djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed typos and issues with the demo code

Browse Source 
- Also cleaned up some wording
This commit is contained in:
Margo Crawford 2021-01-04 16:23:24 -08:00
parent ef828cf2e1
commit 8422659ee5
2 changed files with 35 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
site/content/docs/concierge-and-supervisor-demo.md
View File

@ -8,31 +8,29 @@ cascade:
## Prerequisites ## Prerequisites
1. A Kubernetes clusters of a type supported by Pinniped Concierge as described in [architecture](/docs/architecture). 1. A Kubernetes cluster of a type supported by Pinniped Concierge as described in [architecture](/docs/architecture).
Don't have a cluster handy? Consider using [kind](https://kind.sigs.k8s.io/) on your local machine. Don't have a cluster handy? Consider using [kind](https://kind.sigs.k8s.io/) on your local machine.
See below for an example of using kind. See below for an example of using kind.
1. A Kubernetes clusters of a type supported by Pinniped Supervisor (this can be the same cluster as the above, or different). 1. A Kubernetes cluster of a type supported by Pinniped Supervisor (this can be the same cluster as the above, or different).
1. A kubeconfig where the current context points to the cluster and has admin-like privileges on each cluster. 1. A kubeconfig that has admin-like privileges on each cluster.
1. An external OIDC identity provider to use as the source of identity for Pinniped. 1. An external OIDC identity provider to use as the source of identity for Pinniped.
## Overview ## Overview
Installing and trying Pinniped on any cluster will consist of the following general steps. See the next section below Installing and trying Pinniped on any cluster will consist of the following general steps. See the next section below
for a more specific example, including the exact commands to use for that case. for a more specific example, including the commands to use for that case.
1. Install the Pinniped Supervisor. See [deploy/supervisor/README.md](https://github.com/vmware-tanzu/pinniped/blob/main/deploy/supervisor/README.md). 1. Install the Pinniped Supervisor. See [deploy/supervisor/README.md](https://github.com/vmware-tanzu/pinniped/blob/main/deploy/supervisor/README.md).
1. Create a 1. Create a
[`FederationDomain`](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.19/README.adoc#k8s-api-go-pinniped-dev-generated-1-19-apis-supervisor-config-v1alpha1-federationdomain) [`FederationDomain`](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.19/README.adoc#k8s-api-go-pinniped-dev-generated-1-19-apis-supervisor-config-v1alpha1-federationdomain)
via the installed Pinniped Supervisor. via the installed Pinniped Supervisor.
1. Create a 1. Create an
[`OIDCIdentityProvider`](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.19/README.adoc#k8s-api-go-pinniped-dev-generated-1-19-apis-supervisor-idp-v1alpha1-oidcidentityprovider) [`OIDCIdentityProvider`](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.19/README.adoc#k8s-api-go-pinniped-dev-generated-1-19-apis-supervisor-idp-v1alpha1-oidcidentityprovider)
via the installed Pinniped Supervisor. This via the installed Pinniped Supervisor.
[`OIDCIdentityProvider`](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.19/README.adoc#k8s-api-go-pinniped-dev-generated-1-19-apis-supervisor-idp-v1alpha1-oidcidentityprovider)
should point to a valid external OIDC identity provider with a valid client registered.
1. Install the Pinniped Concierge. See [deploy/concierge/README.md](https://github.com/vmware-tanzu/pinniped/blob/main/deploy/concierge/README.md). 1. Install the Pinniped Concierge. See [deploy/concierge/README.md](https://github.com/vmware-tanzu/pinniped/blob/main/deploy/concierge/README.md).
1. Create a 1. Create a
[`JWTAuthenticator`](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.19/README.adoc#k8s-api-go-pinniped-dev-generated-1-19-apis-concierge-authentication-v1alpha1-jwtauthenticator) [`JWTAuthenticator`](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.19/README.adoc#k8s-api-go-pinniped-dev-generated-1-19-apis-concierge-authentication-v1alpha1-jwtauthenticator)
@ -44,14 +42,14 @@ for a more specific example, including the exact commands to use for that case.
## Example of Deploying on Multiple kind Clusters ## Example of Deploying on Multiple kind Clusters
[kind](https://kind.sigs.k8s.io) is a tool for creating and managing Kubernetes clusters on your local machine [kind](https://kind.sigs.k8s.io) is a tool for creating and managing Kubernetes clusters on your local machine
which uses Docker containers as the cluster's "nodes". This is a convenient way to try out Pinniped on a local which uses Docker containers as the cluster's "nodes". This is a convenient way to try out Pinniped on local
non-production cluster. non-production clusters.
