Configure Kaptain to use the Dex OIDC Provider on a Kommander management cluster for authentication.
Prerequisites
- A Kommander management cluster.
- A managed cluster, into which Kaptain will be installed.
- The managed cluster is attached to the management cluster (Kommander). (You will need to create a cluster via Kommander to have a managed Konvoy cluster.)
- A Dex Client created on the management cluster.
Kaptain configuration requirements
To use the Kommander Dex instance for authentication with Kaptain you will need to collect the following information:
- External OIDC provider endpoint from the management cluster
- External OIDC provider CA bundle (if necessary)
Create a Dex Client
To create the external Dex Client ID, run the following commands on the (Kommander) management cluster:
Create the Dex Client, noting the client id kaptain-authservice
for later use.
Create a Dex Client Secret
Generate a client secret, noting it for later use:
Example:
To create a Dex client secret, run the following command on the (Kommander) management cluster:
Get external OIDC provider endpoint and CA bundle
Get the management cluster’s OIDC provider endpoint as https://<management-cluster-url>/dex
(Optional) In case a custom CA is provided for Kommander certificate, to get the OIDC provider CA bundle, run the following command on the (Kommander) management cluster:
Install Kaptain
Create or update the ConfigMap with Kaptain’s configuration and include the following properties:
The resulting configuration file should look similar to the following:
See Install Kaptain for more info. To install Kaptain through the Kommander UI, copy and paste the configuration values from the previous section into the Kommander UI and deploy the Kaptain application.
Add the redirect URL to Kaptain authentication service in the management cluster
Once Kaptain is up, get the redirect URL from Kaptain’s authentication service by running the following command on the managed cluster:
On the management cluster, add the Redirect URL to the redirectURLs
list of the Dex Client’s resource:
Log in to Kaptain using the management cluster’s Dex instance
Refer to the Kaptain login section to access Kaptains’s Kubeflow dashboard.