You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/content/concepts/authentication/index.md
+12-12Lines changed: 12 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ For detailed instructions on running kcp with a specific authentication strategy
13
13
14
14
-[OIDC]
15
15
16
-
## KCP Front Proxy Authentication
16
+
## kcp Front Proxy Authentication
17
17
18
18
kcp-front-proxy is a reverse proxy that accepts client certificates and forwards Common Name (as username) and Organizations (as groups) to the backend API servers in HTTP headers. The proxy terminates TLS and communicates with API servers via mTLS. Traffic is routed based on paths.
19
19
@@ -50,30 +50,30 @@ These can be passed by setting `--authentication-pass-on-groups` and `--authenti
50
50
By default, kcp-front-proxy is configured to drop `system:masters` and `system:kcp:logical-cluster-admin`.
51
51
This ensures that highly privileged users do not receive elevated access when passing through the proxy.
52
52
53
-
## KCP Server Admin Authentication
53
+
## kcp Server Admin Authentication
54
54
55
55
Admin Authenticator sets up user roles and groups and generates authentication tokens and `admin.kubeconfig` file. The authentication process relies on Kubernetes authenticated group authenticator.
56
56
To enable admin authentication in the kcp server, you need run it in the development mode with the `--batteries-included=admin` flag set.
57
57
This setting is currently enabled by default when running the `kcp` binary, but is disabled in the Helm chart.
|**shard-admin**| Member of the privileged system group. This user bypasses most kcp authorization checks. | system:masters|
64
+
|**kcp-admin**| Member of the system:kcp:admin group. This user is subject to kcp authorization checks. | system:kcp:admin|
65
+
|**user**| Regular non-admin user who is not a part of any predefined groups. | None |
66
66
67
67
### Generated Kubeconfig Contexts
68
68
69
69
kcp server generates a kubeconfig file (admin.kubeconfig) containing credentials for the predefined users. This file allows users to authenticate into different logical clusters.
0 commit comments