GitLab #EveryoneCanContribute cafe, 24 Feb 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: 18. #everyonecancontribute cafe: Kubernetes authentication and authorization

Description

Blog post on https://everyonecancontribute.com/

Kubernetes group repos: https://gitlab.com/everyonecancontribute/kubernetes

Twitter thread: https://twitter.com/dnsmichi/status/1364622431202213893

A

And we are live um back to more kubernetes, magic and stuff in our 18th. uh Everyone can contribute coffee, um and today, nicholas will dive into users permissions and much more. I think so. I will just hand it over to you.

B

Okay, um so I think we can start directly now don't r from our screen, um so.

C

B

Yeah, so we are known everyone number everyone can contribute number 18, so it's like our birthday, so also a little bit of 18 birthdays so that we can also talk about um getting promised and getting rights to do something. So it's the right point to get into this. So um today we want a little bit to speak about um arbor. So that means literally um that we need to look into two um important points, so the first point will be a little bit.

B

What the most people know is probably under the name authentication mostly if you read it in go or other systems, it's mostly only specified as often and if you, of course, if you have, if you are authenticated against the service, you want also probably authorized to do something. So this is the other step. So, instead of authentication, then we're talking about authorization and the short form would be else um so currently.

B

um Kubernetes in the past has different models to do the authorization part, but the authentication part was mostly um the same so for that um we will look at first into the identification part how it can authenticate as a user and afterwards we're looking more into the um row based axis in the model so on the authorization part so which access do. I have to um get directly into the api so before that, um no not before we can deeply dive back into our system.

B

So much max was so great that he um provided me with cluster shared with me, the config um so currently I'm uh as the same user, um and so we can first check. Currently. I hope it's big enough right, so everyone can reach the screen or should I make it smaller.

A

I think it's per it's. It's perfect! Okay,.

B

um Yeah so first we can check and very uh I can connect to it communities cluster. So everything is in place. Most important um point is here so that we can see the control plane, at least- um and this is currently where we're connecting against each other. So for that now, because I don't want to use the um the same.

B

uh um Yeah, so really, this um is the same configuration from last time, so we see here the demo. We don't care about the nicolas user. I will come related to that. We have our cluster, so we have the namespace and the user. Now what we want to do. I don't want to log in with the standard user, so I want to create my own user also that at least I can give michael, also a configuration or someone else. It can also use our cluster. These alternate access to the cluster.

B

So for that there are multiple ways to do that. um Currently, the most common are when I look into this is mostly um the first would be tls, so I have a private key and it gets in certificate, and these are my credentials to authenticate against the cluster.

B

So um if you are running on the managed to wear needles, for example, on rks um eks or kikai, mostly there's another concept used for the authentication, um I will move it there, it's a little bit finer um so for that most people use um another approach and that would be open id so in terms of identity. Br token, literally, this is for authentication for idiot bureau token, mostly called used the protocol for that or the data format for that it's jot.

B

So data ability- and this can be also used but cool part about this- that um currently all the requests go into the api server so and our api server is um capable to do multiple authentication models. So it means when you choose to use ts certificates for authenticating your users.

B

You aren't- um and you want later to add open id to that it's possible, so you can use twice, authentication layers or you can use three in terms of so that you have multiple authentication methods in your 20, most um reason when you go into production or when you want to use it in the day two or day three operations, really, you should use opm id, but we will come later to the point why you should use this instead of theater certificates, but for understanding. I think ts is a great way and also otherwise.

B

We need to dig a little bit into the gis j3s server and check how it works there. So for that um we will come back. Okay, so luckily, um let's create a user so for creating a user or creating um creating um creating the user for the control plane. um First, what we need, of course, is um a username. So probably I will use my same username, so I will use nicolas and we need a special one later with group, so I told everyone to contribute.

B

We will come later to the very so we need that and for that I have prepared a document. Also um sorry, I can find this okay good and move this also outside okay, it's fine! So, first of all, um because we are talking about certificates, most libraries that is known as openssl, so that you can generate a little uh private key first of all, so we will start and creating our privacy.

B

um If any questions you can ask besides that, so I can explain and also um do something um yeah. So in the next step um now we have literally on our system. We have a private key.

