bug 1633137 request header changes #12998
Conversation
openshift-ci-robot
added
the
size/S
|
The preview will be availble shortly at:
|
| ---- | ||
| <1> If you specify your CA certificate location in the | ||
| `openshift_master_identity_providers` parameter, do not specify a certificate | ||
| value in the `openshift_master_ldap_ca` parameter or path in the | ||
| `openshift_master_ldap_ca_file` parameter. | ||
| <2> If you specify a file on the host you run the playbook on, its contents are | ||
| copied to the *_/etc/origin/master/<identity_provider_name>_ca.crt_* file. The |
There was a problem hiding this comment.
| copied to the *_/etc/origin/master/<identity_provider_name>_ca.crt_* file. The | |
| copied to the *_/etc/origin/master/<identity_provider_name>_<identity_provider_type>_ca.crt_* file. The |
| ---- | ||
| <1> If you specify your CA certificate location in the | ||
| `openshift_master_identity_providers` parameter, do not specify a certificate | ||
| value in the `openshift_master_ldap_ca` parameter or path in the | ||
| `openshift_master_ldap_ca_file` parameter. | ||
| <2> If you specify a file on the host you run the playbook on, its contents are | ||
| copied to the *_/etc/origin/master/<identity_provider_name>_ca.crt_* file. The | ||
| identity provider name is `ldap`, `openid`, or `request_header` to match the |
There was a problem hiding this comment.
| identity provider name is `ldap`, `openid`, or `request_header` to match the | |
| identity provider name is name of the item in `openshift_master_identity_providers` list and identity provider type is `ldap`, `openid`, or `request_header` to match the |
In openshift_master_identity_providers two or more identity providers can be specified:
openshift_master_identity_providers:
- name: foo
provider:
kind: OpenIDIdentityProvider
- name: bar
provider:
kind: OpenIDIdentityProvider
- name: baz
provider:
kind: RequestHeaderIdentityProvider
This config would require the following files:
/etc/origin/master/foo_openid_ca.crt/etc/origin/master/bar_openid_ca.crt/etc/origin/master/baz_requestheader_ca.crt
There was a problem hiding this comment.
@enj, are you ready for us to tell people that you can use multiple identity providers?
There was a problem hiding this comment.
Mo says that you've always been able to do this.
| #openshift_master_request_header_ca | ||
| #openshift_master_request_header_ca_file | ||
| #openshift_master_request_header_ca_file <2> | ||
| ---- | ||
| <1> If you specify your CA certificate location in the |
There was a problem hiding this comment.
This is no longer correct, CA certificate location in openshift_master_identity_providers parameter is now ignored
| identity provider name is `ldap`, `openid`, or `request_header` to match the | ||
| identity provider that you configure. If you do not | ||
| specify the CA text or the path to the local CA file, you must place the CA | ||
| cert in this location. You cannot change this location. |
There was a problem hiding this comment.
In LDAP insecure option would allow omitting openshift_master_ldap_ca or openshift_master_ldap_ca_file, this doesn't affect other identity providers
openshift-ci-robot
added
size/M
|
Looks good, one last change would be removing |
|
@vrutkovs, I've pulled it. Thanks! |
|
@stuartchuan Will review from QE. |
|
The changes are OK. |
|
Thank you both! I'll squash and merge after I get a peer review. :) |
kalexand-rh
added
the
peer-review-needed
|
@openshift/team-documentation PTAL |
|
@kalexand-rh LGTM! |
ahardin-rh
added
peer-review-done
kalexand-rh
force-pushed
the
BZ1633137
branch
from
35a27a5 to
77f7d16
Compare
|
/cherrypick enterprise-3.11 |
|
/cherrypick enterprise-3.10 |
|
@kalexand-rh: new pull request created: #13007 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@kalexand-rh: new pull request created: #13008 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
From https://bugzilla.redhat.com/show_bug.cgi?id=1633137
@vrutkovs, will you PTAL? The bug mentions the
insecureoption. Does #12631 cover what you were thinking?