mlbiam
commented
3 years ago For the excess log data - https://github.com/TremoloSecurity/OpenUnison/issues/533
I'm not seeing any issues with login on on-prem or EKS. Checking AKS now
Closed sharmavijay86 closed 3 years ago
mlbiam
commented
3 years ago For the excess log data - https://github.com/TremoloSecurity/OpenUnison/issues/533
I'm not seeing any issues with login on on-prem or EKS. Checking AKS now
mlbiam
commented
3 years ago What does your helm values.yaml look like?
sharmavijay86
commented
3 years ago Hi, This is my value.yaml.
network:
openunison_host: "k8sou.k8s.mylab.local"
dashboard_host: "k8sdb.k8s.mylab.local"
api_server_host: "k8smaster.mylab.local"
session_inactivity_timeout_seconds: 900
k8s_url: "https://k8smaster.mylab.local:6443"
createIngressCertificate: true
ingress_type: nginx
ingress_annotations:
kubernetes.io/ingress.class: nginx
cert-manager.io/cluster-issuer: letsencrypt
cert_template:
ou: "kubernetes"
o: "MyOrg"
l: "aks cluster inc"
st: "Maharashtra"
c: "IN"
image: "docker.io/tremolosecurity/openunison-k8s-login-github:latest"
myvd_config_path: "WEB-INF/myvd.conf"
k8s_cluster_name: kubernetes
enable_impersonation: true
dashboard:
namespace: "kubernetes-dashboard"
cert_name: "kubernetes-dashboard-certs"
label: "k8s-app=kubernetes-dashboard"
service_name: kubernetes-dashboard
certs:
use_k8s_cm: false
trusted_certs: []
monitoring:
prometheus_service_account: system:serviceaccount:monitoring:prometheus-k8s
github:
client_id: 16a0xxxxxxxxxxxxxxx
teams: admin/
impersonation:
use_jetstack: false
jetstack_oidc_proxy_image: quay.io/jetstack/kube-oidc-proxy:v0.3.0
explicit_certificate_trust: true
ca_secret_name: ou-tls-secret
network_policies:
enabled: false
ingress:
enabled: true
labels:
app.kubernetes.io/name: ingress-nginx
monitoring:
enabled: true
labels:
app.kubernetes.io/name: monitoring
apiserver:
enabled: false
labels:
app.kubernetes.io/name: kube-system
services:
enable_tokenrequest: false
token_request_audience: api
token_request_expiration_seconds: 600
node_selectors: []
pullSecret: ""
openunison:
replicas: 1
non_secret_data: {}
secrets: []There are two items:
createIngressCertificate: true
You're using cert-manager to set your cert so this should be false, i don't think it's your root cause but it could cause issues
teams: admin/
The teams configuration option should be in the form of Organization/team. I think this is the root cause of your issue. Change it to be Organization/team and should work.
sharmavijay86
commented
3 years ago Thanks @mlbiam it is working. You were spot on. but kubectl now returns this-
error: You must be logged in to the server (Unauthorized)However i am running get po just after adding kubeconfig. RBAC also have done with.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: github-cluster-admins
subjects:
- kind: Group
name: myorg/myteam
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.iokubectl get ns --v=11?sharmavijay86
commented
3 years ago Dashboard works till login. Namespaces not displaying. bellow is the error log of orchestra pod. This is on AKS cluster and i am using impersonate kube-oidc-proxy. Values.yaml
network:
openunison_host: "k8sou.aks.xxxxx.site"
dashboard_host: "k8sdb.aks.xxxxxsite"
api_server_host: "myaksclust-myresourcegroup-xxxxxxxxxxxxx.hcp.eastus.azmk8s.io"
session_inactivity_timeout_seconds: 9000
k8s_url: "https://myaksclust-myresourcegroup-xxxxxxxxxxx.hcp.eastus.azmk8s.io:443"
createIngressCertificate: false
ingress_type: nginx
ingress_annotations:
kubernetes.io/ingress.class: nginx
cert-manager.io/cluster-issuer: letsencrypt
cert_template:
ou: "kubernetes"
o: "MyOrg"
l: "aks cluster inc"
st: "Maharashtra"
c: "IN"
image: "docker.io/tremolosecurity/openunison-k8s-login-github:latest"
