Merge pull request #118 from bobbyrullo/k8s

Get the K8s files up to date with more docs
This commit is contained in:
bobbyrullo 2015-09-18 15:31:01 -07:00
commit 188aa27c17
10 changed files with 220 additions and 90 deletions

View file

@ -1,41 +1,123 @@
# dex # Deploying dex on Kubernetes
## Getting Started This document will allow you to set up dex in your Kubernetes cluster ;the example configuration files are generally useful, but will need to be modified to meet the needs of your deployment. The places that are likely to need modification will be called out as often as possible in this document.
**Warning**: Hacks Ahead. ## Prerequisites and Assumptions
You must be running cluster wide DNS for this to work. The document assumes that you already have a cluster with at least one worker up and running. The easiest way to bring up a small cluster for experimentation is the [coreos-kubernetes single node](coreos-kubernetes-single-node) Vagrant installer.
Install your dockercfg. There is no nice way to do this: The other assumption is that your Kubernetes cluster will be routable on `172.17.4.99` (which is what it will be if you use [coreos-kubernetes single node][coreos-kubernetes-single-node], and the issuer URL for your dex installation is `http://172.17.4.99:30556`; in production installations you will need to make sure that you are serving on https and you will likely want to use a hostname rather than an IP address.
``` [coreos-kubernetes-single-node][https://github.com/coreos/coreos-kubernetes/blob/master/single-node/README.md]
ssh worker
cat > /proc/$(pgrep kubelet)/cwd/.dockercfg
```
Start postgres ## Start Postgres
Dex needs a database to store information; these commands will create a Postgres service that dex can use. Note that this configuration is not suitable for production - if the container is destroyed, the data is gone forever.
In production you should have a sufficiently fault-tolerant Postgres deployment on a persistent volume with backup.
``` ```
kubectl create -f postgres-rc.yaml kubectl create -f postgres-rc.yaml
kubectl create -f postgres-service.yaml kubectl create -f postgres-service.yaml
``` ```
Run dex and setup services ## Create your secrets.
dex needs a secret key for encrypting private keys in the database. These can be stored as [Kubernetes secrets][k8s-secrets].
[k8s-secrets]: http://kubernetes.io/v1.0/docs/user-guide/secrets.html
``` ```
for i in dex-overlord-rc.yaml dex-overlord-service.yaml dex-worker-rc.yaml dex-worker-service.yaml; do kubectl create -f dex-secrets.yaml
kubectl create -f ${i}
done
``` ```
curl http://$(kubectl describe service dex-worker | grep '^IP:' | awk '{print $2}'):5556 ## Start the Overlord
5. [Register your first client](https://github.com/coreos/dex#registering-clients) Start the overlord. This will also initialize your database the first time it's run, and perform migrations when new versions are installed.
```
kubectl create -f dex-overlord-rc.yaml
kubectl create -f dex-overlord-service.yaml
```
Note: this will make the admin API available to any pod in the cluster. This API is very powerful, and allows the creation of admin users who can perform any action in dex, including creating, modifying and deleting other users. This will be fixed soon by requirng some sort of authentication.
## Add a Connector
This is bit of a hack; right now the only way to add connectors and register
your first client is to use the `dexctl` tool talking directly to the
database. Because the database is only routable inside the cluster, we do it
inside a pod via `kubectl exec`. (note that if your DB is not running on the cluster, you can run the dexctl command directly against your database.)
The other hacky thing is that this needs to happen before the workers start because workers do not (yet!) respond dynamically to connector configuration changes.
First, start a shell session on the overlord pod.
```
DEX_OVERLORD_POD=$(kubectl get pod -l=app=dex,role=overlord -o template -t "{{ (index .items 0).metadata.name }}")
kubectl exec -ti $DEX_OVERLORD_POD -- sh
```
Once we're on the pod, we create a connectors file and upload it to dex.
```
DEX_CONNECTORS_FILE=$(mktemp /tmp/dex-conn.XXXXXX)
cat << EOF > $DEX_CONNECTORS_FILE
[
{
"type": "local",
"id": "local"
}
]
EOF
/opt/dex/bin/dexctl --db-url=postgres://postgres@dex-postgres.default:5432/postgres?sslmode=disable set-connector-configs $DEX_CONNECTORS_FILE
exit
```
## Start the Worker
Start the worker. The worker is exposed as an external service so that end-users can access it.
```
kubectl create -f dex-worker-rc.yaml
kubectl create -f dex-worker-service.yaml
```
## [Create a client](https://github.com/coreos/dex#registering-clients)
We then `eval` that which creates the shell variables `DEX_APP_CLIENT_ID` and `DEX_APP_CLIENT_SECRET`
```
eval "$(kubectl exec $DEX_OVERLORD_POD -- /opt/dex/bin/dexctl --db-url=postgres://postgres@dex-postgres.default:5432/postgres?sslmode=disable new-client http://127.0.0.1:5555/callback )"
```
## Build and Run the Example App
First, go to the root of the dex repo:
```
cd ../..
```
Now, build and run the example app.
```
./build
./bin/example-app --client-id=$DEX_APP_CLIENT_ID --client-secret=$DEX_APP_CLIENT_SECRET --discovery=http://172.17.4.99:30556
```
Now you can register and log-in to your example app: Go to http://127.0.0.1:5555
## Debugging ## Debugging
You can use a port forward from the target host to debug the database
IP=$(kubectl describe service dex-postgres | grep '^IP:' | awk '{print $2}') ### psql
ssh -F ssh-config -L 5432:${IP}:5432 w1
psql -h localhost -w -U postgres Here's how to get psql session.
```
DEX_PSQL_POD=$(kubectl get pod -l=app=postgres -o template -t "{{ (index .items 0).metadata.name }}")
kubectl exec $DEX_PSQL_POD -ti -- psql postgres://postgres@dex-postgres.default:5432/postgres?sslmode=disable
```

