paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 37 Packages Projects Releases Wiki Activity

docs: Add section for Kuberentes plugin Auth

Browse Source 
Signed-off-by: Carlos Esteban Lopez <lcarlosesteb@vmware.com>
This commit is contained in:
Carlos Esteban Lopez
2022-08-29 13:43:40 -05:00
parent 0037c3941d
commit 0058d27517
4 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/kubernetes/authentication.md
+26
View File
@@ -0,0 +1,26 @@
---
id: kubernetes-auth
title: Kubernetes Authentication
description: Authentication in kubernetes plugin
---
The authentication process in kubernetes is basically separate from backstage auth, the
providers are configured so your kubernetes plugin can locate and access the clusters you
have access to, the providers currently available are categorized in server side auth and
client side auth, here's the list:
## Server Side Providers
These providers authenticate your application with the clusters, meaning anyone that is
logged in into your backstage app will be able to access the same clusters, the providers
available as server side are `serviceAccount`, `googleServiceAccount`, `aws`, `azure`
and `localKubectlProxy`.
## Client Side Providers
These providers authenticate your user with the cluster, each user will be requested for
credentials and will have access to the clusters as long as the user has been authorized
to access said cluster, if the cluster is listed in the `clusterLocatorMethods` in the
config, but the user hasn't been authorized to access, the user will see the cluster
listed but will not see any resources in the plugin page for that cluster, and the error
will show as `401` or similar, current providers available are `google` and `oidc`.
docs/features/kubernetes/configuration.md
+3
View File
@@ -110,6 +110,8 @@ cluster. Valid values are:
| `azure` | This will use [Azure Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to access resources in clusters |
| `oidc` | This will use [Oidc Tokens](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) to authenticate to the Kubernetes API. When this is used the `oidcTokenProvider` field should also be set. |
Check the [Kubernetes Authentication][4] section for additional explanation.
##### `clusters.\*.skipTLSVerify`
This determines whether the Kubernetes client verifies the TLS certificate
@@ -477,3 +479,4 @@ for more info.
[1]: https://cloud.google.com/kubernetes-engine
[2]: https://cloud.google.com/docs/authentication/production#linux-or-macos
[3]: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/
[4]: https://https://backstage.io/docs/features/kubernetes/authentication