search

goharbor / harbor

An open source trusted cloud native registry project that stores, signs, and scans content.
https://goharbor.io
Apache License 2.0
23.81k stars 4.74k forks source link

Add keystone as identity provider #6979

Open pytimer opened 5 years ago

pytimer commented 5 years ago

Is your feature request related to a problem? Please describe.

I use keystone as my Kubernetes identity provider, harbor also running in cluster. Now i wants harbor also use keystone as identity provider, otherwise i have to maintain two user system.

Describe the solution you'd like

I wants harbor can integration with keystone as identity provider.

Describe the main design/architecture of your solution

Describe the development plan you've considered

Additional context

I see some issue about it, but it has not had recent activity, so i wants ask this feature progress.

Ref: https://github.com/goharbor/harbor/issues/2235

Now i have no more idea about harbor authentication, but if no one works on it, i can try to do it.

pytimer commented 5 years ago

@reasonerjt @steven-zou If have time, i hope you can tell me what do you think. Thanks.

reasonerjt commented 5 years ago

In 1.8.0 timeframe the planned enhancement in auth area is support of OIDC, so if your Keystone is connected to a 3rd party OIDC provider, you would be able to configure Harbor to authenticate against that OIDC provider.

Additionally, does Kubernetes natively support Keystone natively or through webhook?

pytimer commented 5 years ago

@reasonerjt Thanks for you reply.

In 1.8.0 timeframe the planned enhancement in auth area is support of OIDC, so if your Keystone is connected to a 3rd party OIDC provider, you would be able to configure Harbor to authenticate against that OIDC provider.

My Keystone not connected to OIDC provider, so i think i can't use OIDC provider.

does Kubernetes natively support Keystone natively or through webhook?

Yes. i config Kubernetes webhook to using Keystone.

github-actions[bot] commented 2 years ago

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.