diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md new file mode 100644 index 0000000000..7669d967ed --- /dev/null +++ b/docs/features/kubernetes/authentication.md @@ -0,0 +1,43 @@ +--- +id: authentication +title: Kubernetes Authentication +description: Authentication in Kubernetes plugin +--- + +The authentication process in Kubernetes relies on `KubernetesAuthProviders`, which are +not the same as the application's auth providers, the default providers are defined in +`plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.ts`, you can +add custom providers there if needed. + +These providers are configured so your Kubernetes plugin can locate and access the +clusters you have access to, some of them have special requirements in the third party in +question, like Azure's Managed AAD subscription or Azure RBAC support active on the cluster. + +The providers currently available are divided into server side and client side. + +## Server Side Providers + +These providers authenticate your _application_ with the cluster, meaning anyone that is +logged in into your backstage app will be granted the same access to Kubernetes objects. + +The providers available as server side are: + +- `aws` +- `azure` +- `googleServiceAccount` +- `localKubectlProxy` +- `serviceAccount` + +## Client Side Providers + +These providers authenticate your _user_ with the cluster. Each Backstage user will be +prompted for credentials and will have access to the clusters as long as the user has been +authorized to access said cluster. If the cluster is listed in the `clusterLocatorMethods`, +but the user hasn't been authorized to access, the user will see the cluster listed but +will not see any resources in the plugin page for that cluster, and the error will show +as `401` or similar. + +The providers available as client side are: + +- `google` +- `oidc` diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index 04a04304f9..0adbec6a82 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -110,6 +110,8 @@ cluster. Valid values are: | `azure` | This will use [Azure Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to access resources in clusters | | `oidc` | This will use [Oidc Tokens](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) to authenticate to the Kubernetes API. When this is used the `oidcTokenProvider` field should also be set. | +Check the [Kubernetes Authentication][4] section for additional explanation. + ##### `clusters.\*.skipTLSVerify` This determines whether the Kubernetes client verifies the TLS certificate @@ -477,3 +479,4 @@ for more info. [1]: https://cloud.google.com/kubernetes-engine [2]: https://cloud.google.com/docs/authentication/production#linux-or-macos [3]: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/ +[4]: https://backstage.io/docs/features/kubernetes/authentication diff --git a/microsite/sidebars.json b/microsite/sidebars.json index 1c353ecdde..ba35f8b76b 100644 --- a/microsite/sidebars.json +++ b/microsite/sidebars.json @@ -81,6 +81,7 @@ "features/kubernetes/overview", "features/kubernetes/installation", "features/kubernetes/configuration", + "features/kubernetes/authentication", "features/kubernetes/troubleshooting" ] }, diff --git a/mkdocs.yml b/mkdocs.yml index 374eb0d954..7368602298 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -55,6 +55,7 @@ nav: - Overview: 'features/kubernetes/index.md' - Installation: 'features/kubernetes/installation.md' - Configuration: 'features/kubernetes/configuration.md' + - Authentication: 'features/kubernetes/authentication.md' - Troubleshooting: 'features/kubernetes/troubleshooting.md' - Software Templates: - Overview: 'features/software-templates/index.md'