Anthos Identity Service connects cluster authentication to an existing identity provider through OpenID Connect (OIDC) or LDAP. On Anthos on bare metal, its authentication proxy lets users sign in with corporate credentials through the Google Cloud console or kubectl, rather than maintaining a separate cluster identity source. section 17.4.1 section 5.1.2
Choose when to configure the integration:
- During bare-metal cluster creation, set the authentication section of the cluster configuration file for OIDC or LDAP. section 17.4.1
- After cluster creation, configure authentication through a ClientConfig object or fleet-level Anthos Identity Service. section 17.4.1
authentication:
oidc:
issuerURL: "https://infra.example.dev/adfs"
clientID: "be654652-2c45-49ff-9d7c-3663cee9ba51"
clientSecret: "clientSecret"
kubectlRedirectURL: "http://localhost:44320/callback"
username: "unique_name"
usernamePrefix: "oidc:"
group: "groups"
groupPrefix: "oidc:"
scopes: "allatclaims"
extraParams: "resource=token-groups-claim"
deployCloudConsoleProxy: true
certificateAuthorityData: base64EncodedCACertificate
proxy: http://10.194.2.140:3128
The OIDC configuration example specifies an issuer URL, client credentials, a kubectl redirect URL, username and group claims, and a Cloud Console proxy setting. Replace the example values with those for the intended provider and cluster. section 17.4.1
authentication:
- name: ldap
ldap:
connectionType: ldaps
group:
baseDN: ou=Groups,dc=onpremidp,dc=example,dc=net
filter: (objectClass=*)
identifierAttribute: dn
host: ldap.google.com:636
user:
baseDN: ou=Users,dc=onpremidp,dc=example,dc=net
filter: (objectClass=*)
identifierAttribute: uid
loginAttribute: uid
serviceAccountSecret:
name: google-ldap-client-secret
namespace: anthos-identity-service
type: tls
The LDAP alternative specifies the connection type and host, user and group search settings, and a service-account secret in the anthos-identity-service namespace. section 17.4.1
Sign in for kubectl access
Generate a login configuration with gcloud anthos create-login-config --kubeconfig CLUSTER_KUBECONFIG, then use gcloud anthos auth login with the cluster, user, login-config, certificate, and kubeconfig arguments. The gcloud CLI authenticates the user and creates a kubeconfig containing the ID token used by kubectl; replace the command placeholders with deployment-specific values. section 17.4.1
Check the deployment's supported sign-in paths before relying on console access: as of September 2020, OIDC support for GKE on-prem clusters was described as command-line-only. Authentication integration centralizes identity, but the cited configuration does not define cluster authorization policy. section 5.1.2 section 17.4.1
