paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 32 Packages Projects Releases Wiki Activity

docs: Improve authentication explanation for kubernetes plugin

Browse Source 
Signed-off-by: Carlos Esteban Lopez <lcarlosesteb@vmware.com>
This commit is contained in:
Carlos Esteban Lopez
2022-08-31 11:01:14 -05:00
parent 4f78263768
commit a0180e7889
1 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/kubernetes/authentication.md
+18 -10
View File
@@ -4,15 +4,22 @@ title: Kubernetes Authentication
description: Authentication in Kubernetes plugin
---
The authentication process in kubernetes is basically separate from backstage auth, the
providers are configured so your kubernetes plugin can locate and access the clusters you
have access to. The providers currently available are divided into server side and
client side.
The authentication process in Kubernetes relies on `KubernetesAuthProviders`, which are
not the same as the application's auth providers, the default providers are defined in
`plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.ts`, you can
add custom providers there if needed.
These providers are configured so your Kubernetes plugin can locate and access the
clusters you have access to, some of them have special requirements in the third party in
question, like Azure's Managed AAD subscription or Azure RBAC support active on the cluster.
The providers currently available are divided into server side and client side.
## Server Side Providers
These providers authenticate your _application_ with the cluster, meaning anyone that is
logged in into your backstage app will be granted the same access to Kubernetes objects.
The providers available as server side are:
- `aws`
@@ -23,12 +30,13 @@ The providers available as server side are:
## Client Side Providers
These providers authenticate your _user_ with the cluster. Each Backstage user will be prompted for
credentials and will have access to the clusters as long as the user has been authorized
to access said cluster. If the cluster is listed in the `clusterLocatorMethods` in the
config, but the user hasn't been authorized to access, the user will see the cluster
listed but will not see any resources in the plugin page for that cluster, and the error
will show as `401` or similar.
These providers authenticate your _user_ with the cluster. Each Backstage user will be
prompted for credentials and will have access to the clusters as long as the user has been
authorized to access said cluster. If the cluster is listed in the `clusterLocatorMethods`,
but the user hasn't been authorized to access, the user will see the cluster listed but
will not see any resources in the plugin page for that cluster, and the error will show
as `401` or similar.
The providers available as client side are:
- `google`