myvd_config_path: "WEB-INF/myvd.conf"
k8s_cluster_name: myAKSCluster
enable_impersonation: true
dashboard:
namespace: "kubernetes-dashboard"
cert_name: "kubernetes-dashboard-certs"
label: "k8s-app=kubernetes-dashboard"
service_name: kubernetes-dashboard
certs:
use_k8s_cm: false
trusted_certs: []
monitoring:
prometheus_service_account: system:serviceaccount:monitoring:prometheus-k8s
github:
client_id: 16a0xxxxxxxxx
teams: cmyorg/k8sadmin
impersonation:
use_jetstack: true
jetstack_oidc_proxy_image: quay.io/jetstack/kube-oidc-proxy:v0.3.0
explicit_certificate_trust: false
ca_secret_name: ou-tls-secret
network_policies:
enabled: false
ingress:
enabled: true
labels:
app.kubernetes.io/name: ingress-nginx
monitoring:
enabled: true
labels:
app.kubernetes.io/name: monitoring
apiserver:
enabled: false
labels:
app.kubernetes.io/name: kube-system
services:
enable_tokenrequest: false
token_request_audience: api
token_request_expiration_seconds: 900
node_selectors: []
pullSecret: ""
openunison:
replicas: 1
non_secret_data: {}
secrets: []logs
[10.244.1.9] - [f567855fa72e2b021070274c4f0653a39b61aaf96]
[2021-04-22 15:40:50,211][XNIO-1 task-3] INFO AccessLog - [AzSuccess] - CheckAlive - https://127.0.0.1:8443/check_alive - uid=Anonymous,o=Tremolo -
[127.0.0.1] - [f3b1564d1d17141598eff52a3cfc98b6fe7a224a9]
[2021-04-22 15:40:50,365][XNIO-1 task-3] INFO AccessLog - [AzSuccess] - k8sIdp - https://127.0.0.1:8443/auth/idp/k8sIdp/.well-known/openid-configuration - uid=Anonymous,o=Tremolo - NONE [127.0.0.1] - [f99558d632e6026f0f56beb9a5f22bc71dc22b89e]
[2021-04-22 15:40:57,848][XNIO-1 task-3] INFO AccessLog - [AzSuccess] - ScaleCheckSession - https://k8sou.aks.mevijay.site/scale/sessioncheck - uid=Anonymous,o=Tremolo -
[10.244.1.9] - [f567855fa72e2b021070274c4f0653a39b61aaf96]
[2021-04-22 15:40:58,093][Thread-9] ERROR K8sWatcher - Could not get authentication token
javax.net.ssl.SSLException: Connection reset
at sun.security.ssl.Alert.createSSLException(Alert.java:127) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:349) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:292) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:287) ~[?:?]
at sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1581) ~[?:?]
at sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:979) ~[?:?]
at org.apache.http.impl.io.SessionInputBufferImpl.streamRead(SessionInputBufferImpl.java:137) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.impl.io.SessionInputBufferImpl.fillBuffer(SessionInputBufferImpl.java:153) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.impl.io.SessionInputBufferImpl.readLine(SessionInputBufferImpl.java:280) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.impl.io.ChunkedInputStream.getChunkSize(ChunkedInputStream.java:261) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.impl.io.ChunkedInputStream.nextChunk(ChunkedInputStream.java:222) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.impl.io.ChunkedInputStream.read(ChunkedInputStream.java:183) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.conn.EofSensorInputStream.read(EofSensorInputStream.java:135) ~[httpclient-4.5.9.jar:4.5.9]
at sun.nio.cs.StreamDecoder.readBytes(StreamDecoder.java:284) ~[?:?]
at sun.nio.cs.StreamDecoder.implRead(StreamDecoder.java:326) ~[?:?]
at sun.nio.cs.StreamDecoder.read(StreamDecoder.java:178) ~[?:?]
at java.io.InputStreamReader.read(InputStreamReader.java:181) ~[?:?]
at java.io.BufferedReader.fill(BufferedReader.java:161) ~[?:?]
at java.io.BufferedReader.readLine(BufferedReader.java:326) ~[?:?]
at java.io.BufferedReader.readLine(BufferedReader.java:392) ~[?:?]
at com.tremolosecurity.k8s.watch.K8sWatcher.run(K8sWatcher.java:205) [unison-applications-k8s-1.0.22.jar:?]
at java.lang.Thread.run(Thread.java:834) [?:?]
