{"id":13547505,"url":"https://github.com/vmware-archive/gangway","last_synced_at":"2025-12-15T23:04:37.223Z","repository":{"id":48655799,"uuid":"110878354","full_name":"vmware-archive/gangway","owner":"vmware-archive","description":"An application that can be used to easily enable authentication flows via OIDC for a kubernetes cluster.","archived":true,"fork":false,"pushed_at":"2021-07-15T15:14:45.000Z","size":783,"stargazers_count":410,"open_issues_count":34,"forks_count":111,"subscribers_count":14,"default_branch":"master","last_synced_at":"2024-12-19T00:04:02.951Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vmware-archive.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-11-15T19:41:46.000Z","updated_at":"2024-11-15T01:38:01.000Z","dependencies_parsed_at":"2022-09-11T03:00:36.423Z","dependency_job_id":null,"html_url":"https://github.com/vmware-archive/gangway","commit_stats":null,"previous_names":["heptiolabs/gangway"],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmware-archive%2Fgangway","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmware-archive%2Fgangway/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmware-archive%2Fgangway/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmware-archive%2Fgangway/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vmware-archive","download_url":"https://codeload.github.com/vmware-archive/gangway/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246887734,"owners_count":20850135,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T12:00:57.232Z","updated_at":"2025-12-15T23:04:36.806Z","avatar_url":"https://github.com/vmware-archive.png","language":"Go","funding_links":[],"categories":["Go","others"],"sub_categories":[],"readme":"\ngangway\n[![Build Status](https://travis-ci.org/heptiolabs/gangway.svg?branch=master)](https://travis-ci.org/heptiolabs/gangway)\n=======\n\n# VMware has ended active development of this project, this repository will no longer be updated.\n\n_(noun): An opening in the bulwark of the ship to allow passengers to board or leave the ship._\n\nAn application that can be used to easily enable authentication flows via OIDC for a kubernetes cluster.\nKubernetes supports [OpenID Connect Tokens](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) as a way to identify users who access the cluster.\nGangway allows users to self-configure their `kubectl` configuration in a few short steps.\n\n![gangway screenshot](docs/images/screenshot.png)\n\n## Deployment\n\nInstructions for deploying gangway for common cloud providers can be found [here](docs/README.md).\n\n## How It Works\n\nKubernetes supports OpenID Connect (OIDC) as a user authentication mechanism. OIDC is an\nauthentication protocol that allows servers to verify the identity of a user by way of an ID Token.\n\nWhen using OIDC to authenticate with Kubernetes, the client (e.g. `kubectl`) sends the ID token\nalongside all requests to the API server. On the server side, the Kubernetes API server verifies the\ntoken to ensure it is valid and has not expired. Once verified, the API server extracts username and\ngroup membership information from the token, and continues processing the request.\n\nIn order to obtain the ID token, the user must go through the OIDC authentication process. This is\nwhere Gangway comes in. Gangway is a web application that enables the OIDC authentication flow which\nresults in the minting of the ID Token.\n\nGangway is configured as a client of an upstream Identity Service that speaks OIDC. To obtain the ID\ntoken, the user accesses Gangway, initiates the OIDC flow by clicking the \"Log In\" button, and\ncompletes the flow by authenticating with the upstream Identity Service. The user's credentials are\nnever shared with Gangway.\n\nOnce the authentication flow is complete, the user is redirected to a Gangway page that provides\ninstructions on how to configure `kubectl` to use the ID token.\n\nThe following sequence diagram details the authentication flow:\n\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"docs/images/gangway-sequence-diagram.png\" width=\"600px\" /\u003e\n\u003c/p\u003e\n\n## API-Server flags\n\ngangway requires that the Kubernetes API server is configured for OIDC:\n\nhttps://kubernetes.io/docs/admin/authentication/#configuring-the-api-server\n\n```bash\nkube-apiserver\n...\n--oidc-issuer-url=\"https://example.auth0.com/\"\n--oidc-client-id=3YM4ue8MoXgBkvCIHh00000000000\n--oidc-username-claim=email\n--oidc-groups-claim=groups\n```\n\n## Build\n\nRequirements for building\n\n- Go (built with version \u003e= 1.12)\n- [esc](https://github.com/mjibson/esc) for static resources.\n\nA Makefile is provided for building tasks. The options are as follows\n\nGetting started is as simple as:\n\n```bash\ngo get -u github.com/heptiolabs/gangway\ncd $GOPATH/src/github.com/heptiolabs/gangway\nmake setup\nmake\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvmware-archive%2Fgangway","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvmware-archive%2Fgangway","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvmware-archive%2Fgangway/lists"}