B

You can see here, so this shouldn't be shared to anyone. It should be only local on your system. Please don't share it because I generated only once um it's fine for testing purpose um and afterwards now we have a key. We need to um identify the um the um variety of history so for that we need to have a certificate that can someone trust me that this is my property, so for that we need to create first specificate request, so it's also called assigning request.

B

So for that we're using again openssl- and hopefully it works again, um yeah truth. So now we have a new file, it's towards csr, so this will certificate signing requests here you can would see um all the dates for the certificate, and now we want to um so. What we want to achieve now is that our um application, or that or to beneath the servers because kubernetes for api services own certificate authority, so that means you can manage a lot of multiple private keys um with the certificates means to allow our certificate.

B

So that's the reason why we create now a new file um that is called um certificate, signing request and for that um we will use now the um key from our file and so on and we'll generate a new document. So, first of all, um we can look afterwards into the file, so when it's generated um we generate now assigning request identification. We need this service, and now we can also inspect that.

B

So when you type you can do the you can do the full kind or doing the short handle like uh next um last time um reported so that you can also generate this. um So what we can see now here, I use the name literally. um This name will be used as the username afterwards, um which have it's ultimate to see the yamaha fun and literally, um we can also see here. We, um you can also see here the um username. What usage we want to use.

B

We want to use a client authentication really our chipset is declined. So that means that we also want to authenticate against that, and um so for that um we now need in the next step. We need to um approve this certificate request, so that means we're proving because, when we're going back into the files, so when we're checking with csr, you can see it's currently in a bit condition pending.

B

So that means we are not allowed to use this, but someone needs to accept this and currently because we are luckily, we are on the point of that. We are system admin with our first user, so we can accept the certificate. So for that it's straightforward, um we can use tube ctrl certificate approve and um afterwards um we have nowhere proof. So we can check now the csiden and now it means so that it's approved and the certificate was generated.

B

So that means the true: we have no certificate, and now we need to fetch the sign certificate. So for that um we can use, we can check for csi, then um and type in class.

B

And luckily now, when we're checking the status field, so every um demo file in juventus has this bait and the status field and the status are mostly updates of the item. So that means um that we now need to fetch this certificate. As we remember, okay, all the credentials are encoded in basic c4. So that means we need also decrypt that and then we get the final certificate. So for that I wrote a shorthander literally so that we can use this um now, I'm fetching the certificate, and now, when I check this, it's 549.

B

And which takes the thing yeah true, um you can see the whole certificate literally.

B

And now um you can see here is the user group name the um the common name, and you should also see the issue. Let me check where, like something.

D

B

Let's issue uh yeah yeah: you see it here right so um really um have your issues, so that means it's from the ks3s server. It's from our control plane. Now we have a valid certificate to sort to the um certificate of solution um yeah. So that means um we have now everything in place. We can use these certificates to authenticate against virtually service. So now, let's do it. So luckily um it's a little bit um straightforward, so I will set up my.

B

um I will set up my um cube config to a separate one, because my default config is a bit different. You have lots of options to do that. So when it's supporting the two config variables, you can also set this so um for that point um we now need to update our credentials.

B

So literally, what we do here is um that we will create a new user in youtube in the chase 3stmo file. So when we checking this is a terminal.

B

B

So we can first of all what we did is here now to um to create the new user. This is currently the data of the plant certificate date um and also video, so here's also for private use. It's also a reason why you shouldn't share um these fights around the world, um because someone can get access to that so for that um we now need to set um next to the credentials we can set up our contacts.

B

So, for that reason I have no electronics code. Needless and laterally. um We now want to use this context in terms of because last time also much explained that we can use um cuba ctx for that. So probably I can also use this. um So that means we have a normal um js3s user. So, for example, when we're now typing into the namespace and the same um so we have the default namespace and when we type duplicate our pots, we see the pots.

B

Now I will switch to my user, um it's called nebulas and when I type tubes together pots, oh we got an error. um So now you see the first concept that we currently finished. So what we finished right now was um the authentication so yeah I'm allowed to um authenticate against it. So when I type tube ctl cluster info, I should see it's working. Oh it's also not a lot, no okay! So now we need to fix this part really. So what we did now. We um finished mostly the authentication parts.

B

So we finished the authentication um they set up a privately approved identifier, api server and I'm now able to use this. But now I need to have rights to do um to execute commands at the end. So now traps are better in place mostly, um so for that um we can go into the documents.

