browse Source 
It is now possible to deactivate selected authentication methods
(basic auth, token auth) inside the cluster by adding
removing the required arguments to the Kube API Server and generating
the secrets accordingly.

The x509 authentification is currently not optional because disabling it
would affect the kubectl clients deployed on the master nodes.
This commit is contained in:
Vincent Schwarzer
2017-02-27 14:15:50 +01:00
parent 3feab1cb2d
commit 026da060f2
5 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
roles/kubernetes/master/defaults/main.yml
View File

@@ -31,9 +31,15 @@ kube_apiserver_memory_requests: 256M
kube_apiserver_cpu_requests: 300m
kube_apiserver_storage_backend: etcd2
## Enable/Disable Kube API Server Authentication Methods
kube_basic_auth: true
kube_token_auth: true
kube_oidc_auth: false
## Variables for OpenID Connect Configuration https://kubernetes.io/docs/admin/authentication/
## To use OpenID you have to deploy additional an OpenID Provider (e.g Dex, Keycloak, ...)
kube_oidc_auth: false
#kube_oidc_url: https:// ...
# kube_oidc_client_id: kubernetes
## Optional settings for OIDC