djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Remove mention of things not yet implemented from architecture.md

Browse Source
This commit is contained in:
Ryan Richard 2020-09-17 09:10:19 -07:00
parent a70a4766d2
commit 4c9cbf0706
1 changed files with 7 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
doc/architecture.md
View File

@ -5,25 +5,19 @@ clusters. Pinniped hopes to enable this access across a wide range of Kubernetes
environments with zero configuration. environments with zero configuration.
This integration is implemented using a credential exchange API which takes as This integration is implemented using a credential exchange API which takes as
input a credential from the external IDP (or internal federation trust input a credential from the external IDP and returns a credential which is understood by the host
relationship) and returns a credential which is understood by the host Kubernetes cluster.
Kubernetes cluster. To learn more about this integration, see [Cluster
Integration Strategies](#cluster-integration-strategies).
<img src="img/pinniped_architecture.svg" alt="Pinniped Architecture Sketch" width="300px"/> <img src="img/pinniped_architecture.svg" alt="Pinniped Architecture Sketch" width="300px"/>
Pinniped supports various IDP types and implements different integration strategies
for various Kubernetes distributions to make authentication possible.
## External Identity Provider Integrations ## External Identity Provider Integrations
Pinniped will consume identity from one or more external identity providers Pinniped will consume identity from one or more external identity providers
(IDPs). Administrators will configure external IDPs via [Kubernetes custom (IDPs). Administrators will configure external IDPs via Kubernetes custom
resources](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/), resources allowing Pinniped to be managed using GitOps and standard Kubernetes tools.
allowing Pinniped to be managed using GitOps and standard Kubernetes tools.
IDP integration support will be driven by empirical use case.
IDPs that support only just-in-time flows (such as OIDC) can be optionally
paired with a separate directory backend to enable directory-based flows such as
first-class support for policy editing UX.
### Supported External Identity Provider Types ### Supported External Identity Provider Types