B

I hope. So there were no. Let me check um yeah cool, um so what we need to do now is so that we give our user on the permissions, and for that um we have.

B

um We have really um a new concept, so now we will introduce a new um a new um type, so it's called cluster binding, and this allows us to get permissions to something, and mostly we will create this in first place so, and I already spent afterwards so first, because our current username class doesn't have any permissions.

B

I need to switch back to my admin user and I will um add this cluster raw binding. Another explain afterwards for what the cluster row binding literally, is um so cool, because the robot is there.

B

So now, when we checking it, um you can see that we have our. Everyone can contribute viewbinding. So when I now switch back into the username class and, for example, type the same command that I did before, for example, cubectl reports you can now see, I don't get an error anymore. I did only no resource font namespace, so that means we have now the authenticate part, soft and auto reauthorization. So I'm allowed to start some commands. It's like true.

B

Now we are in a more in a true way so, uh but now check where it was so. I will go back into the case with into the admin account. um Is there a shorthand for customer binding three letters or something right, because crb doesn't work?

B

I don't like to type everything um so when we're now changing this.

B

Down to they are not important. So literally, what we have here is like the row reference, so that means a cluster role and currently all the subjects. So all people or all persons are currently or groups are allowed to do this. So roughly because I created the everyone can contribute group, everyone, every user, where everyone can contribute group, can use the cluster role so and a role literally or cluster role.

B

When we look into this, it's a standard role, that's provided by um by humanities by itself, so it's mostly built in in every conformant. uh We need this cluster and there you can see a lot of commands and a lot of actions. So what you can see here here are now all the rules currently that our users are allowed to do all actions so because we are talking with kubernetes against an api server.

B

We have the same pattern literally, so it means we can allow all the um api groups, so it means from which version comes. So luckily, we can also see now that, in the view role um we have the serp manager, so I'm allowed to see certificates and then I'm allowed to start to see the uh certificate request issuers.

B

But, for example, if I want to check if I'm I'm also capable to start to get parts, but I'm probably when I check back into my user, because I have a rule, you view and check this back with, for example,.

B

For example, starting your port, an application you see also forbidden because with euro, we have only access to the api server that we can get only information about which we need this meta server, but while dating about all the objects that I currently allow to, but I'm not, for example, now to start a port so because this is a different verb, a different action that we need to do, and for that we will come later to the point where we also create this, um so that I'm also allowed to do that.

B

But I will come back into the point. Mostly. I draw a it into my prepared view that I've prepared already so literally, we have now seen um through our three items. Let me check one frame.

D

B

um Yeah, take this um so really what we did now is um we have our group developers in terms of our group was everyone. Everyone can contribute, so this was coming from the um from the certificate. So it's the organization unit. Now we created the role of the cluster role binding. That was called.

B

B

B

um So that we have here the view binding and the view binding is the connection um between between the role, the cluster role and the group of a user. So this we are having here currently three items to do the authorization. So that means this also we're mentioning white spot arbut and not um before that.

B

It was about so attribute based access control, but now we have outwards so we have roles, so roads can contain multiple rules or policies and we are getting the relationship between a cluster role or a juventus role by itself with a row binding so that this row binding knows which routes can be accessed to the following group or user yeah.

B

So coming back so now we talked a little bit about the concept of cluster role and cluster role binding. So for you asking why now currently, which view role we used before or not, and for that we have um currently default adjuster roads or default rods that you can use, and for that um I use the standard for euro. So I would also recommend to start first with the standard roads, and then you can extend it afterwards to your own.

B

If you need that um yeah so coming back, probably you want also to start a little bit um about um about now, starting your pot at least, and we're coming out to a new concept.

B

So, luckily, um now um let me check where my stuff is so now we need, instead of um so, what we want to do now is um we want to create a new namespace so literally, because we want don't want to use um the default namespace, we want to have our own namespace, so what we can do is proof stuff, so for that we creating on all namespaces that we call everyone can contribute, and now, when I'm.

B

Yeah now, when I um switching into that, um I will change the namespace.

B

B

um So we can check here, nothing's currently running so also the same with no roads there. We have nothing so for that um now um we were at a roll literally to the point, a new role binding so and now what we did is um when I go back now into my nexus user. I would come later to the um convention of that.

