essie-chiang
commented
11 months ago Create an HTPasswd identity provider for your cluster. Create two users ceadmin and cedev with a password of your choice. Assign the cluster-admin role to the ceadmin user. Assign the edit role to cedev user. Verify that you can login to the cluster as the users you created. What are the differences in between the roles? Remove the kubeadmin user.
GPT 帮忙生成的步骤
Create an HTPasswd Identity Provider:
In OpenShift, you can create an HTPasswd identity provider to manage users and passwords. You can create an HTPasswd identity provider by creating a secret with HTPasswd credentials and then referencing it in an OAuth configuration.
Here is a simplified example of creating an HTPasswd secret:
htpasswd -c -B -b /path/to/htpasswd-file ceadmin password1
htpasswd -b /path/to/htpasswd-file cedev password2
oc create secret generic htpass-secret --from-file=htpasswd=/path/to/htpasswd-fileYou will replace /path/to/htpasswd-file with the actual path to the HTPasswd file.
Assign Roles:
In OpenShift, you can assign roles to users at the project (namespace) level. The cluster-admin and edit roles can be assigned as follows:
To assign the cluster-admin role to the ceadmin user: oc adm policy add-cluster-role-to-user cluster-admin ceadmin
To assign the edit role to the cedev user:
oc adm policy add-role-to-user edit cedev
Verify User Login:
After creating the users and assigning roles, verify that you can log in to the cluster with the created users. You can use the oc login command to log in as a specific user:
oc login -u ceadmin -p password1
oc login -u cedev -p password2Verify that you have the expected permissions and can perform actions according to the assigned roles.
Remove kubeadmin User:
If you want to remove the kubeadmin user, you can disable it by revoking its permissions:
oc adm policy remove-cluster-role-from-user cluster-admin kubeadmin
After revoking its permissions, you can also delete the kubeadmin user:
oc delete user kubeadmin
However, be cautious when removing the kubeadmin user, as it's the default administrative user and should only be removed when you have alternative administrative accounts configured.
The differences between the roles are:
cluster-admin: Users with the cluster-admin role have full administrative access to the entire OpenShift cluster. They can perform all actions, including creating and managing projects and users.
edit: Users with the edit role have edit access to projects (namespaces) within the cluster. They can create, update, and delete resources within a project but do not have cluster-wide administrative privileges.Remember to follow best practices for user and role management in your OpenShift cluster to ensure secure and efficient operations.
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/authentication_and_authorization/configuring-identity-providers#configuring-htpasswd-identity-provider
工作忙起来了，然而第三周的挑战还是按时来了呢。。。