You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/authentication/proc-enabling-user-authentication-with-rhbk.adoc
-1Lines changed: 0 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -157,7 +157,6 @@ catalog:
157
157
schedule:
158
158
initialDelay: { seconds: 15}
159
159
----
160
-
--
161
160
162
161
. To set up the {rhbk} authentication provider in your {product-short} custom configuration, edit your custom {product-short} ConfigMap such as `app-config-rhdh`, and add the following lines to the `{my-app-config-file}` content:
= Configuring an {product-very-short} instance with a TLS connection in Kubernetes
3
3
4
4
You can configure a {product-very-short} instance with a Transport Layer Security (TLS) connection in a Kubernetes cluster, such as an Azure Red Hat OpenShift (ARO) cluster, any cluster from a supported cloud provider, or your own cluster with proper configuration. Transport Layer Security (TLS) ensures a secure connection for the {product-very-short} instance with other entities, such as third-party applications, or external databases. However, you must use a public Certificate Authority (CA)-signed certificate to configure your Kubernetes cluster.
{product-short} stores data in a PostgreSQL database.
8
+
For resiliency, use an external database and include it in your disaster recovery plan.
9
+
10
+
Redis cache::
11
+
For efficiency, {product-short} caches plugin and Techdocs assets when your provide a Redis cache server.
12
+
13
+
GitHub API access::
14
+
Provide credentials to a GitHub app to enable access to the GitHub API for repository discovery.
15
+
16
+
Connection to your identity provider::
17
+
Provide credentials to your identity provider to enable user provisioning and authentication.
18
+
19
+
.Procedure
20
+
. Get your Redis cache server connection string, such as `redis://user:[email protected]:6379`.
21
+
22
+
23
+
. To allow {product-short} to access the GitHub API for repository, create a GitHub App.
24
+
Opt for a GitHub App instead of an OAuth app to use fine-grained permissions, gain more control over which repositories the application can access, and use short-lived tokens.
25
+
26
+
.. link:https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app[Register a GitHub App] with the following configuration:
27
+
28
+
GitHub App name::
29
+
Enter a unique name identifying your GitHub App, such as `integrating-with-rhdh-__<GUID>__`.
30
+
31
+
Homepage URL::
32
+
Enter your {product-short} URL: `pass:c,a,q[{my-product-url}]`.
33
+
34
+
Authorization callback URL::
35
+
Enter your {product-short} authentication backend URL: `pass:c,a,q[{my-product-url}/api/auth/github/handler/frame]`.
36
+
37
+
Webhook::
38
+
Clear "Active", as this is not needed for authentication and catalog providers.
39
+
40
+
App permissions::
41
+
Select permissions to define the level of access for the app.
42
+
Adapt permissions to your needs:
43
+
44
+
Reading software components:::
45
+
46
+
Contents::::
47
+
`Read-only`
48
+
49
+
Commit statuses::::
50
+
`Read-only`
51
+
52
+
Reading organization data:::
53
+
54
+
Members::::
55
+
`Read-only`
56
+
57
+
Publishing software templates:::
58
+
Set permissions if you intend to use the same GitHub App for software templates.
59
+
60
+
Administration::::
61
+
`Read & write` (for creating repositories)
62
+
63
+
Contents::::
64
+
`Read & write`
65
+
66
+
Metadata::::
67
+
`Read-only`
68
+
69
+
Pull requests::::
70
+
`Read & write`
71
+
72
+
Issues::::
73
+
`Read & write`
74
+
75
+
Workflows::::
76
+
`Read & write` (if templates include GitHub workflows)
77
+
78
+
Variables::::
79
+
`Read & write` (if templates include GitHub Action Repository Variables)
80
+
81
+
Secrets::::
82
+
`Read & write` (if templates include GitHub Action Repository Secrets)
83
+
84
+
Environments::::
85
+
`Read & write` (if templates include GitHub Environments)
86
+
87
+
Organization permissions::
88
+
Members:::
89
+
`Read-only`
90
+
91
+
Where can this GitHub App be installed?::
92
+
Select `Only on this account`.
93
+
94
+
.. In the *General* -> *Clients secrets* section, click *Generate a new client secret*.
95
+
96
+
.. In the *General* -> *Private keys* section, click *Generate a private key*.
97
+
98
+
.. In the *Install App* tab, choose an account to install your GitHub App on.
Copy file name to clipboardExpand all lines: modules/configuring/proc-provisioning-your-custom-configuration.adoc
+31-51Lines changed: 31 additions & 51 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,50 +12,41 @@ Your changes on this configuration might get reverted on {product-short} restart
12
12
.Prerequisites
13
13
* By using the link:https://docs.redhat.com/en/documentation/openshift_container_platform/{ocp-version}/html-single/cli_tools/index#cli-about-cli_cli-developer-commands[{openshift-cli}], you have access, with developer permissions, to the {ocp-short} cluster aimed at containing your {product-short} instance.