B

So, for example, when I start now here the airplane army airplane image to test it. It doesn't work so, but when I now switch into the everyone can contribute and start it there. It works so the main difference. What we didn't know was we don't use a rope. We don't use a cluster row binding. We used a row binding. So what's the difference between that cluster roles or everything with cluster prefix is about the whole kubernetes cluster, so it's placed in every namespace.

B

You can do everything in every namespace, but if you have only a row binding or role, it's only contained into a single namespace of kubernetes. So that means you can give. For example, you can have multiple namespaces or also multiple teams. Each team has our namespace and can do things that they want to, but without harm the others or adding new uh resources, or something like that and probably we cannot communicate outside because we don't have um network policies in place in the air crew.

B

We can now work as an owned developer with our own user, um and that's really true. So that's really the um authentication and authorization part about juventus. So, but now we are coming a little bit to the point.

B

What I wanted to point it out is now um probably when I switched back to my um ks k3s demo. um I, uh for example, we say: okay, I'm don't find anymore with use any class. I want to delete that so when we now.

B

Delete our sign-in request.

B

So now we delete century. Now, probably I switch back into the username class and start a new pod, because I don't just to or something on that you can see now what doesn't work with tls certificates, at least is you can still authenticate the transfer api server with trs?

B

You can't revoke the access, at least so the identification can't be revoked, so what we only can do is we could revolt the cluster roles and for cluster row bindings and also the role and raw bindings, but currently the user still acts uh has can still authenticate against the kubernetes servers.

B

The reason from that is because kubernetes doesn't put in place a certificate revocation, because it would be a tremendous amount of work to do that and that's very recommendation why you should use open id connect or some other tools to do that um for the authentication layer. So we can look a little bit into the part um where you can.

B

um Let me check where wrote it also on yeah.

B

um So roughly this is mine which says um yeah. So um really we have so you could also use a static file token um mostly, but it's what mostly recommend it's like the beer token, so it's the dot um place and also mostly an open id connect. So it means, like you, have lots of options with open id um and how open id is working. Currently, it's like a little bit different to that that you used before so.

B

For that um we can start first of all, as user error against your identity provider, so our identity provider could be, for example, github.com or it could be another server, for example, google, or something like that, so every user from root can login can get authenticates a density to a data source or you can also specify by the open id protocol.

B

You are also allowed to, for example, provide only a subset of open id users by the identity provider, for example, for everyone train contribute group can do that um afterwards for tube ctl, um chords um identity, it will be um added to the identity provider of the token and then in our tube config. We don't use tls certificates anymore. We use the spirit, tokens and then finally authentic hands. um It lands for api server, so the open id flow will be executed mostly and afterwards um the authorization part will be performed.

B

So that means which roads I have and so on, and then the user gets the final feedback um yeah. But for that uh we need now a little bit to decide if you want to do that or not because for that we need a little bit to hack, because we need to probably to um change the api server to um allow an identity provider, because this is not built in by dynamic or you can't change it by dynamically.

B

You can only determine by boot time by bootstrapping with cluster, or you can probably also fix it afterwards. It's also possible, but mostly it's like that. You should use this um when it's started yeah when you bootstrap your cluster. So but before we go into the opm saying um I would say that probably someone has questions or we should can talk a little bit about that. What you don't, if I probably can explain something for.

B

That no no one.

A

To be honest, I'd like to see what you're, showing currently.

B

Probably I can um uh marci to provide my key yeah.

A

Yes, I uploaded it on the server.

B

Okay, so let's check first, I need to check only which gif on this machine, so hopefully um that can hold it yeah, but I need to check on the machine that you're going to have for my massage okay, I don't. I don't show anymore right, yeah, it's fine!

B

B

I hope this was it.

B

Let me change: do you know the default user that we can use here?

B

Okay, I will check.

B

B

B

D

A

um What are you doing currently, maybe verbalize it.

B

Yeah, I'm currently I'm checking which key I have my machine to um check. If I can connect to the machine yeah. Okay, so that's fine! I need only to.

A

You're talking about ssh keys, right, yeah.

B

So, okay, I'm on the machine. So um now let's check um so hopefully.

B

D

B

To debug a little bit.

B

I don't know where it's placed.

B

Okay, so it will be a little bit more interesting than I thought I.

