github/container.training
1
0
Fork 0
mirror of https://github.com/jpetazzo/container.training.git synced 2026-08-18 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #500 from bridgetkromhout/oscon2019

Browse Source 
Oscon2019
This commit is contained in:
Bridget Kromhout
2019-07-14 16:20:51 -05:00
committed by GitHub
parent ef64b83040 c401d28dad
commit 5ae94306e7
2 changed files with 2 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
slides/k8s/authn-authz-k8s201.md
+1 -10
View File
@@ -286,12 +286,9 @@ class: extra-details
API=$(kubectl config view -o \
jsonpath="{.clusters[?(@.name==\"$AKS_NAME\")].cluster.server}")
```
- Connect without the token:
- Connect without the token, then with the token::
```bash
curl -k $API
```
- Connect with the token:
```bash
curl -k -H "Authorization: Bearer $TOKEN" $API
```
@@ -303,18 +300,12 @@ class: extra-details
## Results
- In both cases, we will get a "Forbidden" error
- Without authentication, the user is `system:anonymous`
- With authentication, it is shown as `system:serviceaccount:default:default`
- The API "sees" us as a different user
- But neither user has any rights, so we can't do nothin'
- Let's change that!
---
## Authorization in Kubernetes
slides/shared/title.md
+1 -1
View File
@@ -11,7 +11,7 @@ class: title, in-person
@@TITLE@@<br/></br>
.footnote[
**Be kind to the WiFi!**<br/>
**Be kind to the WiFi!** (Network Name: OReillyCon19, Password: oscon2019)<br/>
<!-- *Use the 5G network.* -->
*Don't use your hotspot.*<br/>
*Don't stream videos or download big files during the workshop[.](https://www.youtube.com/watch?v=h16zyxiwDLY)*<br/>