. Author your custom `_<my_product_secrets>_.txt` file to provision your secrets as environment variables values in an {ocp-short} secret, rather than in clear text in your configuration files.
17
-
It contains one secret per line in `KEY=value` form.
18
+
. For security, store your secrets as environment variables values in an {ocp-short} secret,
19
+
rather than in clear text in your configuration files.
20
+
Collect all your secrets in the `secrets.txt` file, with one secret per line in `KEY=value` form.
18
21
+
19
-
* link:{authentication-book-url}[Enter your authentication secrets].
** To prepare a deployment with the {product} Operator on {ocp-short}, you can start with an empty file.
27
-
28
-
** To prepare a deployment with the {product} Helm chart, or on Kubernetes, enter the {product-short} base URL in the relevant fields in your `{my-app-config-file}` file to ensure proper functionality of {product-short}.
29
-
The base URL is what a {product-short} user sees in their browser when accessing {product-short}.
30
-
The relevant fields are `baseUrl` in the `app` and `backend` sections, and `origin` in the `backend.cors` subsection:
35
+
. Author your custom `dynamic-plugins.yaml` file to enable plugins.
36
+
Plugins that require configuration are disabled by default.
37
+
Enable the GitHub repository discovery and the Role bases access control (RBAC) features:
31
38
+
32
-
.Configuring the `baseUrl` in `{my-app-config-file}`
Alternatively, link:https://docs.redhat.com/en/documentation/openshift_container_platform/{ocp-version}/html-single/building_applications/index#creating-a-project-using-the-web-console_projects[create the project by using the web console].
70
61
71
-
.. Provision your `{my-app-config-file}` file to the `{my-app-config-config-map}` config map in the _<{my-product-namespace}>_ project.
62
+
.. Provision your `{my-app-config-file}` and `dynamic-plugins.yaml` files respectively to the `{my-app-config-config-map}` and `dynamic-plugins-rhdh` config maps in the _<{my-product-namespace}>_ project.
Alternatively, link:https://docs.redhat.com/en/documentation/openshift_container_platform/{ocp-version}/html-single/nodes/index#nnodes-pods-configmap-create-from-console_configmaps[create the config map by using the web console].
70
+
Alternatively,
71
+
link:https://docs.redhat.com/en/documentation/openshift_container_platform/{ocp-version}/html-single/nodes/index#nnodes-pods-configmap-create-from-console_configmaps[create the config maps by using the web console].
79
72
80
-
.. Provision your `_<my_product_secrets>_.txt` file to the `_<my_product_secrets>_` secret in the _<{my-product-namespace}>_ project.
73
+
.. Provision your `secrets.txt` file to the `{my-product-secrets}` secret in the _<{my-product-namespace}>_ project.
link:https://docs.redhat.com/en/documentation/openshift_container_platform/{ocp-version}/html-single/nodes/index#nodes-pods-secrets-creating-web-console-secrets_nodes-pods-secrets[create the secret by using the web console].
89
82
90
-
[NOTE]
91
-
====
92
-
`_<my_product_secrets>_` is your preferred {product-short} secret name, specifying the identifier for your secret configuration within {product-short}.
93
-
====
94
-
95
-
.Next steps
96
-
Consider provisioning additional config maps and secrets:
97
-
98
-
* To use an external PostgreSQL database, xref:configuring-external-postgresql-databases[provision your PostgreSQL database secrets].
99
-
100
-
101
-
* To enable dynamic plugins, link:{installing-and-viewing-plugins-book-url}[provision your dynamic plugins config map].
102
-
103
-
* To configure authorization by using external files, link:{authorization-book-url}#managing-authorizations-by-using-external-files[provision your RBAC policies config map].
= Using the {product} Operator to run {product-short} with your custom configuration
3
+
4
+
To use the {product-short} Operator to run {product} with your custom configuration, create your {product-custom-resource-type} custom resource (CR) that:
5
+
6
+
* Mounts files provisioned in your custom config maps.
7
+
* Injects environment variables provisioned in your custom secrets.
8
+
9
+
.Prerequisites
10
+
* By using the link:https://docs.redhat.com/en/documentation/openshift_container_platform/{ocp-version}/html-single/cli_tools/index#cli-about-cli_cli-developer-commands[{openshift-cli}], you have access, with developer permissions, to the {ocp-short} cluster aimed at containing your {product-short} instance.
0 commit comments