From 7e4bffe0b835ab5b05ce751860653fb4d1289728 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Wed, 21 Sep 2022 14:53:57 -0500 Subject: [PATCH 1/2] docs: Add disclaimer about OIDC enabled clusters Signed-off-by: Carlos Esteban Lopez --- docs/features/kubernetes/configuration.md | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index 0adbec6a82..2fd3611bd6 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -101,14 +101,14 @@ array. Users will see this value in the Software Catalog Kubernetes plugin. This determines how the Kubernetes client authenticates with the Kubernetes cluster. Valid values are: -| Value | Description | -| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `serviceAccount` | This will use a Kubernetes [service account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) to access the Kubernetes API. When this is used the `serviceAccountToken` field should also be set. | -| `google` | This will use a user's Google auth token from the [Google auth plugin](https://backstage.io/docs/auth/) to access the Kubernetes API. | -| `aws` | This will use AWS credentials to access resources in EKS clusters | -| `googleServiceAccount` | This will use the Google Cloud service account credentials to access resources in clusters | -| `azure` | This will use [Azure Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to access resources in clusters | -| `oidc` | This will use [Oidc Tokens](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) to authenticate to the Kubernetes API. When this is used the `oidcTokenProvider` field should also be set. | +| Value | Description | +| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `serviceAccount` | This will use a Kubernetes [service account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) to access the Kubernetes API. When this is used the `serviceAccountToken` field should also be set. | +| `google` | This will use a user's Google auth token from the [Google auth plugin](https://backstage.io/docs/auth/) to access the Kubernetes API. | +| `aws` | This will use AWS credentials to access resources in EKS clusters | +| `googleServiceAccount` | This will use the Google Cloud service account credentials to access resources in clusters | +| `azure` | This will use [Azure Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to access resources in clusters | +| `oidc` | This will use [Oidc Tokens](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) to authenticate to the Kubernetes API. When this is used the `oidcTokenProvider` field should also be set. Please note the cluster must support OIDC, at the time of writing AKS clusters do not support OIDC. | Check the [Kubernetes Authentication][4] section for additional explanation. @@ -159,7 +159,12 @@ auth: audience: ${AUTH_OKTA_AUDIENCE} ``` -The following values are supported out-of-the-box by the frontend: `google`, `microsoft`, `okta`, `onelogin`. +The following values are supported out-of-the-box by the frontend: `google`, `microsoft`, +`okta`, `onelogin`. + +Take note that `oidcTokenProvider` is just the issuer for the token, you can use any +of these with an OIDC enabled cluster, like using `microsoft` as the issuer for a GKE +cluster. ##### `clusters.\*.dashboardUrl` (optional) From 9847aef033b26a9c9231021344c033a37e67ce36 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Wed, 21 Sep 2022 15:50:06 -0500 Subject: [PATCH 2/2] docs: Change GKE for EKS in oidcTokenProvider section Signed-off-by: Carlos Esteban Lopez --- docs/features/kubernetes/configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index 2fd3611bd6..235579ecdb 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -163,7 +163,7 @@ The following values are supported out-of-the-box by the frontend: `google`, `mi `okta`, `onelogin`. Take note that `oidcTokenProvider` is just the issuer for the token, you can use any -of these with an OIDC enabled cluster, like using `microsoft` as the issuer for a GKE +of these with an OIDC enabled cluster, like using `microsoft` as the issuer for a EKS cluster. ##### `clusters.\*.dashboardUrl` (optional)