Blitz
When the steps to prepare for setting up a connection in the platform have been completed (the configuration of the external authentication service has been received):
Log in to the “Shturval” platform using the kubeconfig received during platform installation, or you can take it from the Control Plane of the
/etc/kubernetes/admin.confplatform node.Get ssc
shturval-authand save the original ssc so you can quickly roll back changes in case of an error:
Command
# Get shturval-auth ssc
kubectl get ssc shturval-auth -o yaml > shturval-auth-ssc.yaml
# Save the original ssc
cp shturval-auth-ssc.yaml shturval-auth-ssc.yaml.backup
- Remove the
statussection, parameters and their values from shturval-auth-ssc.yaml:
Deleted parameters
creationTimestamp:
resourceVersion:
uid:
finalizers:
generation:
annotations:
- Prepare a YAML file with a ShturvalServicePatch (PatchSSC) object manifest to apply to the specification (ssc)
shturval-auth. In PatchSSC set the required parameters incustomvaluesusing your parameter values.
Example ShturvalServicePatch
apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
name: <resource name>
spec:
shturvalServiceConfigName: shturval-auth
customvalues:
AUTH_EXTERNAL_IDP_SECRET_BASE64: <your parameter value>
AUTH_IDP_ACTIVE: <your parameter value>
SKIP_INTERNAL_AUTH_FORM: <your parameter value>
| Parameter | Description | Data type | Example |
|---|---|---|---|
metadata.name | Name of the created PatchSSC | string | shturval-auth-blitz |
AUTH_EXTERNAL_IDP_SECRET_BASE64 | External provider configuration encoded in base64 | string | base64* |
AUTH_IDP_ACTIVE | Connecting an external authentication provider. If you need to disable Keycloak, just set false in this parameter | boolean | true |
SKIP_INTERNAL_AUTH_FORM | Possibility of authentication in a graphical interface with an external service. If this parameter is not set or its value is false, then external and internal services will be available for authentication. If the value is true, only external | boolean | true |
*ewogICJuYW1lIjogImJsaXR6IiwgCiAgImlzc3VlclVybCI6ICJodHRwczovL2JsaXR6LmlwLVhYLVhYLVhYLVhYLnNodHVydmFsLmxpbmsvcmVhbG1zL3NodHVydmFsIiwgIAogICJjbGllbnQiOiB7CiAgICAiY2xpZW50SWQiOiAic2h0dXJ2YWxfdW5pYmxpdHpfYmFja2VuZF9jbGllbnRfaWQiLCAKICAgICJjbGllbnRTZWNyZXQiOiAiSEcwcnhKTUtvcG1BR1Nhc0R4RHRrSllRSCIgCiAgfSwKICAiaW5zZWN1cmVTa2lwVmVyaWZ5IjogdHJ1ZSwgCiAgImNhQnVuZGxlIjogIkxTMHRMUzFDUlVkSlRpQkRSVkpVU1VaSlEwRlVSUzB0TFMwdENsdlJnZEMxMFlEUmd0QzQwWVRRdU5DNjBMRFJnaURRc3RDOTBMWFJpTkM5MExYUXM5QytJTkdCMExYUmdOQ3kwTGpSZ2RDd0lOQ3cwWVBSZ3RDMTBMM1JndEM0MFlUUXVOQzYwTERSaHRDNDBMaGRDaTB0TFMwdFJVNUVJRU5GVWxSSlJrbERRVlJGTFMwdExTMD0iIAp9
- Apply the changes:
Command
kubectl apply -f SPECIFY-PATCHSSC-MANIFEST-FILE
An example manifest file name is shturval-auth-blitz.yaml.
- Wait for the changes to apply. In the namespace
shturval-backend, check the details of Secretauth-idps. It must contain the configuration specified inAUTH_EXTERNAL_IDP_SECRET_BASE64.
Command
kubectl get secret auth-idps -n shturval-backend -o yaml
When the authentication service has changed, to access the cluster using kubeconfig, download and use the new kubeconfig. Learn more about how to get kubeconfig on the Cluster Actions page.