From 0df43e589392b4e6860047221c0d44a51a9dd3f5 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Wed, 7 Sep 2022 18:08:29 -0500 Subject: [PATCH 1/7] docs: Add kubernetes azure auth provider section Signed-off-by: Carlos Esteban Lopez --- docs/features/kubernetes/authentication.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index 7669d967ed..baa921e4fa 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -28,6 +28,28 @@ The providers available as server side are: - `localKubectlProxy` - `serviceAccount` +### Azure + +The Azure server side authentication provider works by authenticating on the server with +the Azure CLI `az login`, meaning any user that can access the backstage app will have +the same level of access to the cluster in the Kubernetes plugin, to put an example, even +guest users would have access to the cluster resources. + +```yaml +kubernetes: + clusterLocatorMethods: + - type: 'config' + clusters: + - name: Random cluster name in backstage + url: ${AZURE_CLUSTER_API_SERVER_ADDRESS} + authProvider: azure + skipTLSVerify: true +``` + +To get the API server address for your Azure cluster, go to the Azure console page for the +cluster resource, go to `Overview` > `Properties` tab > `Networking` section and copy paste +the API server address directly in that `url` field. + ## Client Side Providers These providers authenticate your _user_ with the cluster. Each Backstage user will be From d12ebdde778598ab3f980653842f44ab6c66db3d Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Jaramillo Date: Fri, 9 Sep 2022 12:23:46 -0500 Subject: [PATCH 2/7] Update docs/features/kubernetes/authentication.md Co-authored-by: Jamie Klassen Signed-off-by: Carlos Esteban Lopez Jaramillo --- docs/features/kubernetes/authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index baa921e4fa..b342a6892c 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -40,7 +40,7 @@ kubernetes: clusterLocatorMethods: - type: 'config' clusters: - - name: Random cluster name in backstage + - name: My AKS cluster url: ${AZURE_CLUSTER_API_SERVER_ADDRESS} authProvider: azure skipTLSVerify: true From cc05706f351fb2b10305db8a52e791248639ec9e Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Mon, 12 Sep 2022 13:00:26 -0500 Subject: [PATCH 3/7] docs: Address MR comments Signed-off-by: Carlos Esteban Lopez --- docs/features/kubernetes/authentication.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index b342a6892c..c4d6fdda96 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -18,7 +18,9 @@ The providers currently available are divided into server side and client side. ## Server Side Providers These providers authenticate your _application_ with the cluster, meaning anyone that is -logged in into your backstage app will be granted the same access to Kubernetes objects. +logged in into your backstage app will be granted the same access to Kubernetes objects, +to put an example,even guest users would have access to the cluster resources, so be +careful of using server side providers with guest access enabled. The providers available as server side are: @@ -31,9 +33,13 @@ The providers available as server side are: ### Azure The Azure server side authentication provider works by authenticating on the server with -the Azure CLI `az login`, meaning any user that can access the backstage app will have -the same level of access to the cluster in the Kubernetes plugin, to put an example, even -guest users would have access to the cluster resources. +the Azure CLI, follow these steps: + +- Install the Azure CLI: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest +- Login with your Azure/Microsoft account with `az login` in the server's terminal +- Go to your AKS cluster's resource page in Azure Console and follow the steps in the + `Connect` tab to set the subscription and get your credentials for `kubectl` integration +- Configure your cluster to use the `azure` auth provider like this: ```yaml kubernetes: From f32117268f3cbc2c494d29111cdaaf372cf67021 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Mon, 12 Sep 2022 13:15:05 -0500 Subject: [PATCH 4/7] docs: Mention AKS AAD requirement Signed-off-by: Carlos Esteban Lopez --- docs/features/kubernetes/authentication.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index c4d6fdda96..67b4f49e8f 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -33,9 +33,10 @@ The providers available as server side are: ### Azure The Azure server side authentication provider works by authenticating on the server with -the Azure CLI, follow these steps: +the Azure CLI, please note that [Azure AD Authentication][1] is a requirement and has to +be enabled in your AKS cluster, then follow these steps: -- Install the Azure CLI: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest +- [Install the Azure CLI][2] - Login with your Azure/Microsoft account with `az login` in the server's terminal - Go to your AKS cluster's resource page in Azure Console and follow the steps in the `Connect` tab to set the subscription and get your credentials for `kubectl` integration @@ -69,3 +70,6 @@ The providers available as client side are: - `google` - `oidc` + +[1]: https://docs.microsoft.com/en-us/azure/aks/managed-aad +[2]: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest From 16f66c8a51e5e307cb379a11b72c22aa9c7f0f83 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Jaramillo Date: Tue, 20 Sep 2022 10:24:08 -0500 Subject: [PATCH 5/7] Update docs/features/kubernetes/authentication.md Co-authored-by: Patrik Oldsberg Signed-off-by: Carlos Esteban Lopez Jaramillo --- docs/features/kubernetes/authentication.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index 67b4f49e8f..2fe33bcb11 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -18,9 +18,7 @@ The providers currently available are divided into server side and client side. ## Server Side Providers These providers authenticate your _application_ with the cluster, meaning anyone that is -logged in into your backstage app will be granted the same access to Kubernetes objects, -to put an example,even guest users would have access to the cluster resources, so be -careful of using server side providers with guest access enabled. +logged in into your backstage app will be granted the same access to Kubernetes objects, including guest users. The providers available as server side are: From 92eb5690a9b4b7735962f4849f5f613b5bb325a2 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Tue, 20 Sep 2022 10:27:16 -0500 Subject: [PATCH 6/7] docs: Address MR comments Signed-off-by: Carlos Esteban Lopez --- docs/features/kubernetes/authentication.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index 2fe33bcb11..e4aaba5f33 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -34,10 +34,10 @@ The Azure server side authentication provider works by authenticating on the ser the Azure CLI, please note that [Azure AD Authentication][1] is a requirement and has to be enabled in your AKS cluster, then follow these steps: -- [Install the Azure CLI][2] -- Login with your Azure/Microsoft account with `az login` in the server's terminal +- [Install the Azure CLI][2] in the device where the backstage application will run. +- Login with your Azure/Microsoft account with `az login` in the server's terminal. - Go to your AKS cluster's resource page in Azure Console and follow the steps in the - `Connect` tab to set the subscription and get your credentials for `kubectl` integration + `Connect` tab to set the subscription and get your credentials for `kubectl` integration. - Configure your cluster to use the `azure` auth provider like this: ```yaml From 6ddfcd4d9db73fd9fad1e657c6f485a2767ea175 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Tue, 20 Sep 2022 23:54:53 +0200 Subject: [PATCH 7/7] Update docs/features/kubernetes/authentication.md Signed-off-by: Patrik Oldsberg --- docs/features/kubernetes/authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index e4aaba5f33..d44d3a4a64 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -34,7 +34,7 @@ The Azure server side authentication provider works by authenticating on the ser the Azure CLI, please note that [Azure AD Authentication][1] is a requirement and has to be enabled in your AKS cluster, then follow these steps: -- [Install the Azure CLI][2] in the device where the backstage application will run. +- [Install the Azure CLI][2] in the environment where the backstage application will run. - Login with your Azure/Microsoft account with `az login` in the server's terminal. - Go to your AKS cluster's resource page in Azure Console and follow the steps in the `Connect` tab to set the subscription and get your credentials for `kubectl` integration.