Use an OAuth 2.0 Identity Provider

    The following figure shows the authentication process between KubeSphere and an external OAuth 2.0 identity provider.

    You need to deploy a Kubernetes cluster and install KubeSphere in the cluster. For details, see Installing on Linux and .

    Note

    KubeSphere provides two built-in OAuth 2.0 plugins: GitHubIdentityProvider for GitHub and for Alibaba Cloud IDaaS. You can develop other plugins according to the built-in plugins.

    1. Clone the KubeSphere repository on your local machine, go to the local KubeSphere repository, and create a package for your plugin in the directory.

      1. // /pkg/apiserver/authentication/identityprovider/identity_provider.go
      2. type Identity interface {
      3.   // (Mandatory) Return the identifier of the user at the identity provider.
      4.  GetUserID() string
      5.   // (Optional) Return the name of the user to be referred as on KubeSphere.
      6.  GetUsername() string
      7.   // (Optional) Return the email address of the user.
      8.  GetEmail() string
      9. }

    3. Register the plugin in the init() function of the plugin package.

    4. Import the plugin package in /pkg/apiserver/authentication/options/authenticate_options.go.

      1. import (
      2.  ...
      4.  ...
      5.  )

    5. and deploy it in your cluster.

    1. Log in to KubeSphere as admin, move the cursor to Use an OAuth 2.0 Identity Provider - 图2 in the bottom-right corner, click Kubectl, and run the following command to edit the kubesphere-config ConfigMap:

    2. Configure fields other than oauthOptions:identityProviders in the data:kubesphere.yaml:authentication section. For details, see Set Up External Authentication.

    3. Configure fields in oauthOptions:identityProviders section according to the identity provider plugin you have developed.

      1. apiVersion: v1
      2. data:
      3.   kubesphere.yaml: |
      4.     authentication:
      5.       authenticateRateLimiterMaxTries: 10
      6.       authenticateRateLimiterDuration: 10m0s
      7.       loginHistoryRetentionPeriod: 7d
      8.       multipleLogin: true
      9.       kubectlImage: kubesphere/kubectl:v1.0.0
      10.       jwtSecret: '********'
      11.       oauthOptions:
      12.         accessTokenMaxAge: 1h
      13.         accessTokenInactivityTimeout: 30m
      14.         identityProviders:
      15.         - name: GitHub
      16.           type: GitHubIdentityProvider
      17.           mappingMethod: auto
      18.           provider:
      19.             clientID: 'Iv1.547165ce1cf2f590'
      20.             clientSecret: '********'
      21.             redirectURL: 'https://ks-console/oauth/redirect'

      Similarly, you can also use Alibaba Cloud IDaaS as an external identity provider. For details, see the official and the source code of the AliyunIDaasProvider plugin.

    4. After the ConfigMap is modified, run the following command to restart ks-apiserver.

      Note

      The KubeSphere web console is unavailable during the restart of ks-apiserver. Please wait until the restart is complete.

    5. Go to the KubeSphere login page, click Log In with XXX (for example, Log In with GitHub).