Keycloak

Once you have completed the steps to prepare for setting up a connection in the platform (the configuration of the external authentication service has been received), you can make changes to the ssc of the Authentication Management Module (shturval-auth) from the command line interface or from the GUI.

It is recommended to connect external authentication services from the command line interface (console).

Connect from the command line interface #

Log in to the “Shturval” platform using the kubeconfig received during platform installation, or you can take it from the Control Plane of the /etc/kubernetes/admin.conf platform node.

1. Get ssc shturval-auth and save the original ssc so you can quickly roll back changes in case of an error:

# Get shturval-auth ssc
kubectl get ssc shturval-auth -o yaml > shturval-auth-ssc.yaml
# Save the original ssc
cp shturval-auth-ssc.yaml shturval-auth-ssc.yaml.backup

2. Remove the status section, parameters and their values from shturval-auth-ssc.yaml:

 creationTimestamp:
 resourceVersion:
 uid: 
 finalizers:
 generation:
 annotations: 

3. Prepare a YAML file with a ShturvalServicePatch (PatchSSC) object manifest to apply to the specification (ssc) shturval-auth. In PatchSSC, set the required parameters in customvalues using your parameter values.

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: <resource name>
spec:
  shturvalServiceConfigName: shturval-auth
  customvalues:
    AUTH_EXTERNAL_IDP_SECRET_BASE64: <your parameter value>
    AUTH_IDP_ACTIVE: <your parameter value>
    SKIP_INTERNAL_AUTH_FORM: <your parameter value>

4. Apply changes:

kubectl apply -f SPECIFY-PATCHSSC-MANIFEST-FILE

5. Wait for the changes to apply. In the namespace shturval-backend, check the details of Secret auth-idps. It must contain the configuration specified in AUTH_EXTERNAL_IDP_SECRET_BASE64.

kubectl get secret auth-idps -n shturval-backend -o yaml

Once the changes are applied, to access the cluster using kubeconfig, download and use the new kubeconfig. Learn more about how to get kubeconfig on the Cluster Actions page.

Connect from GUI #

1. Prepare a ShturvalServicePatch (PatchSSC) object manifest to apply to specification (ssc) shturval-auth. In PatchSSC, set the required parameters in customvalues as in the example below, using your values.

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: <resource name>
spec:
  shturvalServiceConfigName: shturval-auth
  customvalues:
    AUTH_EXTERNAL_IDP_SECRET_BASE64: <your parameter value>
    AUTH_IDP_ACTIVE: <your parameter value>
    SKIP_INTERNAL_AUTH_FORM: <your parameter value>

3. In the management cluster, load the prepared ShturvalServicePatch using import manifests.

4. If after applying PatchSSC the session in the platform’s graphical interface is completed, connect to the platform from the console. Use the management cluster kubeconfig. If the authentication was not interrupted, you can continue with the following steps in the GUI.

5. In namespace shturval-backend, check the details of Secret auth-idps. Secret must contain the configuration specified in AUTH_EXTERNAL_IDP_SECRET_BASE64.

After applying the changes to access the cluster using kubeconfig, download and use the new kubeconfig. Read more about ways to get kubeconfig on the pageCluster Actions.