Skip to content

Commit 4d4afb0

Browse files
simubastjan
simu
authored and
bastjan
committed
Update install and decommission how-tos to use Keycloak
1 parent 592876b commit 4d4afb0

File tree

8 files changed

+70
-35
lines changed

8 files changed

+70
-35
lines changed

‎docs/modules/ROOT/pages/how-tos/cloudscale/decommission.adoc

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -143,21 +143,7 @@ At this point in the decommissioning process, you'll have to extract the Restic
143143

144144
. Delete all other Vault entries
145145

146-
. Delete LDAP service (via portal)
147-
+
148-
Go to https://control.vshn.net/vshn/services
149-
+
150-
- Search cluster name
151-
+
152-
- Delete cluster entry service using the delete button
153-
154-
. Remove IPs from LDAP allowlist
155-
+
156-
Edit https://git.vshn.net/vshn-puppet/vshn_hieradata/-/blob/master/corp/prod/ldap.yaml
157-
+
158-
- Search cluster IPs and remove those lines and any comments related.
159-
+
160-
- Create a Merge Request and invite a colleague for a review/approve/merge
146+
include::partial$decommission/idp.adoc[]
161147

162148
. Delete all DNS records related with cluster (zonefiles)
163149

‎docs/modules/ROOT/pages/how-tos/cloudscale/install.adoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -195,9 +195,9 @@ vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/floaty \
195195
vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/registry \
196196
httpSecret=$(LC_ALL=C tr -cd "A-Za-z0-9" </dev/urandom | head -c 128)
197197
198-
# Set the LDAP password
199-
vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/vshn-ldap \
200-
bindPassword=${LDAP_PASSWORD}
198+
# Set the Keycloak client secret
199+
vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/oidc/vshn-keycloak \
200+
clientSecret=${KEYCLOAK_CLIENT_SECRET}
201201
202202
# Generate a master password for K8up backups
203203
vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/global-backup \

‎docs/modules/ROOT/pages/how-tos/exoscale/decommission.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,6 @@ NOTE: Don't forget to remove the LB configuration in the https://git.vshn.net/ap
124124

125125
. Remove cluster DNS records from VSHN DNS
126126

127-
. Remove cluster IPs from LDAP allowlist, if applicable
127+
include::partial$decommission/idp.adoc[]
128128

129129
. https://kb.vshn.ch/vshnsyn/how-tos/decommission.html[Decommission cluster in Project Syn]

‎docs/modules/ROOT/pages/how-tos/exoscale/install.adoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -219,9 +219,9 @@ vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/exoscale/storage_iam \
219219
vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/registry \
220220
httpSecret=$(LC_ALL=C tr -cd "A-Za-z0-9" </dev/urandom | head -c 128)
221221
222-
# Set the LDAP password
223-
vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/vshn-ldap \
224-
bindPassword=${LDAP_PASSWORD}
222+
# Set the Keycloak client secret
223+
vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/oidc/vshn-keycloak \
224+
clientSecret=${KEYCLOAK_CLIENT_SECRET}
225225
226226
# Generate a master password for K8up backups
227227
vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/global-backup \

‎docs/modules/ROOT/partials/decommission/idp.adoc

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
. Delete the IDP service
2+
+
3+
[%collapsible]
4+
.LDAP
5+
====
6+
. Delete LDAP service (via portal)
7+
+
8+
Go to https://control.vshn.net/vshn/services
9+
+
10+
- Search cluster name
11+
+
12+
- Delete cluster entry service using the delete button
13+
14+
. Remove IPs from LDAP allowlist
15+
+
16+
Edit https://git.vshn.net/vshn-puppet/vshn_hieradata/-/blob/master/corp/prod/ldap.yaml
17+
+
18+
- Search cluster IPs and remove those lines and any comments related.
19+
+
20+
- Create a Merge Request and invite a colleague for a review/approve/merge
21+
====
22+
+
23+
[%collapsible]
24+
.Keycloak
25+
====
26+
. Delete Keycloak client
27+
+
28+
Go to https://TBD
29+
+
30+
- Search cluster name
31+
+
32+
- Delete cluster client using the delete button
33+
====

‎docs/modules/ROOT/partials/install/prepare-syn-config.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ yq eval -i ".parameters.openshift.clusterID = \"$(jq -r .clusterID "${INSTALLER_
3030
yq eval -i ".parameters.openshift.ssh_key = \"$(cat ${SSH_PUBLIC_KEY})\"" \
3131
${CLUSTER_ID}.yml
3232

33-
yq eval -i ".parameters.vshnLdap.serviceId = \"${LDAP_ID}\"" \
33+
yq eval -i ".parameters.vshnKeycloak.clientId = \"${KEYCLOAK_CLIENT_ID}\"" \
3434
${CLUSTER_ID}.yml
3535
----
3636
+

‎docs/modules/ROOT/partials/install/register.adoc

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,6 @@ Use the following endpoint for Lieutenant:
77
VSHN:: https://api.syn.vshn.net
88
****
99

10-
=== Set up LDAP service
10+
=== Set up Keycloak client
1111

12-
. Create an LDAP service
13-
+
14-
Use https://control.vshn.net/vshn/services/_create to create a service.
15-
The name must contain the customer and the cluster name.
16-
And then put the LDAP service ID in the following variable:
17-
+
18-
[source,bash]
19-
----
20-
export LDAP_ID="Your_LDAP_ID_here"
21-
export LDAP_PASSWORD="Your_LDAP_pw_here"
22-
----
12+
include::partial$setup-keycloak-client.adoc[]

‎docs/modules/ROOT/partials/setup-keycloak-client.adoc

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
. Create a new Keycloak client in the `VSHN` realm with the following settings:
2+
+
3+
[source]
4+
----
5+
Client ID = ocp_<customer>_<c-cluster-id> <1>
6+
Access Type = confidential
7+
Valid Redirect URIs = https://oauth-openshift.apps.cluster-id.tld/oauth2callback/VSHN <2>
8+
Base URL = https://console-openshift-console.apps.cluster-id.tld/ <3>
9+
----
10+
<1> Create a separate client for each cluster.
11+
The client ID shall use the format `ocp_<customer-name>_<cluster-id>`.
12+
<2> The Redirect URI assumes that the authentication method in the OpenShift cluster is named `VSHN`.
13+
<3> Adjust the Base URL to match the desired web console URL of your cluster.
14+
+
15+
Use https://TBD to create a client.
16+
The name must contain the customer and the cluster name.
17+
+
18+
TODO: Add required config for authentication flow & mappers
19+
20+
. Save the Keycloak client details (client ID and secret) in the following variables for subsequent steps.
21+
+
22+
[source,bash]
23+
----
24+
export KEYCLOAK_CLIENT_ID="Your_client_ID_here"
25+
export KEYCLOAK_CLIENT_SECRET="Your_client_secret"
26+
----

0 commit comments

Comments
 (0)