</code></pre></div><h3id=example-oauth2-proxy-kubernetes-dashboard>Example: OAuth2 Proxy + Kubernetes-Dashboard<aclass=headerlinkhref=#example-oauth2-proxy-kubernetes-dashboardtitle="Permanent link"> ¶</a></h3><p>This example will show you how to deploy <ahref=https://github.com/pusher/oauth2_proxy><code>oauth2_proxy</code></a> into a Kubernetes cluster and use it to protect the Kubernetes Dashboard using GitHub as the OAuth2 provider.</p><h4id=prepare>Prepare<aclass=headerlinkhref=#preparetitle="Permanent link"> ¶</a></h4><ol><li><p>Install the kubernetes dashboard</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl create -f https://raw.githubusercontent.com/kubernetes/kops/master/addons/kubernetes-dashboard/v1.10.1.yaml</span>
</code></pre></div></li><li><p>Create a <ahref=https://github.com/settings/applications/new>custom GitHub OAuth application</a></p><p><imgalt="Register OAuth2 Application"src=images/register-oauth-app.png></p><ul><li>Homepage URL is the FQDN in the Ingress rule, like <code>https://foo.bar.com</code></li><li>Authorization callback URL is the same as the base FQDN plus <code>/oauth2/callback</code>, like <code>https://foo.bar.com/oauth2/callback</code></li></ul><p><imgalt="Register OAuth2 Application"src=images/register-oauth-app-2.png></p></li><li><p>Configure values in the file <ahref=https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/docs/examples/auth/oauth-external-auth/oauth2-proxy.yaml><code>oauth2-proxy.yaml</code></a> with the values:</p><ul><li>OAUTH2_PROXY_CLIENT_ID with the github <code><Client ID></code></li><li>OAUTH2_PROXY_CLIENT_SECRET with the github <code><Client Secret></code></li><li>OAUTH2_PROXY_COOKIE_SECRET with value of <code>python -c 'import os,base64; print(base64.b64encode(os.urandom(16)).decode("ascii"))'</code></li><li>(optional, but recommended) OAUTH2_PROXY_GITHUB_USERS with GitHub usernames to allow to login</li><li><code>__INGRESS_HOST__</code> with a valid FQDN (e.g. <code>foo.bar.com</code>)</li><li><code>__INGRESS_SECRET__</code> with a Secret with a valid SSL certificate</li></ul></li><li><p>Deploy the oauth2 proxy and the ingress rules by running:</p><divclass=highlight><pre><span></span><code><spanclass=gp>$ </span>kubectl<spanclass=w></span>create<spanclass=w></span>-f<spanclass=w></span>oauth2-proxy.yaml
</code></pre></div></li></ol><h4id=test>Test<aclass=headerlinkhref=#testtitle="Permanent link"> ¶</a></h4><p>Test the integration by accessing the configured URL, e.g. <code>https://foo.bar.com</code></p><p><imgalt="Register OAuth2 Application"src=images/github-auth.png></p><p><imgalt="GitHub authentication"src=images/oauth-login.png></p><p><imgalt="Kubernetes dashboard"src=images/dashboard.png></p><h3id=example-vouch-proxy-kubernetes-dashboard>Example: Vouch Proxy + Kubernetes-Dashboard<aclass=headerlinkhref=#example-vouch-proxy-kubernetes-dashboardtitle="Permanent link"> ¶</a></h3><p>This example will show you how to deploy <ahref=https://github.com/vouch/vouch-proxy><code>Vouch Proxy</code></a> into a Kubernetes cluster and use it to protect the Kubernetes Dashboard using GitHub as the OAuth2 provider.</p><h4id=prepare_1>Prepare<aclass=headerlinkhref=#prepare_1title="Permanent link"> ¶</a></h4><ol><li><p>Install the kubernetes dashboard</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl create -f https://raw.githubusercontent.com/kubernetes/kops/master/addons/kubernetes-dashboard/v1.10.1.yaml</span>
</code></pre></div></li><li><p>Create a <ahref=https://github.com/settings/applications/new>custom GitHub OAuth application</a></p><p><imgalt="Register OAuth2 Application"src=images/register-oauth-app.png></p><ul><li>Homepage URL is the FQDN in the Ingress rule, like <code>https://foo.bar.com</code></li><li>Authorization callback URL is the same as the base FQDN plus <code>/oauth2/auth</code>, like <code>https://foo.bar.com/oauth2/auth</code></li></ul><p><imgalt="Register OAuth2 Application"src=images/register-oauth-app-2.png></p></li><li><p>Configure Vouch Proxy values in the file <ahref=https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/docs/examples/auth/oauth-external-auth/vouch-proxy.yaml><code>vouch-proxy.yaml</code></a> with the values:</p><ul><li>VOUCH_COOKIE_DOMAIN with value of <code><Ingress Host></code></li><li>OAUTH_CLIENT_ID with the github <code><Client ID></code></li><li>OAUTH_CLIENT_SECRET with the github <code><Client Secret></code></li><li>(optional, but recommended) VOUCH_WHITELIST with GitHub usernames to allow to login</li><li><code>__INGRESS_HOST__</code> with a valid FQDN (e.g. <code>foo.bar.com</code>)</li><li><code>__INGRESS_SECRET__</code> with a Secret with a valid SSL certificate</li></ul></li><li><p>Deploy Vouch Proxy and the ingress rules by running:</p><divclass=highlight><pre><span></span><code><spanclass=gp>$ </span>kubectl<spanclass=w></span>create<spanclass=w></span>-f<spanclass=w></span>vouch-proxy.yaml
</code></pre></div></li></ol><h4id=test_1>Test<aclass=headerlinkhref=#test_1title="Permanent link"> ¶</a></h4><p>Test the integration by accessing the configured URL, e.g. <code>https://foo.bar.com</code></p><p><imgalt="Register OAuth2 Application"src=images/github-auth.png></p><p><imgalt="GitHub authentication"src=images/oauth-login.png></p><p><imgalt="Kubernetes dashboard"src=images/dashboard.png></p></article></div></div></main><footerclass=md-footer><divclass="md-footer-meta md-typeset"><divclass="md-footer-meta__inner md-grid"><divclass=md-copyright> Made with <ahref=https://squidfunk.github.io/mkdocs-material/target=_blankrel=noopener> Material for MkDocs </a></div></div></div></footer></div><divclass=md-dialogdata-md-component=dialog><divclass="md-dialog__inner md-typeset"></div></div><scriptid=__configtype=application/json>{"base":"../../..","features":["navigation.tabs","navigation.tabs.sticky","navigation.instant","navigation.sections"],"search":"../../../assets/javascripts/workers/search.f886a092.min.js","translations":{"clipboard.copied":"Copied to clipboard","clipboard.copy":"Copy to clipboard","search.result.more.one":"1 more on this page","search.result.more.other":"# more on this page","search.result.none":"No matching documents","search.result.one":"1 matching document","search.result.other":"# matching documents","search.result.placeholder":"Type to start searching","search.result.term.missing":"Missing","select.version":"Select version"}}</script><scriptsrc=../../../assets/javascripts/bundle.aecac24b.min.js></script></body></html>
