{"id":13548758,"url":"https://github.com/ObjectifLibre/k8s-ldap","last_synced_at":"2025-04-02T21:32:14.365Z","repository":{"id":151891773,"uuid":"115627247","full_name":"ObjectifLibre/k8s-ldap","owner":"ObjectifLibre","description":"Kubernetes - LDAP authentication with Dex","archived":true,"fork":false,"pushed_at":"2019-04-29T18:35:52.000Z","size":32,"stargazers_count":60,"open_issues_count":1,"forks_count":59,"subscribers_count":9,"default_branch":"master","last_synced_at":"2024-11-03T17:40:26.685Z","etag":null,"topics":["coreos","dex","k8s","kubernetes","ldap","manifests"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ObjectifLibre.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2017-12-28T13:45:01.000Z","updated_at":"2024-04-22T14:06:44.000Z","dependencies_parsed_at":"2023-05-14T18:45:25.994Z","dependency_job_id":null,"html_url":"https://github.com/ObjectifLibre/k8s-ldap","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ObjectifLibre%2Fk8s-ldap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ObjectifLibre%2Fk8s-ldap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ObjectifLibre%2Fk8s-ldap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ObjectifLibre%2Fk8s-ldap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ObjectifLibre","download_url":"https://codeload.github.com/ObjectifLibre/k8s-ldap/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246895900,"owners_count":20851352,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["coreos","dex","k8s","kubernetes","ldap","manifests"],"created_at":"2024-08-01T12:01:14.135Z","updated_at":"2025-04-02T21:32:14.124Z","avatar_url":"https://github.com/ObjectifLibre.png","language":null,"funding_links":[],"categories":["Others"],"sub_categories":[],"readme":"# Kubernetes - LDAP authentication with Dex\n\n- [Kubernetes - LDAP authentication with Dex](#kubernetes---ldap-authentication-with-dex)\n  - [Docs](#docs)\n  - [Requirements](#requirements)\n  - [Helm chart](#helm-chart)\n  - [Login application](#login-application)\n  - [Dex](#dex)\n    - [CRD](#crd)\n    - [Deployment](#deployment)\n\n## Docs\n\nThis deployment follows Dex by CoreOS \u0026 Kubernetes Documentations:\n\n* [Kubernetes OIDC Doc](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens)\n* [Dex by CoreOS](https://github.com/coreos/dex)\n* [Login App](https://github.com/fydrah/loginapp)\n\n## Requirements\n\n* DNS entries:\n  * **dex.k8s.example.com** --\u003e Dex OIDC provider\n  * **login.k8s.example.com** --\u003e Custom Login Application\n\n* Kubernetes cluster available with the following requirements:\n  * RBAC enabled\n  * OIDC authentication enabled. API server configuration:\n    * **--oidc-issuer-url=https://dex.k8s.example.com/dex**: External Dex endpoint\n    * **--oidc-client-id=loginapp**: ID for our Login Application\n    * **--oidc-ca-file=/etc/kubernetes/ssl/letsencrypt.pem**: Letsencrypt CA file because we will use automatic certificate requests.\n    * **--oidc-username-claim=name**: Map to **nameAttr** Dex configuration. This will be used by Kubernetes RBAC to authorize users based on their name.\n    * **oidc-groups-claim=groups**: This will be used by Kubernetes RBAC to authorize users based on their groups.\n  * Ingress Controller available.\n  * Automatic certificate requests for Kubernetes (ex: https://github.com/jetstack/cert-manager)\n\n* An available LDAP server\n\n## Helm chart\n\nHelm chart is available [here](https://github.com/ObjectifLibre/kube-oidc).\n\n## Login application\n\n* Create the auth namespace:\n\n```shell\nkubectl create ns auth\n```\n\n* Create resources:\n\n```shell\n# CA (letsencrypt) configmap\nkubectl create -f ca-cm.yml\n# Login App configuration\nkubectl create -f loginapp-cm.yml\n# Login App Ingress and SVC\nkubectl create -f loginapp-ing-svc.yml\n# Login App Deployment\nkubectl create -f loginapp-deploy.yml\n```\n\nIt should fail because Dex is not deployed.\n\n## Dex\n\n### CRD\n\nWe will use Kubernetes Custom Resource Definitions (https://kubernetes.io/docs/concepts/api-extension/custom-resources/) as Dex storage backend.\n\n```shell\nkubectl create -f dex-crd.yml\n```\n\n### Deployment\n\n* Create Dex resources:\n\n```shell\n# Dex configuration\nkubectl create -f dex-cm.yml\n# Dex ingress and service\nkubectl create -f dex-ing-svc.yml\n# Dex deployment\nkubectl create -f dex-deploy.yml\n```\n\nNow it should work: try https://login.k8s.example.org, login and retrieve k8s configuration.\n\n```shell\nkubectl --token=token get pods -n auth\nError from server (Forbidden): pods is forbidden: User \"\u003coidc-issuer-url\u003e#\u003cname\u003e\" cannot list pods in the namespace \"auth\"\n```\n\nUser prefix can be updated with the **--oidc-username-prefix** apiserver option.\n\n* Create ClusterRoleBinding resource:\n```shell\nkubectl create -f crb-all-auth.yml\n```\n\nTry again:\n\n```shell\nkubectl --token=$token get po\nNAME                        READY     STATUS    RESTARTS   AGE\ndex-6f6568d499-m89z6        1/1       Running   0          7m\nloginapp-6474748f4b-gb5kb   1/1       Running   0          8m\nloginapp-6474748f4b-prq25   1/1       Running   0          8m\nloginapp-6474748f4b-vnvnb   1/1       Running   0          8m\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FObjectifLibre%2Fk8s-ldap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FObjectifLibre%2Fk8s-ldap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FObjectifLibre%2Fk8s-ldap/lists"}