Use FreeIPA subCa to be the Kubernetes cluster external CA

OsgiliathEnterprise / platform

Platform to deploy an entire IS with all its Mail servers, CRMs, engineering suite, ...

https://osgiliathenterprise.github.io/platform/reference/toc.html

GNU Lesser General Public License v3.0

4 stars 5 forks source link

Use FreeIPA subCa to be the Kubernetes cluster external CA #72

Open Tcharl opened 3 years ago

Tcharl commented 3 years ago

Describe the Enhancement:

As expressed in the Kube PKI documentation, an external CA can be used instead of the kubeadm-generated one. This would help to integrate FreeIPA and Kube better, the ultimate goal being to have cluster admins and developpers authenticated via FreeIPA-generated certificates containing their Kubernetes roles in the 'O' section

Describe the Need:

Enhance security

Current Alternative

Using certs generated by Kubernetes CA, but it is not related to freeipa at all

Tcharl commented 1 year ago

End user reverse proxy: freeipa to generate kube admins/ops certificates, no additionnal CA to download but the frreipa one from an end user perspective Technical Added value: apiserver to be protected by reverse proxy instead of firewalld rule.