From a0180e7889c1a6d593178051b5d0ce8c170bf689 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Wed, 31 Aug 2022 11:01:14 -0500 Subject: [PATCH] docs: Improve authentication explanation for kubernetes plugin Signed-off-by: Carlos Esteban Lopez --- docs/features/kubernetes/authentication.md | 28 ++++++++++++++-------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index 71d0d7b758..7669d967ed 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -4,15 +4,22 @@ title: Kubernetes Authentication description: Authentication in Kubernetes plugin --- -The authentication process in kubernetes is basically separate from backstage auth, the -providers are configured so your kubernetes plugin can locate and access the clusters you -have access to. The providers currently available are divided into server side and -client side. +The authentication process in Kubernetes relies on `KubernetesAuthProviders`, which are +not the same as the application's auth providers, the default providers are defined in +`plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.ts`, you can +add custom providers there if needed. + +These providers are configured so your Kubernetes plugin can locate and access the +clusters you have access to, some of them have special requirements in the third party in +question, like Azure's Managed AAD subscription or Azure RBAC support active on the cluster. + +The providers currently available are divided into server side and client side. ## Server Side Providers These providers authenticate your _application_ with the cluster, meaning anyone that is logged in into your backstage app will be granted the same access to Kubernetes objects. + The providers available as server side are: - `aws` @@ -23,12 +30,13 @@ The providers available as server side are: ## Client Side Providers -These providers authenticate your _user_ with the cluster. Each Backstage user will be prompted for -credentials and will have access to the clusters as long as the user has been authorized -to access said cluster. If the cluster is listed in the `clusterLocatorMethods` in the -config, but the user hasn't been authorized to access, the user will see the cluster -listed but will not see any resources in the plugin page for that cluster, and the error -will show as `401` or similar. +These providers authenticate your _user_ with the cluster. Each Backstage user will be +prompted for credentials and will have access to the clusters as long as the user has been +authorized to access said cluster. If the cluster is listed in the `clusterLocatorMethods`, +but the user hasn't been authorized to access, the user will see the cluster listed but +will not see any resources in the plugin page for that cluster, and the error will show +as `401` or similar. + The providers available as client side are: - `google`