View file

@ -1,25 +0,0 @@
apiVersion: v1beta3
kind: ReplicationController
metadata:
labels:
app: dex
role: overlord
name: dex-overlord
spec:
replicas: 1
selector:
app: dex
role: overlord
template:
metadata:
labels:
app: dex
role: overlord
spec:
containers:
- image: quay.io/coreos/dex
name: dex-overlord
command: ["/opt/dex/bin/dex-overlord", "-key-secret", "XXXXXXXXXXXXX", "-db-url", "postgres://postgres@auth-postgres.default.tectonic.local:5432/auth?sslmode=disable"]
ports:
- containerPort: 5557
name: overlord-port

View file

@ -1,32 +0,0 @@
apiVersion: v1beta3
kind: ReplicationController
metadata:
labels:
app: dex
role: worker
name: dex-worker
spec:
replicas: 1
selector:
app: dex
role: worker
template:
metadata:
labels:
app: dex
role: worker
spec:
containers:
- image: quay.io/coreos/dex
name: dex-worker
command: ["/opt/dex/bin/dex-worker", "-issuer", "http://dex-worker.default.tectonic.local:5556", "-key-secret", "XXXXXXXXXXX", "-db-url", "postgres://postgres@auth-postgres.default.tectonic.local:5432/auth?sslmode=disable"]
ports:
- containerPort: 5556
name: worker-port
livenessProbe:
httpGet:
path: /health
port: 5556
initialDelaySeconds: 15
timeoutSeconds: 1

View file

@ -0,0 +1,47 @@
apiVersion: v1
kind: ReplicationController
metadata:
labels:
app: dex
role: overlord
name: dex-overlord
spec:
replicas: 1
selector:
app: dex
role: overlord
template:
metadata:
labels:
app: dex
role: overlord
spec:
containers:
- image: quay.io/coreos/dex
name: dex-overlord
env:
- name: DEX_OVERLORD_DB_URL
value: postgres://postgres@dex-postgres.default:5432/postgres?sslmode=disable
- name: DEX_OVERLORD_ADMIN_LISTEN
value: http://0.0.0.0:5557
command:
- "sh"
- "-c"
- "/opt/dex/bin/dex-overlord --key-secrets=$(cat /etc/dex/key-secrets)"
ports:
- containerPort: 5557
name: overlord-port
livenessProbe:
httpGet:
path: /health
port: 5557
initialDelaySeconds: 15
timeoutSeconds: 1
volumeMounts:
- name: dex
mountPath: "/etc/dex"
readOnly: true
volumes:
- name: dex
secret:
secretName: "dex"

View file

@ -1,4 +1,4 @@
apiVersion: v1beta3 apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:

View file

@ -0,0 +1,7 @@
apiVersion: v1
kind: Secret
metadata:
name: dex
type: Opaque
data:
key-secrets: ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIZz0= # 32 x's base64 encoded twice.

View file

@ -0,0 +1,51 @@
apiVersion: v1
kind: ReplicationController
metadata:
labels:
app: dex
role: worker
name: dex-worker
spec:
replicas: 1
selector:
app: dex
role: worker
template:
metadata:
labels:
app: dex
role: worker
spec:
containers:
- image: quay.io/coreos/dex
name: dex-worker
env:
- name: DEX_WORKER_ISSUER
value: http://172.17.4.99:30556
- name: DEX_WORKER_DB_URL
value: postgres://postgres@dex-postgres.default:5432/postgres?sslmode=disable
- name: DEX_WORKER_EMAIL_CFG
value: /opt/dex/email/emailer.json
- name: DEX_WORKER_LISTEN
value: http://0.0.0.0:5556
command:
- "sh"
- "-c"
- "/opt/dex/bin/dex-worker --key-secrets=$(cat /etc/dex/key-secrets)"
ports:
- containerPort: 5556
name: worker-port
livenessProbe:
httpGet:
path: /health
port: 5556
initialDelaySeconds: 15
timeoutSeconds: 1
volumeMounts:
- name: dex
mountPath: "/etc/dex"
readOnly: true
volumes:
- name: dex
secret:
secretName: "dex"

View file

@ -1,4 +1,4 @@
apiVersion: v1beta3 apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:
@ -6,8 +6,12 @@ metadata:
role: worker role: worker
name: dex-worker name: dex-worker
spec: spec:
type: "NodePort"
ports: ports:
- port: 5556 - name: "worker"
port: 5556
nodePort: 30556
selector: selector:
app: dex app: dex
role: worker role: worker

View file

@ -1,9 +1,9 @@
apiVersion: v1beta3 apiVersion: v1
kind: ReplicationController kind: ReplicationController
metadata: metadata:
labels: labels:
app: postgres app: postgres
name: auth-postgres name: dex-postgres
spec: spec:
replicas: 1 replicas: 1
selector: selector:
@ -14,12 +14,8 @@ spec:
app: postgres app: postgres
spec: spec:
containers: containers:
- image: quay.io/sym3tri/postgres-dev:9.4 - image: postgres
name: auth-postgres name: dex-postgres
env:
- name: DATABASES
key: DATABASES
value: auth
ports: ports:
- containerPort: 5432 - containerPort: 5432
name: postgres-port name: postgres-port

View file

@ -1,9 +1,9 @@
apiVersion: v1beta3 apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:
app: postgres app: postgres
name: auth-postgres name: dex-postgres
spec: spec:
ports: ports:
- port: 5432 - port: 5432