History

sa069q 88d18fa126 Dex deployment for subclusters using existing dex HelmRelease in treasuremap

Note:
1. As per the latest conclusion, Dex and SIPCluster would be deployed on same namespace, hence dex function added to same Kustomization file

2. As a part of Issue# 136 for catalogue, there would be another patchset to make nodeport flexible

Change-Id: I53b2bb33278dd229450c305ad2e15476d8796073

2021-05-24 22:17:48 +05:30

replacements

Adding a place for external secrets to be stored on site level

2021-05-20 05:34:19 +00:00

dex-cert-issuer.yaml

Changes in dex function to work for both target cluster as well as sub-clusters along with few enhancements

2021-05-20 22:38:15 +05:30

dex-helmrelease.yaml

Dex deployment for subclusters using existing dex HelmRelease in treasuremap

2021-05-24 22:17:48 +05:30

kustomization.yaml

Changes in dex function to work for both target cluster as well as sub-clusters along with few enhancements

2021-05-20 22:38:15 +05:30

README.md

Treasuremap - Dex, API server & LDAP integration

2021-05-12 14:48:48 +00:00

README.md

DEX-AIO function

The DEX-AIO function implements the Dex Authentication service. It contains the HelmRelease manifest for dex-aio, which contains the LDAP connector customization as well as certificates to be used.

The certificate (Secret) used by dex-aio will be generated by the cert-manager, which will be signed by CA that is generated in the Ephemeral cluster and copied to the Target cluster during the airshipctl phase run clusterctl-move operation.

Before you can deploy this helm release, you will need to update the following:

      ldap:
        bind_password: "your LDAP bind password"
        config:
          host: "your LDAP FQDN"
          bind_dn: "your LDAP bind username"

Also, in the same helm release you will need to update the search criteria for the user and group based on your LDAP schema. See the attributes under spec.values.ldap to update below:

      user_search:
        base_dn: dc=testservices,dc=test,dc=com
        filter: "(objectClass=person)"
        username: cn
        idAttr: cn
        emailAttr: name
        nameAttr: name
      group_search:
        base_dn: ou=groups,dc=testservices,dc=test,dc=com
        filter: "(objectClass=group)"
        userMatchers:
          userAttr: name
          groupAttr: member
        nameAttr: name