mintel / dex-k8s-authenticator

A Kubernetes Dex Client Authenticator
MIT License
374 stars 146 forks source link

dex chart docs #127

Closed sdarwin closed 4 years ago

sdarwin commented 4 years ago

Hi, After testing the dex and dex-k8s-authenticator charts, here are some notes about the setup process. Not sure if you think this could be added to the docs ( https://github.com/mintel/dex-k8s-authenticator/blob/master/charts/dex/README.md ), or it's already been covered sufficiently.


TLS Notes:

In the current incarnation of this chart, there is not a single setting like "https: true" to enable TLS. Rather, you must change all of the following settings.

".Values.tls.create" is used internally by the chart in some places as if it meant "https: true". "tls.create" does more than "create a certificate".

Ingress Notes:

If enabling the ingress, the chart does not create the certificate secret as it does for dex itself. Therefore, you should create a secret for the ingress:

kubectl create secret tls dex.example.com --cert _path_to_cert_ --key _path_to_key_ -n dex

Or, you may possibly re-use the dex certificate, typically named "dex-tls". View secrets:

kubectl get secrets -n dex

If dex has tls enabled (.Values.tls.create: true), the ingress needs to be adjusted. Add this annotation to the ingress:

nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
sdarwin commented 4 years ago

From another issue here, it looks like maybe you are considering migrating to a different helm chart.
If that's the case, I will close this one. Feel free to re-open if you'd like.