SSO and LDAP demo

A complete sign-in setup in one throwaway namespace, to see how Glowpod's SSO and LDAP sign-in work before wiring up your real identity provider:

• lldap, a small LDAP server, with two people:
  • alice in group devs
  • bob in group ops
• Dex, an OIDC provider that signs people in against lldap.
• Glowpod, offering three ways in: SSO through Dex, LDAP straight to lldap, and tokens.
• RBAC in the namespace: devs may look (view), ops may change things (edit).

browser ──► Glowpod ──SSO──► Dex ──► lldap
              │  └──LDAP────────────► lldap
              └──impersonates alice / bob──► Kubernetes API (their RBAC)

It runs over plain HTTP with -insecure-cookies and stores Dex state in memory: fine for a demo, not for real use. See Install in a cluster for that.

You need

• A cluster with an ingress controller that has an IP address you can reach, and that the cluster's pods can reach too (Glowpod talks to Dex through it).
• kubectl, helm, curl and python3.
• A Glowpod image in a registry the cluster can pull from (make image-push IMAGE=registry.example.com/you/glowpod).

Hostnames come from nip.io, which resolves anything.<ip>.nip.io to <ip>, so there's no DNS to set up.

Run it

From the repository root:

INGRESS_IP=192.168.64.240          # your ingress controller's address
export BASE_DOMAIN=$INGRESS_IP.nip.io

deploy/examples/sso-demo/setup.sh

sed "s/\${BASE_DOMAIN}/$BASE_DOMAIN/g" deploy/examples/sso-demo/values.yaml |
  helm upgrade --install glowpod deploy/helm/glowpod -n glowpod-demo -f - \
    --set image.repository=registry.example.com/you/glowpod --set image.tag=0.1.0

helm test glowpod -n glowpod-demo

setup.sh creates the namespace glowpod-demo (override with NS=...), random passwords in Secrets, the two people, Dex's config and the RoleBindings. Running it again keeps the same passwords.

Sign in

Open http://glowpod.<ingress-ip>.nip.io. Read the passwords from the cluster:

kubectl -n glowpod-demo get secret demo-users -o jsonpath='{.data.alice}' | base64 -d; echo
kubectl -n glowpod-demo get secret demo-users -o jsonpath='{.data.bob}' | base64 -d; echo

Neither can see other namespaces: they only have RoleBindings here, so type glowpod-demo in the namespace picker. Switch to Deep mode and open the avatar menu to see the groups Glowpod signed you in with.

Try a token too:

kubectl -n glowpod-demo create serviceaccount demo-viewer
kubectl -n glowpod-demo create rolebinding demo-viewer --clusterrole=view --serviceaccount=glowpod-demo:demo-viewer
kubectl -n glowpod-demo create token demo-viewer --duration=1h

How the pieces map to a real setup

Sign-in and access has the settings for each provider.

Clean up

helm uninstall glowpod -n glowpod-demo
kubectl delete namespace glowpod-demo