search

OpenUnison / openunison-k8s-login-oidc

Kubernetes login portal for both kubectl and the dashboard using OpenID Connect. Use groups from your assertion in RBAC policies to control access to your cluster. Supports impersonation and OpenID Connect integration with your API server.
https://www.tremolosecurity.com/kubernetes/
Apache License 2.0
12 stars 5 forks source link

installing helm chart k8s-login-oidc results in error off of openunison_host #47

Closed matty1979 closed 3 years ago

matty1979 commented 3 years ago

Installed and used values.yaml

network:
  openunison_host: "ou.ou-test.runshiftup.local"
  dashboard_host: "dashboard.ou-test.runshiftup.local"
  api_server_host: "api.ou-test.runshiftup.local"
  session_inactivity_timeout_seconds: 900
  k8s_url: http://127.0.0.1:49202/856a8c21-4dad-48d9-b82a-c9ba7dab23cc
  createIngressCertificate: true
  ingress_type: nginx
  ingress_annotations:
    kubernetes.io/ingress.class: nginx
  force_redirect_to_tls: true
  ingress_certificate: ou-tls-certificate

Going to https://ou.ou-test.runshiftup.local:8443 redirects to https://ou.ou-test.runshiftup.local:8443/login/ldap

It should be redirecting to my keycloak installation for login. I don't know where it's getting this login/ldap from.

mlbiam commented 3 years ago

Going to https://ou.ou-test.runshiftup.local:8443 redirects to https://ou.ou-test.runshiftup.local:8443/login/ldap

this is an intermediate step that is generally invisible to the user. You're seeing it because the next redirect is hanging (probably to https://ou.ou-test.runshiftup.local/auth/oidc

It should be redirecting to my keycloak installation for login. I don't know where it's getting this login/ldap from.

You're likely hanging on trying to connect to https://ou.ou-test.runshiftup.local/auth/oidc, but because youre trying to connect on 8443 its hanging. One of our assumptions is that your load balancer is running on 443.

matty1979 commented 3 years ago

I'm asking my team why they set it up this way. Seeing though makes sense why it worked perfectly using an AWS ELB on 443 and not on this.

Thanks for that explanation

matty1979 commented 3 years ago

This is caused by a limitation on k3d not an issue with openunison