A

A

B

B

B

Here's the config and do we have probably static nodes there, no chair, how does it start it's 20 id right. I.

A

B

B

Too deep watch.

B

Press on df64.

B

A

You should also be able to run the k3s binary from opt, slash, opt k3s, and then I think it has sub commands to rj.

B

B

So, let's check uh-huh move first with president um now let me check.

B

I want to use those.

B

Specials I'll cheat what the third man can do for us.

A

A

B

Actually starts with server so.

B

For three ctr, so what I want to do right now is: um I want to check currently which container running, because I want to check you for api service running.

B

Oh, it's probably a different name space.

B

D

B

Okay, okay jsus works a little bit different than the normal upstream to see that so, let's check.

A

You you are looking for the api server port.

B

A

I think it's not running as a port. It's uh the k3s binary itself.

A

B

So let me check how this works really. Okay, coming back to a point, um so what I want to do now would be.

B

I want to um provide an identity broker really, so that means um dex will allow us to um connect to an open id identity provider. So um for that, my intention is really to use for that also gitlab, so that everyone from everyone can contribute group can um access slowly or to united states service and authenticate against it. So that would be the main idea mostly um for that. um Let me change if I wrote the stone because it noted there very cool um so for that there's some good point really.

B

What we need to do is um we need to um provide decks in which we need this cluster and also gangway. um Then we will be used later for the um iphone 84 for the users so that we can easily generate our optimized client um so yeah. Now we need to find out how we can um set the uh open id for the twenties api server. Otherwise our journeys api, so if it doesn't trust um the diplab and so then we can't authenticate against the servers.

B

So let me check how it works, trust it. My assumption was that um js3s um uses some static parts to do that, because it's a quite normal way. ah No, that's every single! What I'm looking.

B

B

It's I don't even know where right uh well for stuff total method of id connect to the sim floor.

B

Now now I'm gently stuck in a little bit if we cross okay.

B

Specify for that.

B

Now I need to check how to do that. Oops, sorry, um so, for that um is it possible, but you know it probably is that we can restart the ks3s. So yes,.

A

You can just restart it without any issues, but you can it's a systemd unit, so you can assist in the systemcta restart k3s.

B

Okay, yeah. I want.

A

It's a typo system.

A

B

B

And then we need to patch this.

A

I would say: yeah it's uh it's deployed by our ansible role, so it's just in edc, systemd system, k3s.

B

Now, probably it's let me check something. First,.

C

um Maybe we we can talk about what our static ports are, not dynamic. Plots in the meantime.

B

Or something yeah, we don't really need to teach you currently something what it is. It's cheaper to know so, okay um yeah, currently um by default. If you are using kubernetes, um so luckily we can explain it a little bit what is static and it's there's no difference between acetic or dynamic probabilities. So what you have typically in your um system, if you are deploying with um uh cheap iem or with other tools like mostly a lot of other tools, supports the same way it's like.

B

So what you can use is you have um a root path under your node, so a lot of it largely everything from kubernetes goes into um normal font, um girls um into etc. Kubernetes um yamaha.

C

B

Yeah yeah manifest will come later um so and for that, um when you put something into um adc- and it is manifest, um these yum, yum or manifest will be deployed automatically so and what you can do in the folder is. You can um create, for example, like.

B

My pot jammer and you can put this into um htc manifest and then by by automatically when the tuplet starts. So it's more it's a feature of a tubelet, so it's not like from the automatic unit service. um So that means that automatically this part will be automatically started and by default, if you're, using another installation method like tube idm, uh the api server, the att server every component or core component, but you beneath this will be deployed as a static manifest into these manifests and then will be executed dynamically by the tubeless.

B

So that's the reason why it's called static um manifests mostly or aesthetic parts, or you can put everything there. So it's like that you have for bootstrapping, so so that would be also coming to the theory that you can do um kubernetes without config management, if you're looking at it forwards, so because it could also write everything to containers into pots and something like that and then starting on bootstrap and automate all the stuff um yeah. So now, let's come back momentum, so I need to.

B

Check, okay, you can set it here so for that um it was an etc right. Systemd.

B

A

Yeah there should be a fire k3s, no.

A

Let me check we do this in the answer.

B

So now I need a little bit too. Okay, I'm not rude. What what's read only.

A

You can probably just write it anyway, with a w exclamation mark.

