[Starlingx-discuss] Kubernetes static token authentication support
Hi,
I want to know whether Starling X supports Static token authentication for kubernetes cluster. i.e. https://kubernetes.io/docs/reference/access-authn-authz/authentication/#stat... .
In case like accessing kubernetes cluster running in starling X from a remote container using static token based authentication.
Thanks and regards
The short answer is no.
The reason why is that StarlingX simplifies & robustifies the installation and configuration of Kubernetes by hiding the complexity of the kubeadm-based install/config of K8S, choosing appropriate defaults for parameters, and only exposing a few parameters for change by the end user with semantic checks to prevent mis-configuration.
In order to configure static token authentication, you would have to be able to configure the token-auth-file parameter of the kube-apiserver. Currently that is not exposed in the bootstrap playbook or in any ‘system service-parameters ...’ .
In theory you could explicitly edit the kube-apiserver’s manifest (sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml) and add this in ... but you’d have to do both controllers ... and kubeadm would not be aware of this change, so if you ever had to re-install a controller, you’d have to remember to do this change ... ... i.e. “really not supported by starlingx”
Greg.
From: Nidhi Kalkur nidhikalkur@gmail.com Date: Friday, October 30, 2020 at 5:27 AM To: "starlingx-discuss@lists.starlingx.io" starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] Kubernetes static token authentication support
[Please note this e-mail is from an EXTERNAL e-mail address] Hi,
I want to know whether Starling X supports Static token authentication for kubernetes cluster. i.e. https://kubernetes.io/docs/reference/access-authn-authz/authentication/#stat....
In case like accessing kubernetes cluster running in starling X from a remote container using static token based authentication.
Thanks and regards
participants (2)
-
Nidhi Kalkur
-
Waines, Greg