starlingx/docs
Code Issues Proposed changes
docs/doc/source/security/kubernetes/deprovision-windows-active-directory-authentication.rst
Elaine Fonaro 0f57542f81 Updated OIDC service parameter names 
- Added a note about historical service parameters for OIDC.

- Renamed the parameters to have dashes instead of underscores.

- Removed occurrences of "\" before "-".

Story: 2009766
Task: 46855

Signed-off-by: Elaine Fonaro <elaine.fonaro@windriver.com>
Change-Id: I47e5ab3c689184bdec20b39b2a00bf999ac5706a
2022-11-18 16:02:05 -03:00

2.1 KiB
Raw Blame History

Deprovision Windows Active Directory Authentication

You can remove Windows Active Directory authentication from .

  1. Remove the configuration of kube-apiserver to use oidc-auth-apps for authentication.

    1. Determine the UUIDs of parameters used in the kubernetes kube-apiserver group.

      These include oidc-client-id, oidc-groups-claim, oidc-issuer-url and oidc-username-claim.

      ~(keystone_admin)]$ system service-parameter-list

    2. Delete each parameter.

      ~(keystone_admin)]$ system service-parameter-delete <UUID>

    3. Apply the changes.

      ~(keystone_admin)]$ system service-parameter-apply kubernetes

  2. Uninstall oidc-auth-apps.

    ~(keystone_admin)]$ system application-remove oidc-auth-apps

  3. Clear the helm-override configuration.

    ~(keystone_admin)]$ system helm-override-update oidc-auth-apps dex kube-system --reset-values
~(keystone_admin)]$ system helm-override-show oidc-auth-apps dex kube-system

~(keystone_admin)]$ system helm-override-update oidc-auth-apps oidc-client kube-system --reset-values
~(keystone_admin)]$ system helm-override-show oidc-auth-apps oidc-client kube-system

  4. Remove secrets that contain certificate data.

    ~(keystone_admin)]$ kubectl delete secret local-dex.tls -n kube-system
~(keystone_admin)]$ kubectl delete secret dex-client-secret -n kube-system
~(keystone_admin)]$ kubectl delete secret wadcert -n kube-system

  5. Remove any RoleBindings added for users and/or groups.

    For example:

    $ kubectl delete clusterrolebinding testuser-rolebinding
$ kubectl delete clusterrolebinding billingdeptgroup-rolebinding