A

Yeah, you can still write to it.

B

Okay, um now we need to look back into the.

B

Into the commands that we need to use okay,.

B

I'll make some notes there, so it goes a bit faster. Do this, um and now I didn't knot it down right, but I noticed it down into the.

B

The mirror board already.

D

B

D

B

What we now use, um we use our own um operating issuer, so it means like we would deploy uh dates under often or we could just use sexy. It's like fine, and then um we need to affiliate strategies. We begin with afterwards or not.

B

So let me check something first,.

D

B

Objects on youtube server.

B

What is it today.

B

B

We can test this, so it's like, of course, I don't have to try that yeah. What did you plan on different? Let me.

B

D

B

Dragon badge.

B

Okay, I already produced first number, okay, so um normally we use um like last time uh we also use a head chart for that. So I prepared everything. So um actually you can um see here on the x configuration so um the access outsold hem chart and we can generate um the um configuration so in the um connection connect. This part is very connection to video clip, so date is only on proxies predictable with it for the japanese api server so that you can have multiple opm id connection services um yeah.

B

So let me check now: I'm going back.

B

That managed it where it was.

B

No leverage yeah, I know the.

B

Performance: okay,.

B

So when we hopefully deploy.

D

B

D

B

um Upgrade just.

B

B

B

Time upgrade so our release will be dates and we'll give a chart that sticks, and then we start with this.

B

There we go so.

B

uh Because ham doesn't create automatically the names with by default, so we created also the namespace before now deployment again.

B

B

Okay, so we need also to search for.

B

C

So maybe just fyi, um so you can do a ham. Upgrade minus minus, create measures. Namespace then, have me create the namespace.

B

Yep now it's in for autos this process.

B

um Now hopefully we have our dates in place.

B

And now we can check if it's available, so for that first we see a page, not font, or you would say: okay, the service is at least reachable because we're getting http 404 page not found, but um now we can also check if the service is working because we're using open id the sender protocol. You can also draw a well-known open id search, configuration yeah and they can currently see the whole um open id information about our server syllabus story.

B

Also open id um provides a sign based approach, so for that we have also the signing keys here so that you can also see that these keys will be used to sign the the jot token so because, when you're going to judge, um you um need also to sign the whole g, and for that it's the reason why um you've also jvtst um yeah. So we have no decks in place now. We need um to bootstrap our trivanity cluster to use that.

B

So. For that I need to find my notes. We wrote it down, but I didn't get the client any right yeah. So now we need to get client id. So, let's check into the secret and probably there we have the um that's config or let's check for docs objects. First.

B

Start is the same like um like the servers um yeah. We will skip it, we will see if it works or not. So, let's check if it works, um because we don't use also not ssl. We don't also need that.

B

B

And now we need everything in one command line. Wasn't really.

B

B

B

huh Just follow myself.

B

So, let's use this and connect them back to a.

B

B

So and now editing view.

B

D

B

We should repeat.

B

And hopefully we start.

B

And see how it works. Oh.

B

Currently, I don't see the commands, I don't because it's in a different c group.

A

You might have to run a systemctl daemon reload for it to reload the new systemd unit. No, the the service file wasn't updated. um I think you need to.

D

A

D

A

The file permissions are wrong. um It's a read: only file change it to six uh zero zero. Six, oh.

A

So vi did not: okay yeah execute it's not necessary, but now you can save it. um Okay,.

B

A

Because I think uh colon, w q and and exclamation marks don't work, you need to explicitly have permissions or pre-metric.

B

Route, I want you guys if you don't miss this answer.

B

A

And probably max max can immediately add that to the ncb roll yeah, you can do that.

A

Thanks um if it works.

A

Currently, uh trying to understand what we're doing now,.

B

Okay, so what we do now is because we have novadex service and our api server, so it can draw it like, hopefully afterwards, otherwise we do it next week. It's then I figured out how it works.

B

um So when we know starting with cube, ctrl restart jsvs.

B

D

A

B

Issue or if you're trying to disappear.

B

Together- oh probably, I missed something.

B

So we have the happy iso, we have sure.

D

B

Why is it right.

B

It's quite bitter now we need the command bank.

B

So what we internally missing is um that we missing the um all right, open, ready, connect, find id.

D

B

Let's project so.

B

I think the order of commands is not important. Let's do it this way.

