-
Notifications
You must be signed in to change notification settings - Fork 891
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use hashFromEnv in dex component for static user passwords #2229
Use hashFromEnv in dex component for static user passwords #2229
Conversation
12595f1
to
14c5e1c
Compare
@krishnadurai could you please review? |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: krishnadurai, mvoitko The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
@krishnadurai @yanniszark Could you please add the lgtm label so I merge the PR? |
Hi @mvoitko, can you please explain the purpose of this change. |
Please put this on the agenda of the next manifest wg meeting in two weeks and join us for a discussion |
I'm sorry, I don't know how to do this. Could you please help with the link to the agenda and the meeting? |
Yes of course. https://www.kubeflow.org/docs/about/community/#kubeflow-community-calendars here you can find all community meetings and join slack and the channel manifests-wg as well. In the calendar entry you can also find the meeting notes on google documents. |
/lgtm and the owner @krishnadurai approved |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This PR made Kubeflow not usable through WEB UI because of auth misconfiguration.
@mvoitko can you fix those two simple issues?
metadata: | ||
name: dex-passwords | ||
data: | ||
DEX_USER_PASSWORD: $2y$12$4K/VkmDd1q1Orb3xAt82zu8gk7Ad6ReFR4LCP9UeYE90NLiN9Df72 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This value should be encrypted with base64 or provided as stringData.DEX_USER_PASSWORD
.
Using this in current form presents this error on kubectl apply
:
Error from server (BadRequest): error when creating "STDIN": Secret in version "v1" cannot be handled as a Secret: illegal base64 data at input byte 52
@@ -0,0 +1,6 @@ | |||
apiVersion: v1 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This file is not added to kustomization.yaml
in resources
section. Installing Kubeflow with this version renders dex as CreateContainerConfigError
:
$ kubectl -n auth describe pod -l app=dex
(...)
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 39s default-scheduler Successfully assigned auth/dex-86f655645d-qc92d to kind-worker2
Normal Pulled 11s (x4 over 38s) kubelet Container image "ghcr.io/dexidp/dex:v2.36.0" already present on machine
Warning Failed 11s (x4 over 38s) kubelet Error: secret "dex-passwords" not found
@kromanow94 you can also create a PR and I can approve :-) this here was approved by a probably stale owner @krishnadurai by accident then. |
The dex-passwords secret didn't have the secret defined properly and the secret wasn't added to the dex kustomization file.
Contributions: * kubeflow/manifests#2544 * kubeflow/manifests#2588 * kubeflow/manifests#2516 * kubeflow/manifests#2517 * kubeflow/manifests#2229 (review) * kubeflow/kubeflow#7437 (comment) * https://kubeflow.slack.com/archives/CKBA5D0MU/p1702465109437099 * https://kubeflow.slack.com/archives/C01A7RYEYMB/p1702556772959959 * https://kubeflow.slack.com/archives/CE10KS9M4/p1700672066110009 * https://kubeflow.slack.com/archives/CE10KS9M4/p1700672066110009
Contributions: * kubeflow/manifests#2544 * kubeflow/manifests#2588 * kubeflow/manifests#2516 * kubeflow/manifests#2517 * kubeflow/manifests#2229 (review) * kubeflow/kubeflow#7437 (comment) * https://kubeflow.slack.com/archives/CKBA5D0MU/p1702465109437099 * https://kubeflow.slack.com/archives/C01A7RYEYMB/p1702556772959959 * https://kubeflow.slack.com/archives/CE10KS9M4/p1700672066110009 * https://kubeflow.slack.com/archives/CE10KS9M4/p1700672066110009
Which issue is resolved by this Pull Request:
Resolves #
Description of your changes:
Checklist:
Make sure you have installed kustomize == 3.2.1
make generate-changed-only
make test