techies/authelia
1
0
Fork 0
mirror of https://github.com/0rangebananaspy/authelia.git synced 2024-09-14 22:47:21 +07:00
Code Issues Projects Releases Wiki Activity
6245dd68e9
authelia/example/kube
History
Clement Michaud c95c7210d8 Put secrets in env variables of Kubernetes Deployment. 
This is preliminary work to bootstrap the Helm chart and rely on
the Kubernetes vault.

WARNING: those variables should never be set in the configuration
in a production environment. They have been set here for ease of
deployment and because this is a showcase.
2020-01-22 10:15:25 +11:00
..
apps Update references to remove hash router 2020-01-10 11:33:18 +01:00
authelia Put secrets in env variables of Kubernetes Deployment. 2020-01-22 10:15:25 +11:00
ingress-controller Declare suites as Go structs and bootstrap e2e test framework in Go. 2019-11-15 20:23:06 +01:00
ldap Add support for LDAP over TLS. 2019-12-06 21:33:47 +01:00
mail Declare suites as Go structs and bootstrap e2e test framework in Go. 2019-11-15 20:23:06 +01:00
storage Deprecate mongo and add mariadb as storage backend option. 2019-11-16 23:39:26 +01:00
bootstrap-authelia.sh Fix and parallelize integration tests. 2019-12-05 11:05:24 +01:00
bootstrap-dashboard.sh Fix Kubernetes suite tests. 2019-11-16 23:39:26 +01:00
bootstrap.sh Fix Kubernetes suite tests. 2019-11-16 23:39:26 +01:00
dashboard.yml Bootstrap Go implementation of Authelia. 2019-10-28 23:28:59 +01:00
namespace.yml fix permissions 2018-12-18 16:34:56 +01:00
README.md Update references to remove hash router 2020-01-10 11:33:18 +01:00
test.yml Rename org from clems4ever to authelia 2019-12-24 13:14:52 +11:00

README.md

Authelia on Kubernetes

Authelia is now available on Kube in order to protect your most critical applications using 2-factor authentication and Single Sign-On.

This example leverages ingress-nginx to delegate authentication and authorization to Authelia within the cluster.

Getting started

You can either try to install Authelia on your running instance of Kubernetes or deploy the dedicated suite called kubernetes.

Set up a Kube cluster

The simplest way to start a Kubernetes cluster is to deploy the kubernetes suite with

authelia-scripts suites setup kubernetes

This will take a few seconds (or minutes) to deploy the cluster.

How does it work?

Authentication via Authelia

In a Kube clusters, the routing logic of requests is handled by ingress controllers following rules provided by ingress configurations.

In this example, ingress-nginx controller has been installed to handle the incoming requests. Some of them (specified in the ingress configuration) are forwarded to Authelia so that it can verify whether they are allowed and should reach the protected endpoint.

The authentication is provided at the ingress level by an annotation called nginx.ingress.kubernetes.io/auth-url that is filled with the URL of Authelia's verification endpoint. The ingress controller also requires the URL to the authentication portal so that the user can be redirected if he is not yet authenticated. This annotation is as follows: nginx.ingress.kubernetes.io/auth-signin: "https://login.example.com:8080/"

Those annotations can be seen in apps/apps.yml configuration.

Production grade infrastructure

What is great with using ingress-nginx is that it is compatible with kube-lego which removes the usual pain of manually renewing SSL certificates. It uses letsencrypt to issue and renew certificates every three month without any manual intervention.

What do I need to know to deploy it in my cluster?

Given your cluster already runs a LDAP server, a Redis, a SQL database, a SMTP server and a nginx ingress-controller, you can deploy Authelia and update your ingress configurations. An example is provided here.

Questions

If you have questions about the implementation, please post them on Gitter