From 0058d2751773dcee4079947528a16dc587627560 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Mon, 29 Aug 2022 13:43:40 -0500 Subject: [PATCH] docs: Add section for Kuberentes plugin Auth Signed-off-by: Carlos Esteban Lopez --- .changeset/few-nails-search.md | 5 +++++ docs/features/kubernetes/authentication.md | 26 ++++++++++++++++++++++ docs/features/kubernetes/configuration.md | 3 +++ mkdocs.yml | 1 + 4 files changed, 35 insertions(+) create mode 100644 .changeset/few-nails-search.md create mode 100644 docs/features/kubernetes/authentication.md diff --git a/.changeset/few-nails-search.md b/.changeset/few-nails-search.md new file mode 100644 index 0000000000..048e29867f --- /dev/null +++ b/.changeset/few-nails-search.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-kubernetes': patch +--- + +Add docs section for Kubernetes plugin Auth. diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md new file mode 100644 index 0000000000..c605e7479a --- /dev/null +++ b/docs/features/kubernetes/authentication.md @@ -0,0 +1,26 @@ +--- +id: kubernetes-auth +title: Kubernetes Authentication +description: Authentication in kubernetes plugin +--- + +The authentication process in kubernetes is basically separate from backstage auth, the +providers are configured so your kubernetes plugin can locate and access the clusters you +have access to, the providers currently available are categorized in server side auth and +client side auth, here's the list: + +## Server Side Providers + +These providers authenticate your application with the clusters, meaning anyone that is +logged in into your backstage app will be able to access the same clusters, the providers +available as server side are `serviceAccount`, `googleServiceAccount`, `aws`, `azure` +and `localKubectlProxy`. + +## Client Side Providers + +These providers authenticate your user with the cluster, each user will be requested for +credentials and will have access to the clusters as long as the user has been authorized +to access said cluster, if the cluster is listed in the `clusterLocatorMethods` in the +config, but the user hasn't been authorized to access, the user will see the cluster +listed but will not see any resources in the plugin page for that cluster, and the error +will show as `401` or similar, current providers available are `google` and `oidc`. diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index 04a04304f9..adef82696a 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -110,6 +110,8 @@ cluster. Valid values are: | `azure` | This will use [Azure Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to access resources in clusters | | `oidc` | This will use [Oidc Tokens](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) to authenticate to the Kubernetes API. When this is used the `oidcTokenProvider` field should also be set. | +Check the [Kubernetes Authentication][4] section for additional explanation. + ##### `clusters.\*.skipTLSVerify` This determines whether the Kubernetes client verifies the TLS certificate @@ -477,3 +479,4 @@ for more info. [1]: https://cloud.google.com/kubernetes-engine [2]: https://cloud.google.com/docs/authentication/production#linux-or-macos [3]: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/ +[4]: https://https://backstage.io/docs/features/kubernetes/authentication diff --git a/mkdocs.yml b/mkdocs.yml index e3bd86afdb..c9ad457634 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -55,6 +55,7 @@ nav: - Overview: 'features/kubernetes/index.md' - Installation: 'features/kubernetes/installation.md' - Configuration: 'features/kubernetes/configuration.md' + - Authentication: 'features/kubernetes/authentication.md' - Troubleshooting: 'features/kubernetes/troubleshooting.md' - Software Templates: - Overview: 'features/software-templates/index.md'