Improve the Dex guide

[Callisto13]

Proposed changes to this page.

Currently opaque, hard to follow, and makes many assumptions about what's been done+prior knowledge.

Could swap this for a guide on Keycloak instead, because their docs are waaaay better.

Acceptance criteria:

• [ ] The guide explains what problem the user can solve, why the user wants to solve that problem, and a summary of the outcome
• [ ] Provides a complete list of prerequisites:
  • [ ] what state does the cluster need to be in?
  • [ ] do I need to have set anything up outside the cluster?
  • [ ] is this guide for a development environment? or do i need a "real" env with network/dns/routing etc?
• [ ] An intuitive journey through the steps
• [ ] Yaml/command output is collapsed to avoid saturating the page
• [ ] Screenshots with readable text, if applicable
• [ ] Every copy-pastable command is tested
• [ ] An example repository that shows the completed solution, which users can easily clone and apply to their cluster if they want
• [ ] Addresses how the orgs field of the Dex connector works, and how it relates to the RBAC configuration (see below comment)
• [ ] Clarify TLS ambiguities (see below)

[interdependence]

It is a little confusing, but personally I really like Dex. I think most of the confusion (at least when I was following this guide) stems from how the orgs field of the Dex connector works, and how it relates to the RBAC configuration.

[Callisto13]

Thanks for the note @interdependence 👍

This ticket is open for anyone to pick up if you have ideas... 😏 😄

[joshri]

The pre-reqs mention having TLS enabled - when I go to those docs, I get a little confused about what this is/how to do it coming in with zero knowledge of TLS.

Like here - do I have to put this in a specific place? kubectl create secret tls my-tls-secret \ --cert=path/to/cert/file \ --key=path/to/key/file

And then the next step is to reference it in "the helm release". Which helm release?

[interdependence]

You would run that command if you have a pre-existing cert that you would like to use instead of using another method for getting a cert (like cert-manager).

The helm release referenced is the weave-gitops helm release, and you can either let the dashboard handle TLS directly or delegate it to a dedicated ingress controller like ingress-nginx or traefik. Since Dex also should be setup using TLS, I would recommend using a dedicated ingress controller.

[LappleApple]

Closed this as the page will be folded into the install guide with modifications.