daa431e385
This commit does 2 changes in the OIDC app docs: 1) The docs were updated to be explicit about the OIDC app being compatible with LDAP servers and not only with the Windows Active Directory; 2) The page "Centralized OIDC Authentication Setup for Distributed Cloud" was renamed to "Centralized vs Distributed OIDC Authentication Setup" and was moved in the index of pages to be right below the first page "Overview of LDAP Servers". The idea is to use this page as a entry point for someone learning about the OIDC app, because every user must decide between a centralized and a distributed setup and because this page has links to all other pages except "Deprovision LDAP Server Authentication". Story: 2010738 Task: 49455 Change-Id: I61c5b7f322ac8159b649c70eeaa0195d97ab12c7 Signed-off-by: Joao Victor Portal <Joao.VictorPortal@windriver.com>
82 lines
2.6 KiB
ReStructuredText
82 lines
2.6 KiB
ReStructuredText
|
|
.. luo1591184217439
|
|
.. _deprovision-ldap-server-authentication:
|
|
|
|
======================================
|
|
Deprovision LDAP Server Authentication
|
|
======================================
|
|
|
|
You can remove Windows Active Directory or |LDAP| authentication from
|
|
|prod-long|.
|
|
|
|
.. rubric:: |proc|
|
|
|
|
#. Remove the configuration of kube-apiserver to use oidc-auth-apps for
|
|
authentication.
|
|
|
|
|
|
#. Determine the UUIDs of parameters used in the kubernetes **kube-apiserver** group.
|
|
|
|
These include oidc-client-id, oidc-groups-claim,
|
|
oidc-issuer-url and oidc-username-claim.
|
|
|
|
.. code-block:: none
|
|
|
|
~(keystone_admin)]$ system service-parameter-list
|
|
|
|
#. Delete each parameter.
|
|
|
|
.. code-block:: none
|
|
|
|
~(keystone_admin)]$ system service-parameter-delete <UUID>
|
|
|
|
#. Apply the changes.
|
|
|
|
.. code-block:: none
|
|
|
|
~(keystone_admin)]$ system service-parameter-apply kubernetes
|
|
|
|
|
|
#. Uninstall oidc-auth-apps.
|
|
|
|
.. code-block:: none
|
|
|
|
~(keystone_admin)]$ system application-remove oidc-auth-apps
|
|
|
|
#. Clear the helm-override configuration.
|
|
|
|
.. code-block:: none
|
|
|
|
~(keystone_admin)]$ system helm-override-update oidc-auth-apps dex kube-system --reset-values
|
|
~(keystone_admin)]$ system helm-override-show oidc-auth-apps dex kube-system
|
|
|
|
~(keystone_admin)]$ system helm-override-update oidc-auth-apps oidc-client kube-system --reset-values
|
|
~(keystone_admin)]$ system helm-override-show oidc-auth-apps oidc-client kube-system
|
|
|
|
~(keystone_admin)]$ system helm-override-update oidc-auth-apps secret-observer kube-system --reset
|
|
~(keystone_admin)]$ system helm-override-show oidc-auth-apps secret-observer kube-system
|
|
|
|
#. Remove secrets that contain certificate data. Depending on your
|
|
configuration, some secrets listed below may not exist.
|
|
|
|
.. code-block:: none
|
|
|
|
~(keystone_admin)]$ kubectl delete secret dex-ca-cert -n kube-system
|
|
~(keystone_admin)]$ kubectl delete secret oidc-auth-apps-certificate -n kube-system
|
|
~(keystone_admin)]$ kubectl delete secret wad-ca-cert -n kube-system
|
|
~(keystone_admin)]$ kubectl delete secret local-ldap-ca-cert -n kube-system
|
|
~(keystone_admin)]$ kubectl delete secret local-dex.tls -n kube-system
|
|
~(keystone_admin)]$ kubectl delete secret dex-client-secret -n kube-system
|
|
|
|
#. Remove any |RBAC| RoleBindings added for |OIDC| users and/or groups.
|
|
|
|
For example:
|
|
|
|
.. code-block:: none
|
|
|
|
$ kubectl delete clusterrolebinding testuser-rolebinding
|
|
$ kubectl delete clusterrolebinding billingdeptgroup-rolebinding
|
|
|
|
|
|
|