The following steps will deploy the latest release of Pinniped on kind. It will deploy the Pinniped The following steps will deploy the latest release of Pinniped on kind. It will deploy the Pinniped
Supervisor on one cluster, and the Pinniped Concierge on another cluster. A multi-cluster deployment Supervisor on one cluster, and the Pinniped Concierge on another cluster. A multi-cluster deployment
strategy is common for Pinniped. The Pinniped Concierge will use a strategy is typical for Pinniped. The Pinniped Concierge will use a
[`JWTAuthenticator`](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.19/README.adoc#k8s-api-go-pinniped-dev-generated-1-19-apis-concierge-authentication-v1alpha1-jwtauthenticator) [`JWTAuthenticator`](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.19/README.adoc#k8s-api-go-pinniped-dev-generated-1-19-apis-concierge-authentication-v1alpha1-jwtauthenticator)
to authenticate federated identities from the Supervisor to authenticate federated identities from the Supervisor.
1. Install the tools required for the following steps. 1. Install the tools required for the following steps.
@ -80,7 +78,9 @@ to authenticate federated identities from the Supervisor
This demo uses a `Secret` named `my-federation-domain-tls` to provide the serving certificate for This demo uses a `Secret` named `my-federation-domain-tls` to provide the serving certificate for
the the
[`FederationDomain`](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.19/README.adoc#k8s-api-go-pinniped-dev-generated-1-19-apis-supervisor-config-v1alpha1-federationdomain). The [`FederationDomain`](https://github.com/vmware-tanzu/pinniped/blob/main/generated/1.19/README.adoc#k8s-api-go-pinniped-dev-generated-1-19-apis-supervisor-config-v1alpha1-federationdomain). The
service certificate `Secret` must be of type `kubernetes.io/tls`. The CA bundle for this serving serving certificate `Secret` must be of type `kubernetes.io/tls`.
The CA bundle for this serving
certificate is assumed to be written, base64-encoded, to a file named certificate is assumed to be written, base64-encoded, to a file named
`/tmp/pinniped-supervisor-ca-bundle-base64-encoded.pem`. `/tmp/pinniped-supervisor-ca-bundle-base64-encoded.pem`.
@ -107,7 +107,7 @@ to authenticate federated identities from the Supervisor
```bash ```bash
kubectl create secret generic my-oidc-identity-provider-client \ kubectl create secret generic my-oidc-identity-provider-client \
--context kind-pinniped-supervisor \ --context kind-pinniped-supervisor \
--namespace local-user-authenticator \ --namespace pinniped-supervisor \
--type secrets.pinniped.dev/oidc-client \ --type secrets.pinniped.dev/oidc-client \
--from-literal=clientID=xxx \ --from-literal=clientID=xxx \
--from-literal=clientSecret=yyy --from-literal=clientSecret=yyy
@ -118,7 +118,8 @@ to authenticate federated identities from the Supervisor
object to configure the Pinniped Supervisor to federate identities from an upstream OIDC identity object to configure the Pinniped Supervisor to federate identities from an upstream OIDC identity
provider. provider.
This external OIDC identity provider is specific to this demo. Replace the `issuer` with your external identity provider's issuer and
adjust any other configuration on the spec.
```bash ```bash
cat <<EOF | kubectl create --context kind-pinniped-supervisor --namespace pinniped-supervisor -f - cat <<EOF | kubectl create --context kind-pinniped-supervisor --namespace pinniped-supervisor -f -
@ -127,9 +128,11 @@ to authenticate federated identities from the Supervisor
metadata: metadata:
name: my-oidc-identity-provider name: my-oidc-identity-provider
spec: spec:
issuer: https://dev-xxxxxx.okta.com/oauth2/default issuer: https://dev-zzz.okta.com/oauth2/default
claims: claims:
username: email username: email
authorizationConfig:
additionalScopes: ['email']
client: client:
secretName: my-oidc-identity-provider-client secretName: my-oidc-identity-provider-client
EOF EOF
@ -142,8 +145,8 @@ to authenticate federated identities from the Supervisor
pinniped_version=$(curl https://api.github.com/repos/vmware-tanzu/pinniped/releases/latest -s | jq .name -r) pinniped_version=$(curl https://api.github.com/repos/vmware-tanzu/pinniped/releases/latest -s | jq .name -r)
``` ```
Alternatively, [any release version](https://github.com/vmware-tanzu/pinniped/releases) Alternatively, you can manually select [any release version](https://github.com/vmware-tanzu/pinniped/releases)
you can manually select this version of Pinniped. of Pinniped.
```bash ```bash
# Example of manually choosing a release version... # Example of manually choosing a release version...
@ -191,12 +194,10 @@ to authenticate federated identities from the Supervisor
1. Move the Pinniped CLI binary to your preferred filename and directory. Add the executable bit, 1. Move the Pinniped CLI binary to your preferred filename and directory. Add the executable bit,
e.g. `chmod +x /usr/local/bin/pinniped`. e.g. `chmod +x /usr/local/bin/pinniped`.
