[Starlingx-discuss] [docs] OpenID connect

[Tullis, Michael L]

Thanks Jerry.

I’ve created a corresponding doc story with your notes embedded to queue up for R3.

https://storyboard.openstack.org/#!/story/2006289

-- Mike

From: Sun, Yicheng (Jerry) [mailto:Jerry.Sun at windriver.com]
Sent: Friday, July 26, 2019 1:46 PM
To: starlingx-discuss at lists.starlingx.io
Subject: [Starlingx-discuss] [docs] OpenID connect

Hi Docs Team,

For story 2006235 (https://storyboard.openstack.org/#!/story/2006235), I need the following changes to docs:
OpenID connect can now be set up on the kubernetes cluster as a form of authentiation. This is done by specifying these values during ansible bootstrap:
apiserver_oidc:
  client_id: …
  issuer_url: …
  username_claim: …

All the values must be specified or all of them must be missing; not specifying any would mean the feature is not configured.

The options match the options with the same name with "oidc_" when starting kube-apiserver. Please refer to official Kubernetes documentation on how to use these values: https://kubernetes.io/docs/reference/access-authn-authz/authentication/

Currently, the options only sets up Kubernetes to support OpenID connect. Authentication by OpenID connect is not forced if these options are used during Ansible bootstrap. The controller can still run Kubernetes commands without OpenID connect auth. If you want to use OpenID connect auth, you will need to configure a (remote) Kubernetes client to use OpenID connect auth as well.

Please note that this will be targeted for R3, so please do not put this in the R2 docs.

Thanks,
Jerry

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20190726/c3b9b34d/attachment-0001.html>