search

OpenUnison / openunison-k8s-login-oidc

Kubernetes login portal for both kubectl and the dashboard using OpenID Connect. Use groups from your assertion in RBAC policies to control access to your cluster. Supports impersonation and OpenID Connect integration with your API server.
https://www.tremolosecurity.com/kubernetes/
Apache License 2.0
12 stars 5 forks source link

Orchestra is pointing to IDP local host #13

Closed lalithvaka closed 4 years ago

lalithvaka commented 4 years ago

Configured it with google OIDC using the following config

OU_HOST=52.175.252.220 K8S_DASHBOARD_HOST=52.175.252.220 K8S_URL=https://52.175.252.220:6443 OU_CERT_OU=k8s OU_CERT_O=Tremolo Security OU_CERT_L=Alexandria OU_CERT_ST=Virginia OU_CERT_C=US USE_K8S_CM=true SESSION_INACTIVITY_TIMEOUT_SECONDS=900 OIDC_CLIENT_ID=844805839722-r54gbam9n33teelujcl6dghfpol18ucj.apps.googleusercontent.com OIDC_IDP_AUTH_URL=https://accounts.google.com/o/oauth2/v2/auth OIDC_IDP_TOKEN_URL=https://oauth2.googleapis.com/token OIDC_IDP_LIMIT_DOMAIN=tremolosecurity-test.com

Orchestra logs are showing errors as following orchestra.log

Not sure if am configuring it right for testing with Google OIDC? And not able to get to my login page as well.

mlbiam commented 4 years ago

i'm sorry i missed this. You're not getting to your login page because you have OIDC_IDP_LIMIT_DOMAIN set to tremolosecurity-test.com. You also can't do this by IP. I'd suggest using nip.io for your OU_HOST and K8S_DASHBOARD.

Just released a helm based install that might be easier

mlbiam commented 4 years ago

closing for inactivity. feel free to reopen