@@ -197,7 +197,7 @@ Install cert-manager:
197197kustomize build common/cert-manager/base | kubectl apply -f -
198198kustomize build common/cert-manager/kubeflow-issuer/base | kubectl apply -f -
199199echo " Waiting for cert-manager to be ready ..."
200- kubectl wait --for=condition=ready pod -l ' app in (cert-manager,webhook)' --timeout=180s -n cert-manager
200+ kubectl wait --for=condition=Ready pod -l ' app in (cert-manager,webhook)' --timeout=180s -n cert-manager
201201kubectl wait --for=jsonpath=' {.subsets[0].addresses[0].targetRef.kind}' =Pod endpoints -l ' app in (cert-manager,webhook)' --timeout=180s -n cert-manager
202202```
203203
@@ -239,7 +239,7 @@ echo "Installing oauth2-proxy..."
239239# tokens to be used from outside the cluster via the Istio ingress-gateway.
240240#
241241kustomize build common/oauth2-proxy/overlays/m2m-dex-only/ | kubectl apply -f -
242- kubectl wait --for=condition=ready pod -l ' app.kubernetes.io/name=oauth2-proxy' --timeout=180s -n oauth2-proxy
242+ kubectl wait --for=condition=Ready pod -l ' app.kubernetes.io/name=oauth2-proxy' --timeout=180s -n oauth2-proxy
243243
244244# Option 2: works on Kind, K3D, Rancher, GKE, and many other clusters with the proper configuration, and allows K8s service account tokens to be used
245245# from outside the cluster via the Istio ingress-gateway. For example, for automation with GitHub Actions.
@@ -250,15 +250,15 @@ kubectl wait --for=condition=ready pod -l 'app.kubernetes.io/name=oauth2-proxy'
250250# from a pod in the cluster should provide you with the issuer of your cluster.
251251#
252252# kustomize build common/oauth2-proxy/overlays/m2m-dex-and-kind/ | kubectl apply -f -
253- # kubectl wait --for=condition=ready pod -l 'app.kubernetes.io/name=oauth2-proxy' --timeout=180s -n oauth2-proxy
254- # kubectl wait --for=condition=ready pod -l 'app.kubernetes.io/name=cluster-jwks-proxy' --timeout=180s -n istio-system
253+ # kubectl wait --for=condition=Ready pod -l 'app.kubernetes.io/name=oauth2-proxy' --timeout=180s -n oauth2-proxy
254+ # kubectl wait --for=condition=Ready pod -l 'app.kubernetes.io/name=cluster-jwks-proxy' --timeout=180s -n istio-system
255255
256256# OPTION 3: works on most EKS clusters with K8s service account
257257# tokens to be used from outside the cluster via the Istio ingress-gateway.
258258# You have to adjust AWS_REGION and CLUSTER_ID in common/oauth2-proxy/overlays/m2m-dex-and-eks/ first.
259259#
260260# kustomize build common/oauth2-proxy/overlays/m2m-dex-and-eks/ | kubectl apply -f -
261- # kubectl wait --for=condition=ready pod -l 'app.kubernetes.io/name=oauth2-proxy' --timeout=180s -n oauth2-proxy
261+ # kubectl wait --for=condition=Ready pod -l 'app.kubernetes.io/name=oauth2-proxy' --timeout=180s -n oauth2-proxy
262262```
263263
264264If and after you finish the installation with Kubernetes service account token support, you should be able to create and use the tokens:
@@ -280,7 +280,7 @@ Install Dex:
280280``` sh
281281echo " Installing Dex..."
282282kustomize build common/dex/overlays/oauth2-proxy | kubectl apply -f -
283- kubectl wait --for=condition=ready pods --all --timeout=180s -n auth
283+ kubectl wait --for=condition=Ready pods --all --timeout=180s -n auth
284284```
285285
286286To connect to your desired identity providers (LDAP, GitHub, Google, Microsoft, OIDC, SAML, GitLab), please take a look at < https://dexidp.io/docs/connectors/oidc/ > . We recommend using OIDC in general since it is compatible with most providers. For example, Azure in the following example. You need to modify < https://github.com/kubeflow/manifests/blob/master/common/dex/overlays/oauth2-proxy/config-map.yaml > and add some environment variables in < https://github.com/kubeflow/manifests/blob/master/common/dex/base/deployment.yaml > by adding a patch section in your main Kustomization file. For guidance, please check out [ Upgrading and Extending] ( #upgrading-and-extending ) .
0 commit comments