B

Do I need to reload.

A

Yeah you need to you need to do the system demon reload again, because the service file changed on disk system. Ttl.

A

Team on reload bang and then restart the service. No.

B

Computer says no.

B

ah Okay, okay, then it's a different topic um yeah that will take a little bit more time.

A

It doesn't like http.

B

Yeah now we need to probably explain in high overview what we want to try to achieve. So I will draw a small diagram and then um we will fix it in the next week.

B

Hopefully, oh, we will fix it in the next video control to cross yeah. um So coming back to my mirrorboard, um so let me check with some players for that um yeah cool. So.

B

um So actually, this is our juvenile cluster. So um and now what we you know sometimes I know bringing this into pictures would be a fun try.

B

Well, this wouldn't know also much.

B

um Let me change so.

D

B

I will zoom back down so.

B

um So currently, what we have here is.

B

um All right, so we have um currently dates in our jubilees cluster and we have um our kubernetes api so so.

B

And what we're trying to achieve is um that we want to connect our api server literally um to.

B

To gitlab- and um I will change controllers a little bit, so it makes more sense so and for that case, what we need to do is because the api server doesn't can speak directly with gitlab as open id provider.

B

We need to tell the api server first in the first step, go to um go to dates, ask there for the user and um afterwards dex will ask instead of um reduce, we'll ask the clip for the final user so that I can authenticate against it so and currently, as user as person. What we are doing is, we are only speaking mostly with um just another.

B

um We will speak only with the um with the api, so so we don't know that dex is there that we don't know that git club is there literally. We know only that we want to authenticate and um against gitlab, and so for that we have the user with internal ctl, and for that um we do this flow. So really our identity, identity provider is um okay, is a skid lab.

B

So it's called the idp.

B

And we want to authenticate and then stick clap with that, so that we can use this user with a beer token instead of tls. But for that because it's a security protocol, it's an authentication protocol. It requires security, for that it shouldn't be good that we speak http over that we draw them probably using information to delete over the internet. That's also the reason why we need to um speak this in some secure ways.

B

So for that we need to do only https ports here, https and also here https, and for that we need to leverage the next week. We need to leverage text with an external uh with the um server manager, so the textual speech https, because then this can also be verified, um and then we are have the option to um use all the users there to um authenticate against that, and mostly we can also the true part about this is when we open between the text documentation.

B

We can also specify like before that we specify our everyone can contribute group. We can also do this in gitlab, so we can say use only the group of gitlab. Only everyone can contribute so that we also restricting the scope, who has also access to that, um and then we can do the same albert again.

B

So that would be the outcome of next week. I would say if everyone is fine with that or probably then we need to um take at least an hour. I would say to serve all the stuff.

A

I think that's a great idea. um The the thing which I need, or probably others also would appreciate a recap what we did today, because I think there were many not next week then um so we do a little recap what we did and and then we were aiming to uh fix the https.

B

Yeah, I can start with a short video. What we did today and mostly I repeated the next week so already what we did is. We did the authentication part, but we did this only with a tls certificate so with a private key in terms of instead of a real username. So we don't use an external user and we did for authorization part with airbag.

B

So this is airborne really and um we created different authorizations models, so we used a row binding to get access, for example, for our developers group in the um everyone can contribute namespace and also the same for the cluster role, so that also our admin has general access to the cluster yeah. Mostly next week we were focusing on the authentication part of open id with k3s yeah.

B

That will be mostly next weekend.

A

Yeah: okay: okay! Are there any other questions from the group.

B

Was it too fast? Was it too.

A

B

Too much okay, not too much. It was a lot of to capture yeah, but um we repeat it next week in the first five ten minutes and then going back into the openid topic.

A

And we also have the recording in the live stream to like scroll two times fast. Now um the blog post will be ready soon and probably um yep.

A

I I'm a little overloaded myself right now, but I think next week will be fine. So thanks a lot for for preparations and all the nice things.

B

I can also write to the blog post. I can also give you all my commands, because it's written in martha it can easily copy paste. It.

A

Okay yeah. I will update the much request which I'm working on currently and then uh assign you.

B

Just by adding it to the repository there and it replaced, it's also fun.

A

Yeah, we'll we'll try it out in our new discord channel.

B

A

Okay, then we'll say bye, bye to.