Suppressed: java.net.SocketException: Broken pipe (Write failed)
at java.net.SocketOutputStream.socketWrite0(Native Method) ~[?:?]
at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:110) ~[?:?]
at java.net.SocketOutputStream.write(SocketOutputStream.java:150) ~[?:?]
at sun.security.ssl.SSLSocketOutputRecord.encodeAlert(SSLSocketOutputRecord.java:81) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:380) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:292) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:287) ~[?:?]
at sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1581) ~[?:?]
at sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:979) ~[?:?]
at org.apache.http.impl.io.SessionInputBufferImpl.streamRead(SessionInputBufferImpl.java:137) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.impl.io.SessionInputBufferImpl.fillBuffer(SessionInputBufferImpl.java:153) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.impl.io.SessionInputBufferImpl.readLine(SessionInputBufferImpl.java:280) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.impl.io.ChunkedInputStream.getChunkSize(ChunkedInputStream.java:261) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.impl.io.ChunkedInputStream.nextChunk(ChunkedInputStream.java:222) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.impl.io.ChunkedInputStream.read(ChunkedInputStream.java:183) ~[httpcore-4.4.14.jar:4.4.14]
at org.apache.http.conn.EofSensorInputStream.read(EofSensorInputStream.java:135) ~[httpclient-4.5.9.jar:4.5.9]
at sun.nio.cs.StreamDecoder.readBytes(StreamDecoder.java:284) ~[?:?]
at sun.nio.cs.StreamDecoder.implRead(StreamDecoder.java:326) ~[?:?]
at sun.nio.cs.StreamDecoder.read(StreamDecoder.java:178) ~[?:?]
at java.io.InputStreamReader.read(InputStreamReader.java:181) ~[?:?]
at java.io.BufferedReader.fill(BufferedReader.java:161) ~[?:?]
at java.io.BufferedReader.readLine(BufferedReader.java:326) ~[?:?]
at java.io.BufferedReader.readLine(BufferedReader.java:392) ~[?:?]
at com.tremolosecurity.k8s.watch.K8sWatcher.run(K8sWatcher.java:205) [unison-applications-k8s-1.0.22.jar:?]
at java.lang.Thread.run(Thread.java:834) [?:?]
Caused by: java.net.SocketException: Connection reset
at java.net.SocketInputStream.read(SocketInputStream.java:186) ~[?:?]
at java.net.SocketInputStream.read(SocketInputStream.java:140) ~[?:?]
at sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:478) ~[?:?]
at sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:472) ~[?:?]
at sun.security.ssl.SSLSocketInputRecord.bytesInCompletePacket(SSLSocketInputRecord.java:70) ~[?:?]
at sun.security.ssl.SSLSocketImpl.readApplicationRecord(SSLSocketImpl.java:1354) ~[?:?]
at sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:963) ~[?:?]
... 16 more
[2021-04-22 15:41:00,235][XNIO-1 task-3] INFO AccessLog - [AzSuccess] - CheckAlive - https://127.0.0.1:8443/check_alive - uid=Anonymous,o=Tremolo -
[127.0.0.1] - [f6d91ec095701342477177e10ca05138c102b439f]
[2021-04-22 15:41:00,375][XNIO-1 task-3] INFO AccessLog - [AzSuccess] - k8sIdp - https://127.0.0.1:8443/auth/idp/k8sIdp/.well-known/openid-configuration - uid=Anonymous,o=Tremolo - NONE [127.0.0.1] - [f1624a01a4d2c91023e68144bcc8ccd059b35f7a1]sorry for the delay.
[2021-04-22 15:40:58,093][Thread-9] ERROR K8sWatcher - Could not get authentication token javax.net.ssl.SSLException: Connection reset
You can ignore this, we're going to make this less verbose. This is because AKS has a really short timeout but we recover from it. Looks much worse then it is
Dashboard works till login. Namespaces not displaying.
In the dashboard do you see an error in the upper right hand corner? Chances are it's an RBAC issue
I am configuring openunison-k8s-login-github with aks cluster. error which i am getting is after github auth it gives
Not Authorized You are not authorized for failed authentication. If you feel you received this message in error, please contact your system administrator or help desk.
logs shows --
INFO AccessLog - [AuFail] - scale - https://k8sou.k8s.mylab.local/auth/github - cn=none - enterprise_idp [10.46.0.10] - [f097ee9e1796de03b03aa128d091c5de4abe899c6] [2021-04-20 10:09:26,036][XNIO-1 task-3]