Quick start:

You must add the following flags to your API server configuration (see Dex's documentation for more details):
```
# this should probably go in /etc/kubernetes/apiserver
KUBE_API_ARGS="...
--oidc-issuer-url=https://server.my-company.com:32000 \
--oidc-client-id=kubernetes \
--oidc-ca-file=/etc/kubernetes/pki/ca.crt \
--oidc-username-claim=email \
--oidc-groups-claim=groups"
```
where:
- /etc/kubernetes/pki/ca.crt is the CA certificate used by your API server.
- https://server.my-company.com:32000 is the issuer URL
- email is the nameAttr used we will specify in the LDAPConnector, so Kubernetes RBAC will use it for authorizing users based on their email.
Restart the API server

Load the Dex operator

kubectl apply -f https://raw.githubusercontent.com/kubic-project/dex-operator/master/deployments/dex-operator-full.yaml

Once the operator is running, create a DexConfiguration object like this:

# my-dex-config.yaml
apiVersion: kubic.opensuse.org/v1beta1
kind: DexConfiguration
metadata:
  labels:
    controller-tools.k8s.io: "1.0"
  name: dex-configuration
spec:
  nodePort: 32000
  adminGroup: Administrators
  names:
    - server.my-company.com
    # any extra names here will be added to the certificates

some important things:

the DexConfiguration name must be dex-configuration (otherwise it will be ignored).
the name and port in https://server.my-company.com:32000 must match an entry in the names and nodePort attributes.

then you can load it with kubectl apply -f my-dex-config.yaml.

Add some LDAP connectors like this:

# my-connector.yaml
apiVersion: kubic.opensuse.org/v1beta1
kind: LDAPConnector
metadata:
  labels:
    controller-tools.k8s.io: "1.0"
  name: external-ldap-server
spec:
  id: some-id
  name: ldap.suse.de
  server: "ldap.suse.de:389"
  user:
    baseDn: "ou=People,dc=infra,dc=caasp,dc=local"
    filter: "(objectClass=inetOrgPerson)"
    username: mail
    idAttr: DN
    emailAttr: mail
    nameAttr: cn
    group:
  group:
    baseDn: "ou=Groups,dc=infra,dc=caasp,dc=local"
    filter: "(objectClass=groupOfUniqueNames)"
    userAttr: DN
    nameAttr: cn
    groupAttr: uniqueMember

After loading the LDAPConnector with kubectl apply -f my-connector.yaml, a Dex Deployment should be launched automatically by the Dex operator:

$ kubectl get deployment --all-namespaces                                                                                                dex_controller ✱ ◼
NAMESPACE     NAME        DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
kube-system   coredns     2         2         2            2           7m
kube-system   kubic-dex   3         3         3            3           3m

You can check the current status of the DexConfiguration by "describing" it:

$ kubectl describe dexconfiguration main-configuration                                                                                   dex_controller ✱ ◼
Name:         main-configuration
Namespace:
Labels:       controller-tools.k8s.io=1.0
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"kubic.opensuse.org/v1beta1","kind":"DexConfiguration","metadata":{"annotations":{},"labels":{"controller-tools.k8s.io":"1.0"},"name":"ma...
API Version:  kubic.opensuse.org/v1beta1
Kind:         DexConfiguration
Metadata:
  Creation Timestamp:  2018-10-03T15:09:05Z
  Finalizers:
    dexconfiguration.finalizers.kubic.opensuse.org
  Generation:        1
  Resource Version:  760
  Self Link:         /apis/kubic.opensuse.org/v1beta1/dexconfigurations/main-configuration
  UID:               44fbd63e-c71e-11e8-ae07-847beb0267d4
Spec:
  Admin Group:  Administrators
  Certificate:
  Node Port:  32000
Status:
  Config:      kube-system/kubic-dex
  Deployment:  kube-system/kubic-dex
  Generated Certificate:
    Name:          kubic-dex-cert
    Namespace:     kube-system
  Num Connectors:  1
  Static Passwords:
    Kubic - Dex - Cli:
      Name:       kubic-dex-cli
      Namespace:  kube-system
    Kubic - Dex - Kubernetes:
      Name:       kubic-dex-kubernetes
      Namespace:  kube-system
    Kubic - Dex - Velum:
      Name:       kubic-dex-velum
      Namespace:  kube-system
Events:
  Type    Reason     Age   From           Message
  ----    ------     ----  ----           -------
  Normal  Checking   2m    DexController  ConfigMap 'kubic-dex' for 'main-configuration' has changed
  Normal  Checking   2m    DexController  Getting certificate 'kubic-dex-cert' for 'main-configuration'...
  Normal  Checking   2m    DexController  Deployment 'kubic-dex' for 'main-configuration' has changed
  Normal  Deploying  2m    DexController  Starting/updating Dex...
  Normal  Deploying  2m    DexController  Created 3 Secrets for shared passwords for 'main-configuration'
  Normal  Deploying  2m    DexController  Configmap 'kubic-dex' created for 'main-configuration'
  Normal  Deploying  2m    DexController  Deployment 'kubic-dex' created for 'main-configuration'

Dex will be dynamically reconfigured if you change any of these resources, so updating the LDAPConnector instance or adding a new connector would result in an update of the ConfigMap and a new Dex deployment, and removing all the connectors would mean that the Dex deployment would be stopped.

Configuration

The Dex operator can configure Dex automatically from a set of Custom Resources. From Dex's documentation:

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex acts as a portal to other identity providers through "connectors." This lets Dex defer authentication to LDAP servers, SAML providers, or established identity providers like GitHub, Google, and Active Directory. Clients write their authentication logic once to talk to Dex, then Dex handles the protocols for a given backend.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!