@@ -40,10 +40,10 @@ subjectAltName = @alt_names
40
40
DNS.1 = dex.example.com
41
41
```
42
42
43
- Please replace dex.example.com to your favorit hostname.
43
+ Please replace dex.example.com to your favorite hostname.
44
44
Generate certificate and private key by following command.
45
45
46
- ```
46
+ ``` console
47
47
$ openssl req -new -x509 -sha256 -days 3650 -newkey rsa:4096 -extensions v3_req -out openid-ca.pem -keyout openid-key.pem -config req.cnf -subj " /CN=kube-ca" -nodes
48
48
$ ls openid*
49
49
openid-ca.pem openid-key.pem
@@ -53,7 +53,7 @@ openid-ca.pem openid-key.pem
53
53
54
54
Modify following host, bindDN and bindPW in examples/config-ad-kubelogin.yaml.
55
55
56
- ```
56
+ ``` yaml
57
57
connectors :
58
58
- type : ldap
59
59
name : OpenLDAP
@@ -99,27 +99,27 @@ See https://kubernetes.io/docs/reference/access-authn-authz/authentication/ for
99
99
100
100
Create context for dex authentication:
101
101
102
- ```
102
+ ``` console
103
103
$ kubectl config set-context oidc-ctx --cluster=cluster.local --user=test
104
- $ kubectl config set-credentials test
104
+ $ kubectl config set-credentials test \
105
105
--auth-provider=oidc \
106
106
--auth-provider-arg=idp-issuer-url=https://dex.example.com:32000/dex \
107
107
--auth-provider-arg=client-id=kubernetes \
108
108
--auth-provider-arg=client-secret=ZXhhbXBsZS1hcHAtc2VjcmV0 \
109
109
--auth-provider-arg=idp-certificate-authority-data=$(base64 -w 0 openid-ca.pem) \
110
- " --auth-provider-arg=extra-scopes=offline_access openid profile email group"
110
+ --auth-provider-arg=extra-scopes=" offline_access openid profile email group"
111
111
$ kubectl config use-context oidc-ctx
112
112
```
113
113
114
- Please confirm idp-issuer-url, cleint -id, client-secret and idp-certificate-authority-data value is same as config-ad-kubelogin.yaml's value.
114
+ Please confirm idp-issuer-url, client -id, client-secret and idp-certificate-authority-data value is same as config-ad-kubelogin.yaml's value.
115
115
116
116
Then run kubelogin:
117
117
118
- ```
118
+ ``` console
119
119
$ kubelogin
120
120
```
121
121
122
- Access
http://localhost:8000 by web browser and login with your AD account(eg.
[email protected] ) and password.
122
+ Access
http://localhost:8000 by web browser and login with your AD account
(eg.
[email protected] ) and password.
123
123
After login and grant, you have following token in ~ /.kube/config:
124
124
125
125
```
0 commit comments