djpbessems
/
ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
ContainerImage.Pinniped/site/content/docs/howto/configure-supervisor-with-g...

143 lines
5.2 KiB
Markdown
Raw Normal View History

Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
---
Use sentence case for headers in docs Following some common developer style guides such as Google https://developers.google.com/style/capitalization#capitalization-in-titles-and-headings and Microsoft https://docs.microsoft.com/en-us/style-guide/scannable-content/headings#formatting-headings
2021-07-27 00:18:44 +00:00
title: Configure the Pinniped Supervisor to use GitLab as an OIDC provider
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
description: Set up the Pinniped Supervisor to use GitLab login.
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
cascade:
layout: docs
menu:
docs:
More doc updates
2021-05-26 17:08:03 +00:00
name: Configure Supervisor With GitLab OIDC
Some light docs wordsmithing and reordering of the sidebar
2021-05-25 23:15:45 +00:00
weight: 90
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
parent: howtos
---
New docs: 1) Concierge with Supervisor, and 2) Supervisor with OpenLDAP
2021-05-25 02:08:01 +00:00
The Supervisor is an [OpenID Connect (OIDC)](https://openid.net/connect/) issuer that supports connecting a single
"upstream" identity provider to many "downstream" cluster clients.
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
Incorporated PR feedback
2021-04-28 20:34:36 +00:00
This guide shows you how to configure the Supervisor so that users can authenticate to their Kubernetes
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
cluster using their GitLab credentials.
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
## Prerequisites
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
This how-to guide assumes that you have already [installed the Pinniped Supervisor]({{< ref "install-supervisor" >}}) with working ingress,
New docs: 1) Concierge with Supervisor, and 2) Supervisor with OpenLDAP
2021-05-25 02:08:01 +00:00
and that you have [configured a FederationDomain to issue tokens for your downstream clusters]({{< ref "configure-supervisor" >}}).
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
## Configure your GitLab Application
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
Follow the instructions for [using GitLab as an OAuth2 authentication service provider](https://docs.gitlab.com/ee/integration/oauth_provider.html) and create a user, group, or instance-wide application.
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
For example, to create a user-owned application:
1. In GitLab, navigate to [_User Settings_ > _Applications_](https://gitlab.com/-/profile/applications)
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
1. Create a new application:
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
1. Enter a name for your application, such as "My Kubernetes Clusters".
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
1. Enter the redirect URI. This is the `spec.issuer` you configured in your `FederationDomain` appended with `/callback`.
1. Check the box saying that the application is _Confidential_.
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
1. Select scope `openid`. This provides access to the `nickname` (GitLab username) and `groups` (GitLab groups) claims.
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
1. Save the application and make note of the _Application ID_ and _Secret_.
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
## Configure the Supervisor cluster
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
Create an [OIDCIdentityProvider](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.20/README.adoc#oidcidentityprovider) in the same namespace as the Supervisor.
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
For example, this OIDCIdentityProvider and corresponding Secret for [gitlab.com](https://gitlab.com) use the `nickname` claim (GitLab username) as the Kubernetes username:
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
```yaml
apiVersion: idp.supervisor.pinniped.dev/v1alpha1
kind: OIDCIdentityProvider
metadata:
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
namespace: pinniped-supervisor
name: gitlab
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
spec:
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
# Specify the upstream issuer URL.
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
issuer: https://gitlab.com
# Specify how GitLab claims are mapped to Kubernetes identities.
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
claims:
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
# Specify the name of the claim in your GitLab token that will be mapped
# to the "username" claim in downstream tokens minted by the Supervisor.
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
username: nickname
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
# Specify the name of the claim in GitLab that represents the groups
# that the user belongs to. Note that GitLab's "groups" claim comes from
# their "/userinfo" endpoint, not the token.
groups: groups
# Specify the name of the Kubernetes Secret that contains your GitLab
# application's client credentials (created below).
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
client:
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
secretName: gitlab-client-credentials
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
---
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
apiVersion: v1
kind: Secret
metadata:
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
namespace: pinniped-supervisor
name: gitlab-client-credentials
type: secrets.pinniped.dev/oidc-client
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
stringData:
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
# The "Application ID" that you got from GitLab.
clientID: "<your-client-id>"
# The "Secret" that you got from GitLab.
clientSecret: "<your-client-secret>"
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
```
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
Once your OIDCIdentityProvider has been created, you can validate your configuration by running:
Do some minor copyediting on "configure-supervisor-with-gitlab.md". Some minor edits I came across while reviewing this: - Capitalize "GitLab" the way they do. - Use `{{< ref "xyz" >}}` references when linking internally. The advantage of these is that they're "type checked" by Hugo when the site is rendered, so we'll know if we ever break one. - Add links to the GitLab docs about creating an OAuth client. These also cover adding a group-level or instance-wide application. - Re-wrap the YAML lines to fit a bit more naturally. - Add a `namespace` to the YAML examples, so they're more likely to work without tweaks. - Use "gitlab" instead of "my-oidc-identity-provider" as the example name, for clarity. - Re-word a few small bits. These are 100% subjective but hopefully an improvement? Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 19:13:20 +00:00
Incorporated PR feedback
2021-04-28 20:34:36 +00:00
```shell
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
kubectl describe OIDCIdentityProvider -n pinniped-supervisor gitlab
Incorporated PR feedback
2021-04-28 20:34:36 +00:00
```
Look at the `status` field. If it was configured correctly, you should see `phase: Ready`.
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
### (Optional) Use a different GitLab claim for Kubernetes usernames
You can also use other GitLab claims as the username.
To do this, make sure you have configured the appropriate scopes on your GitLab application, such as `email`.
You must also adjust the `spec.authorizationConfig` to request those scopes at login and adjust `spec.claims` to use those claims in Kubernetes, for example:
```yaml
# [...]
spec:
# Request any scopes other than "openid" that you selected when
# creating your GitLab application. The "openid" scope is always
# included.
#
# See here for a full list of available claims:
# https://docs.gitlab.com/ee/integration/openid_connect_provider.html
authorizationConfig:
additionalScopes: [ email ]
claims:
username: email
groups: groups
# [...]
```
### (Optional) Use a private GitLab instance
To use privately hosted instance of GitLab, you can change the `spec.issuer` and `spec.tls.certificateAuthorityData` fields, for example:
```yaml
apiVersion: idp.supervisor.pinniped.dev/v1alpha1
kind: OIDCIdentityProvider
# [...]
spec:
# Specify your GitLab instance URL.
issuer: https://gitlab.your-company.example.com.
# Specify the CA bundle for the GitLab server as base64-encoded PEM
Clean up this language in configure-supervisor-with-gitlab.md a bit more. This was duplicitive. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:47:18 +00:00
# data. For example, the output of `cat my-ca-bundle.pem | base64`.
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
#
Clean up this language in configure-supervisor-with-gitlab.md a bit more. This was duplicitive. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:47:18 +00:00
# This is only necessary if your instance uses a custom CA.
More adjustments to configure-supervisor-with-gitlab.md. - Use `nickname` claim as an example, which means we only need the `openid` scope. This is also more stable since emails can change over time. - Put the OIDCIdentityProvider and Secret into one YAML blob, since they will likely be copy-pasted together anyway. - Add a separate section for using alternate claims. - Add a separate section for using a private GitLab instance. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-05-04 20:33:33 +00:00
tls:
certificateAuthorityData: "<gitlab-ca-bundle>"
# [...]
```
Use sentence case for headers in docs Following some common developer style guides such as Google https://developers.google.com/style/capitalization#capitalization-in-titles-and-headings and Microsoft https://docs.microsoft.com/en-us/style-guide/scannable-content/headings#formatting-headings
2021-07-27 00:18:44 +00:00
## Next steps
Added documentation for how to configure the Supervisor with GitLab
2021-04-27 23:18:30 +00:00
Add new howto guide login.md
2021-07-21 19:10:47 +00:00
Next, [configure the Concierge to validate JWTs issued by the Supervisor]({{< ref "configure-concierge-supervisor-jwt" >}})!
Then you'll be able to log into those clusters as any of the users from the GitLab directory.