VMware Pinniped Community Meeting, 25 Apr 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Pinniped KubeCon + CloudNativeCon Europe 2021 Demo

Description

Pinniped maintainer, Matt Moyer, shows a quick demo of the Pinniped concierge. Learn more about Pinniped at Pinniped.dev.

This demo is featured at the VMware virtual booth at KubeCon + CloudNativeCon Europe 2021.

A

Hi, my name is matt moyer and I'm one of the maintainers of peniped, which is an open source batteries included solution for kubernetes user authentication.

A

Today, I'm going to show a quick demo of the penipet concierge, which lets you easily configure authentication across any kubernetes clusters. I'm going to start by installing the pentapi concierge on each of these clusters using kubectl apply.

A

I have four clusters here. I have a vmware tonzu kubernetes grid, cluster or tkg cluster, a cluster from amazon's eks, a cluster from google's gke and a cluster from azure's aks, and today's demo is going to be performed identically across all of the clusters at the same time. So now that piniped is installed on the clusters, I'm going to configure a json web token or jwt authenticator.

A

This will configure pinpoint to validate these tokens and authenticate users, and today I'm going to be using azure ad, as my identity provider via another piniped component called the supervisor, but this could be any openid connect identity provider.

A

So if we look at the pinniped crd here, we can see that each of these clusters has a nearly identical configuration, but each has a unique audience value, and this is important for security.

A

I'm gonna go ahead and apply these crd configurations to the clusters, and now that that's done, uh the next thing we'll need to do is give myself some access on the cluster.

A

So once I've authenticated and logged in through azure id I'll need to give my azure ad user some permissions, which I can do by creating a cluster rule binding and then finally I'll use the pendiped command line tool to generate a coupe config that will use penfed to log into the clusters, and I can do that by running piniped, git, coop config and writing the output to a pentapid.yaml file.

A

Okay, so now that we've done that we can take a look at those cubeconfig files and we can see that they don't contain anything secret and they don't contain anything, that's user specific, which means it's really easy for me to share these coop config files. Out with my team. The coop config file is the same for everyone, so we can now uh switch to using that penpad-based cubeconfig by exporting the config environment variable and we should have access via pinniped.

A

So you can't see, but in another window I have a browser-based pop-up coming up to log me into azure id and now that that is finished, I see my uh each of my windows has completed and I have access via my azure id user. We can also use the pendiped cli to check that.

A

Oops- and so I can see that I'm authenticated on each of these clusters as my azure ad identity. So that's the demo. um This is just a part of what pinniped can do. Please visit piniped.dev to learn more or find us in kubernetes slack in the pinniped channel. We are a community driven project and welcome your suggestions and contributions. You can learn more about our bi-weekly community meetings on our website. Thank you.