1. Generate a kubeconfig for the current cluster. Use `--static-token` to include a token which should 1. Generate a kubeconfig for the current cluster.
allow you to authenticate as the user that you created above.
```bash ```bash
pinniped get kubeconfig \ pinniped get kubeconfig \
--context kind-pinniped-concierge \ --kubeconfig-context kind-pinniped-concierge \
--concierge-namespace pinniped-concierge \ --concierge-namespace pinniped-concierge \
> /tmp/pinniped-kubeconfig > /tmp/pinniped-kubeconfig
``` ```
@ -209,26 +210,27 @@ to authenticate federated identities from the Supervisor
Click Open to allow the command to proceed. Click Open to allow the command to proceed.
1. Try using the generated kubeconfig to issue arbitrary `kubectl` commands. The `pinniped` CLI will 1. Try using the generated kubeconfig to issue arbitrary `kubectl` commands. The `pinniped` CLI will
open a browser page on which can be used to login to the external OIDC identity provider configured earlier. open a browser page that can be used to login to the external OIDC identity provider configured earlier.
```bash ```bash
kubectl --context kind-pinniped-concierge --kubeconfig /tmp/pinniped-kubeconfig get pods -n pinniped-concierge kubectl --kubeconfig /tmp/pinniped-kubeconfig get pods -n pinniped-concierge
``` ```
Because this user has no RBAC permissions on this cluster, the previous command results in the Because this user has no RBAC permissions on this cluster, the previous command results in an
error `Error from server (Forbidden): pods is forbidden: User "xxx" cannot list resource "pods" error that is similar to
in API group "" in the namespace "pinniped"`, where `xxx` is the username that was used to login `Error from server (Forbidden): pods is forbidden: User "pinny" cannot list resource "pods"
in API group "" in the namespace "pinniped"`, where `pinny` is the username that was used to login
to the upstream OIDC identity provider. However, this does prove that you are authenticated and to the upstream OIDC identity provider. However, this does prove that you are authenticated and
acting as the `xxx` user. acting as the `pinny` user.
1. As the admin user, create RBAC rules for the test user to give them permissions to perform actions on the cluster. 1. As the admin user, create RBAC rules for the test user to give them permissions to perform actions on the cluster.
For example, grant the test user permission to view all cluster resources. For example, grant the test user permission to view all cluster resources.
```bash ```bash
kubectl create clusterrolebinding pinny-can-read --clusterrole view --user xxx kubectl --context kind-pinniped-concierge create clusterrolebinding pinny-can-read --clusterrole view --user pinny
``` ```
1. Use the generated kubeconfig to issue arbitrary `kubectl` commands as the `xxx` user. 1. Use the generated kubeconfig to issue arbitrary `kubectl` commands as the `pinny` user.
```bash ```bash
kubectl --kubeconfig /tmp/pinniped-kubeconfig get pods -n pinniped-concierge kubectl --kubeconfig /tmp/pinniped-kubeconfig get pods -n pinniped-concierge
@ -237,7 +239,7 @@ to authenticate federated identities from the Supervisor
The user has permission to list pods, so the command succeeds this time. The user has permission to list pods, so the command succeeds this time.
Pinniped has provided authentication into the cluster for your `kubectl` command! 🎉 Pinniped has provided authentication into the cluster for your `kubectl` command! 🎉
1. Carry on issuing as many `kubectl` commands as you'd like as the `xxx` user. 1. Carry on issuing as many `kubectl` commands as you'd like as the `pinny` user.
Each invocation will use Pinniped for authentication. Each invocation will use Pinniped for authentication.
You may find it convenient to set the `KUBECONFIG` environment variable rather than passing `--kubeconfig` to each invocation. You may find it convenient to set the `KUBECONFIG` environment variable rather than passing `--kubeconfig` to each invocation.

4
site/content/docs/concierge-only-demo.md
View File

@ -68,8 +68,8 @@ as the authenticator.
pinniped_version=$(curl https://api.github.com/repos/vmware-tanzu/pinniped/releases/latest -s | jq .name -r) pinniped_version=$(curl https://api.github.com/repos/vmware-tanzu/pinniped/releases/latest -s | jq .name -r)
``` ```
Alternatively, [any release version](https://github.com/vmware-tanzu/pinniped/releases) Alternatively, you can manually select [any release version](https://github.com/vmware-tanzu/pinniped/releases)
you can manually select this version of Pinniped. of Pinniped.
```bash ```bash
# Example of manually choosing a release version... # Example of manually choosing a release version...