Joao Victor Portal daa431e385 Updated OIDC app docs

This commit does 2 changes in the OIDC app docs:

1) The docs were updated to be explicit about the OIDC app being
   compatible with LDAP servers and not only with the Windows Active
   Directory;
2) The page "Centralized OIDC Authentication Setup for Distributed
   Cloud" was renamed to "Centralized vs Distributed OIDC Authentication
   Setup" and was moved in the index of pages to be right below the
   first page "Overview of LDAP Servers". The idea is to use this page
   as a entry point for someone learning about the OIDC app, because
   every user must decide between a centralized and a distributed setup
   and because this page has links to all other pages except
   "Deprovision LDAP Server Authentication".

Story: 2010738
Task: 49455

Change-Id: I61c5b7f322ac8159b649c70eeaa0195d97ab12c7
Signed-off-by: Joao Victor Portal <Joao.VictorPortal@windriver.com>

2024-01-29 19:14:14 -03:00

2.6 KiB

Raw Blame History

Deprovision LDAP Server Authentication

You can remove Windows Active Directory or authentication from .

Remove the configuration of kube-apiserver to use oidc-auth-apps for authentication.
1. Determine the UUIDs of parameters used in the kubernetes kube-apiserver group.
  
  These include oidc-client-id, oidc-groups-claim, oidc-issuer-url and oidc-username-claim.
```
~(keystone_admin)]$ system service-parameter-list
```
2. Delete each parameter.
```
~(keystone_admin)]$ system service-parameter-delete <UUID>
```
3. Apply the changes.
```
~(keystone_admin)]$ system service-parameter-apply kubernetes
```

Uninstall oidc-auth-apps.

~(keystone_admin)]$ system application-remove oidc-auth-apps

Clear the helm-override configuration.

~(keystone_admin)]$ system helm-override-update oidc-auth-apps dex kube-system --reset-values
~(keystone_admin)]$ system helm-override-show oidc-auth-apps dex kube-system

~(keystone_admin)]$ system helm-override-update oidc-auth-apps oidc-client kube-system --reset-values
~(keystone_admin)]$ system helm-override-show oidc-auth-apps oidc-client kube-system

~(keystone_admin)]$ system helm-override-update oidc-auth-apps secret-observer kube-system --reset
~(keystone_admin)]$ system helm-override-show oidc-auth-apps secret-observer kube-system

Remove secrets that contain certificate data. Depending on your configuration, some secrets listed below may not exist.

~(keystone_admin)]$ kubectl delete secret dex-ca-cert -n kube-system
~(keystone_admin)]$ kubectl delete secret oidc-auth-apps-certificate -n kube-system
~(keystone_admin)]$ kubectl delete secret wad-ca-cert -n kube-system
~(keystone_admin)]$ kubectl delete secret local-ldap-ca-cert -n kube-system
~(keystone_admin)]$ kubectl delete secret local-dex.tls -n kube-system
~(keystone_admin)]$ kubectl delete secret dex-client-secret -n kube-system

Remove any RoleBindings added for users and/or groups.

For example:

$ kubectl delete clusterrolebinding testuser-rolebinding
$ kubectl delete clusterrolebinding billingdeptgroup-rolebinding

2.6 KiB Raw Blame History

Deprovision LDAP Server Authentication

2.6 KiB

Raw Blame History