You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
By now, qinling connects to the Kubernetes API server insecurely. kubectl proxy is used for testing purpose. However, in real production deployments, it is not a good idea to let qinling connect to the Kubernetes API server without any authentication and authorization. This commit adds the support in qinling for it to connect to the Kubernetes API server with X509 Client Certs for authentication . An example file is also added for users to grant specific access to the Kubernetes API for qinling using the RBAC authorization of Kubernetes . With these users can control qinling's access to the Kubernetes API  and ensure qinling uses a secure connection to talk with the Kubernetes API. Devstack plugin also setups qinling to connect to Kubernetes API server using TLS certificates by default. This makes the deployment with devstack closer to a production-ready environment. For testing purpose, user can set the QINLING_K8S_APISERVER_TLS variable to False in devstack's local.conf. Note: a HOTWO document will be added in a follow-up commit.  https://kubernetes.io/docs/admin/authentication/#x509-client-certs  https://kubernetes.io/docs/admin/authorization/rbac/  https://kubernetes.io/docs/admin/accessing-the-api/ Change-Id: I532f131abbfc8ed90de398cc135e9b8248d2757a
|5 years ago|
|functions/python/openstack||5 years ago|
|kubernetes||5 years ago|