[Starlingx-discuss] Kubernetes static token authentication support

[Waines, Greg]

The short answer is no.

The reason why is that StarlingX simplifies & robustifies the installation and configuration of Kubernetes by hiding the complexity of the kubeadm-based install/config of K8S, choosing appropriate defaults for parameters, and only exposing a few parameters for change by the end user with semantic checks to prevent mis-configuration.

In order to configure static token authentication, you would have to be able to configure the token-auth-file parameter of the kube-apiserver.   Currently that is not exposed in the bootstrap playbook or in any ‘system service-parameters ...’ .

In theory you could explicitly edit the kube-apiserver’s manifest (sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml) and add this in ... but you’d have to do both controllers ... and kubeadm would not be aware of this change, so if you ever had to re-install a controller, you’d have to remember to do this change ...
... i.e. “really not supported by starlingx”

Greg.


From: Nidhi Kalkur <nidhikalkur at gmail.com>
Date: Friday, October 30, 2020 at 5:27 AM
To: "starlingx-discuss at lists.starlingx.io" <starlingx-discuss at lists.starlingx.io>
Subject: [Starlingx-discuss] Kubernetes static token authentication support

[Please note this e-mail is from an EXTERNAL e-mail address]
Hi,

I want to know whether Starling X supports Static token authentication for kubernetes cluster.
i.e.
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#static-token-file.

In case like accessing kubernetes cluster running in starling X from a remote container using static token based authentication.

Thanks and regards
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20201105/7cb9bb51/attachment.html>