Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update the token-auth example for getting-started. #4772

Merged
merged 2 commits into from
May 25, 2022
Merged

Update the token-auth example for getting-started. #4772

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
89df18f
Update the token-auth example for getting-started.
absoludity May 24, 2022
b10d6f1
Update website use-cases also.
absoludity May 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions script/makefiles/cluster-kind.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
KUBE ?= ${HOME}/.kube
CLUSTER_NAME ?= kubeapps
ADDITIONAL_CLUSTER_NAME ?= kubeapps-additional
IMAGE ?= kindest/node:v1.24.0
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kind recommends using the very exact image tag for each Kind version. However, as we can change it just setting IMAGE is not a big deal. Perhaps this image also works out of the box.

https://github.com/kubernetes-sigs/kind/releases

New Node images have been built for kind v0.12.0, please use these exact images (IE like ....

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, I'll update to the exact image - easy to set in the Makefile and we can do what we like when we override (as I did to test out 1.21).


CLUSTER_CONFIG = ${KUBE}/kind-config-${CLUSTER_NAME}
ADDITIONAL_CLUSTER_CONFIG = ${KUBE}/kind-config-${ADDITIONAL_CLUSTER_NAME}
Expand All @@ -14,6 +15,7 @@ ADDITIONAL_CLUSTER_CONFIG = ${KUBE}/kind-config-${ADDITIONAL_CLUSTER_NAME}
# but is sufficient for the pod to be created so that we can copy the certs below.
${CLUSTER_CONFIG}:
kind create cluster \
--image ${IMAGE} \
--kubeconfig ${CLUSTER_CONFIG} \
--name ${CLUSTER_NAME} \
--config=./site/content/docs/latest/reference/manifests/kubeapps-local-dev-apiserver-config.yaml \
Expand Down
21 changes: 13 additions & 8 deletions site/content/docs/latest/tutorials/getting-started.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,16 @@ For any user-facing installation you should [configure an OAuth2/OIDC provider](
```bash
kubectl create --namespace default serviceaccount kubeapps-operator
kubectl create clusterrolebinding kubeapps-operator --clusterrole=cluster-admin --serviceaccount=default:kubeapps-operator
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
name: kubeapps-operator-token
namespace: default
annotations:
kubernetes.io/service-account.name: kubeapps-operator
type: kubernetes.io/service-account-token
EOF
```
Comment on lines +32 to 42
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given that we also have these instructions replictated in the website, I guess we would need to update this file as well: https://github.com/vmware-tanzu/kubeapps/blob/main/site/themes/template/layouts/partials/use-cases.html

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, I'll check the demo website once updated.


> **NOTE** It's not recommended to assign users the `cluster-admin` role for Kubeapps production usage. Please refer to the [Access Control](../howto/access-control.md) documentation to configure fine-grained access control for users.
Expand All @@ -38,7 +48,7 @@ To retrieve the token,
### On Linux/macOS

```bash
kubectl get --namespace default secret $(kubectl get --namespace default serviceaccount kubeapps-operator -o jsonpath='{range .secrets[*]}{.name}{"\n"}{end}' | grep kubeapps-operator-token) -o jsonpath='{.data.token}' -o go-template='{{.data.token | base64decode}}' && echo
kubectl get --namespace default secret kubeapps-operator-token -o jsonpath='{.data.token}' -o go-template='{{.data.token | base64decode}}' && echo
```

### On Windows
Expand All @@ -48,7 +58,7 @@ kubectl get --namespace default secret $(kubectl get --namespace default service
Open a Powershell terminal and run:

```powershell
[Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($(kubectl get --namespace default secret $(kubectl get --namespace default serviceaccount kubeapps-operator -o jsonpath='{.secrets[].name}') -o jsonpath='{.data.token}')))
[Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($(kubectl get --namespace default secret kubeapps-operator-token -o jsonpath='{.data.token}')))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll give it a try soon just to double-check it works

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It does work :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for checking the powershell :)

```

#### Using CMD
Expand All @@ -57,13 +67,8 @@ Create a file called `GetDashToken.cmd` with the following lines in it:

```bat
@ECHO OFF
REM Get the Service Account
kubectl get --namespace default serviceaccount kubeapps-operator -o jsonpath={.secrets[].name} > s.txt
SET /p ks=<s.txt
DEL s.txt

REM Get the Base64 encoded token
kubectl get --namespace default secret %ks% -o jsonpath={.data.token} > b64.txt
kubectl get --namespace default secret kubeapps-operator-token -o jsonpath={.data.token} > b64.txt

REM Decode The Token
DEL token.txt
Expand Down