diff --git a/README.md b/README.md index 6199fba..3d620fb 100644 --- a/README.md +++ b/README.md @@ -132,9 +132,9 @@ OIDC_ID= kubectl create secret -n kube-system generic skooner \ ---from-literal=url="$OIDC_URL" \ ---from-literal=id="$OIDC_ID" \ ---from-literal=secret="$OIDC_SECRET" +--from-literal=url=$OIDC_URL \ +--from-literal=id=$OIDC_ID \ +--from-literal=secret=$OIDC_SECRET kubectl apply -f https://raw.githubusercontent.com/skooner-k8s/skooner/master/kubernetes-skooner-oidc.yaml @@ -199,16 +199,21 @@ To run the client, open a new terminal tab and navigate to the `/client` directo ### Recommendation for keycloak configuration: -1. Set OIDC_URL to keycloak OpenId endpoint configuration page. - e.g. `OIDC_URL=https://{keycloak_domain}/realms/foo/.well-known/openid-configuration` - Also set `OIDC_CLIENT_ID` locally with `OIDC_CLIENT_ID={client_id}` (this is the same as `OIDC_ID`) -2. While creating secret, use correct var name and use skooner namespace (by default it's `kube-system`): +1. Set OIDC_URL to keycloak OpenId endpoint configuration page. +- `OIDC_URL=https://{keycloak_domain}/realms/foo/.well-known/openid-configuration` +- Also set `$OIDC_ID` locally with `OIDC_ID={client_id}` +- You can get `$OIDC_SECRET` from keycloak + - (You need to set the Client authentication toggle to be on, for older version of keycloaks you should switch access type to confidential ) + ![img.png](imgs/OIDC_keycloak_settings/img.png) + - ![img.png](imgs/OIDC_SECTET_img.png) + +2. While creating secret, use correct var name and use skooner namespace (by default it's `kube-system`): ``` kubectl create secret generic skooner \ ---from-literal=url="$OIDC_URL" \ ---from-literal=id="$OIDC_ID" \ ---from-literal=secret="$OIDC_SECRET" \ +--from-literal=url=$OIDC_URL \ +--from-literal=id=$OIDC_ID \ +--from-literal=secret=$OIDC_SECRET \ --namespace=kube-system ``` @@ -218,8 +223,15 @@ kubectl create secret generic skooner \ 4. Make sure skooner is running by checking `kubectl rollout status deploy/skooner --namespace=kube-system` If not, report error with logging in `kubectl describe pod skooner --namespace=kube-system` -5. visit skooner, check if login succeeded -6. If not, please report both client and server error. +5. [Optional] create an ingress for skooner, you can take `provision/keycloak/skooner-ingress.yaml` as an example + +6. visit skooner, check if login succeeded + +7. [Trouble Shooting] If the api call returns 403 with a message containing some error like: `User \"system:anonymous\" cannot list resource \"selfsubjectrulesreviews\" in API group \"authorization.k8s.io\" at the cluster scope"` + - it means you'll need a cluster role bond. You can take `provision/keycloak/skooner-oidc-patch.yaml` as an example + - @elieassi suggests create a serviceaccount separately, I feel like it's more secure but I hadn't test it out. See [this issue](https://github.com/skooner-k8s/skooner/issues/361) for more details + +8. If failed, please report both client and server error. Client error: check browser console and send a screenshot Server error: check logs by `kubectl logs deploy/skooner --namespace=kube-system` Note that `RequestError: connect ECONNREFUSED` may indicate a configuration issue rather than Skooner's issue. diff --git a/imgs/OIDC_SECTET_img.png b/imgs/OIDC_SECTET_img.png new file mode 100644 index 0000000..5cf3f5b Binary files /dev/null and b/imgs/OIDC_SECTET_img.png differ diff --git a/imgs/OIDC_keycloak_settings/img.png b/imgs/OIDC_keycloak_settings/img.png new file mode 100644 index 0000000..a9a0a9e Binary files /dev/null and b/imgs/OIDC_keycloak_settings/img.png differ diff --git a/provision/keycloak/keycloak-ingress.yaml b/provision/keycloak/keycloak-ingress.yaml new file mode 100644 index 0000000..ce8e40c --- /dev/null +++ b/provision/keycloak/keycloak-ingress.yaml @@ -0,0 +1,29 @@ +kind: Ingress +apiVersion: networking.k8s.io/v1 +metadata: + name: keycloak + namespace: default +spec: + ingressClassName: nginx + defaultBackend: + service: + name: keycloak + port: + number: 8080 + rules: + - + host: keycloak.192.168.64.11.nip.io + http: + paths: + - + path: / + backend: + service: + name: keycloak + port: + number: 8080 + pathType: ImplementationSpecific +status: + loadBalancer: + ingress: + - ip: 192.168.64.11 diff --git a/provision/keycloak/keycloak.yaml b/provision/keycloak/keycloak.yaml new file mode 100644 index 0000000..ac6b4b0 --- /dev/null +++ b/provision/keycloak/keycloak.yaml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Service +metadata: + name: keycloak + labels: + app: keycloak +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + selector: + app: keycloak + type: LoadBalancer +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: keycloak + labels: + app: keycloak +spec: + replicas: 1 + selector: + matchLabels: + app: keycloak + template: + metadata: + labels: + app: keycloak + spec: + containers: + - name: keycloak + image: quay.io/keycloak/keycloak:20.0.1 + args: ["start-dev"] + env: + - name: KEYCLOAK_ADMIN + value: "admin" + - name: KEYCLOAK_ADMIN_PASSWORD + value: "admin" + - name: KC_PROXY + value: "edge" + ports: + - name: http + containerPort: 8080 + readinessProbe: + httpGet: + path: /realms/master + port: 8080 \ No newline at end of file diff --git a/provision/keycloak/skooner-ingress.yaml b/provision/keycloak/skooner-ingress.yaml new file mode 100644 index 0000000..7cc16ad --- /dev/null +++ b/provision/keycloak/skooner-ingress.yaml @@ -0,0 +1,29 @@ +kind: Ingress +apiVersion: networking.k8s.io/v1 +metadata: + name: skooner + namespace: kube-system +spec: + ingressClassName: nginx + defaultBackend: + service: + name: skooner + port: + number: 4654 + rules: + - + host: skooner.192.168.64.11.nip.io + http: + paths: + - + path: / + backend: + service: + name: skooner + port: + number: 4654 + pathType: ImplementationSpecific +status: + loadBalancer: + ingress: + - ip: 192.168.64.11 diff --git a/provision/keycloak/skooner-oidc-patch.yaml b/provision/keycloak/skooner-oidc-patch.yaml new file mode 100644 index 0000000..fefdfa3 --- /dev/null +++ b/provision/keycloak/skooner-oidc-patch.yaml @@ -0,0 +1,30 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: anonymous-review-access + namespace: kube-system #whichever namespace you deployed skooner dashboard to +rules: + - apiGroups: + - authorization.k8s.io + resources: + - selfsubjectaccessreviews + - selfsubjectrulesreviews + verbs: + - create + - get + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: anonymous-review-access + namespace: kube-system #whichever namespace you deployed skooner dashboard to +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: anonymous-review-access +subjects: + - kind: User + name: system:anonymous + namespace: default \ No newline at end of file