Added documentation for LDAP (#658)
* Added documentation for LDAP Related to #133 Inspired by https://github.com/jenkinsci/kubernetes-operator/issues/133#issuecomment-555976832
This commit is contained in:
kalle (jag)
GitHub
parent
14b0018a7f
commit
b4345b2905
|
|
@ -0,0 +1,128 @@
|
||||||
|
---
|
||||||
|
title: "LDAP"
|
||||||
|
linkTitle: "LDAP"
|
||||||
|
weight: 9
|
||||||
|
date: 2021-09-30
|
||||||
|
description: >
|
||||||
|
Additional configuration for LDAP
|
||||||
|
---
|
||||||
|
|
||||||
|
Configuring LDAP is not supported out of the box, but can be achieved through
|
||||||
|
plugins and some well tuned configurations.
|
||||||
|
|
||||||
|
The plugin we will use is: <https://plugins.jenkins.io/ldap/>
|
||||||
|
|
||||||
|
> Note: This is an example of how LDAP authentication can be achieved. The LDAP
|
||||||
|
> plugin is from a third-party, and there may be other alternatives that suits
|
||||||
|
> your use case better. Use this guide with a grain of salt.
|
||||||
|
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
- LDAP server accessible from the Kubernetes cluster where your Jenkins
|
||||||
|
instance will live.
|
||||||
|
|
||||||
|
- Credentials to a manager account in your AD. Jenkins Operator will use
|
||||||
|
this account to authenticate with Jenkins for health checks, seed jobs, etc.
|
||||||
|
|
||||||
|
## Steps
|
||||||
|
|
||||||
|
In your Jenkins configuration, add the following plugin:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
plugins:
|
||||||
|
# Check https://plugins.jenkins.io/ldap/ to find the latest version.
|
||||||
|
- name: ldap
|
||||||
|
version: "2.7"
|
||||||
|
```
|
||||||
|
|
||||||
|
Easiest step is to then start up Jenkins then navigate to your instance's
|
||||||
|
"Configure Global Security" page and configure it accordingly.
|
||||||
|
|
||||||
|
`http://jenkins.example.com/configureSecurity/`
|
||||||
|
|
||||||
|
Once it's set up and tested, you can navigate to your JCasC page and export
|
||||||
|
the LDAP settings.
|
||||||
|
|
||||||
|
`https://jenkins.example.com/configuration-as-code/`
|
||||||
|
|
||||||
|
Feed the relevant new settings into your Kubernetes ConfigMap for your JCasC
|
||||||
|
settings.
|
||||||
|
|
||||||
|
Here's a snippet of the LDAP-related configurations:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: jenkins-casc
|
||||||
|
data:
|
||||||
|
ldap.yaml: |
|
||||||
|
jenkins:
|
||||||
|
securityRealm:
|
||||||
|
ldap:
|
||||||
|
configurations:
|
||||||
|
- displayNameAttributeName: "name"
|
||||||
|
groupSearchBase: "OU=Groups,OU=MyCompany"
|
||||||
|
groupSearchFilter: "(& (cn={0}) (objectclass=group) )"
|
||||||
|
inhibitInferRootDN: false
|
||||||
|
managerDN: "CN=Jenkins Admin,OU=UsersSystem,OU=UsersOther,OU=MyCompany,DC=mycompany,DC=local"
|
||||||
|
managerPasswordSecret: "${LDAP_MANAGER_PASSWORD}"
|
||||||
|
rootDN: "DC=mycompany,DC=local"
|
||||||
|
server: "MyCompany.local"
|
||||||
|
userSearch: "SamAccountName={0}"
|
||||||
|
userSearchBase: "OU=MyCompany"
|
||||||
|
disableMailAddressResolver: false
|
||||||
|
disableRolePrefixing: true
|
||||||
|
groupIdStrategy: "caseInsensitive"
|
||||||
|
userIdStrategy: "caseInsensitive"
|
||||||
|
```
|
||||||
|
|
||||||
|
> Note the use of `${LDAP_MANAGER_PASSWORD}` above. You can reference
|
||||||
|
> Kubernetes secrets in your JCasC ConfigMaps by adding the following to your
|
||||||
|
> Jenkins object:
|
||||||
|
>
|
||||||
|
> ```yaml
|
||||||
|
> kind: Jenkins
|
||||||
|
> spec:
|
||||||
|
> configurationAsCode:
|
||||||
|
> configurations:
|
||||||
|
> - name: jenkins-casc
|
||||||
|
> secret:
|
||||||
|
> # This here
|
||||||
|
> name: jenkins-casc-secrets
|
||||||
|
> ```
|
||||||
|
>
|
||||||
|
> ```yaml
|
||||||
|
> apiVersion: v1
|
||||||
|
> kind: Secret
|
||||||
|
> metadata:
|
||||||
|
> name: jenkins-cred-conf-secrets
|
||||||
|
> stringData:
|
||||||
|
> LDAP_MANAGER_PASSWORD: <password-for-manager-created-in-ldap>
|
||||||
|
> ```
|
||||||
|
>
|
||||||
|
> Schema reference: [v1alpha2.ConfigurationAsCode](./schema/#github.com/jenkinsci/kubernetes-operator/pkg/apis/jenkins/v1alpha2.ConfigurationAsCode)
|
||||||
|
|
||||||
|
Finally you must configure the Jenkins operator to use the manager's
|
||||||
|
credentials from the AD.
|
||||||
|
|
||||||
|
This is because this procedure will disable Jenkins' own user database, and the
|
||||||
|
Jenkins operator still needs to be able to talk to Jenkins in an authorized
|
||||||
|
manner.
|
||||||
|
|
||||||
|
Create the following Kubernetes secret:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: jenkins-operator-credentials-<jenkins-cr-name>
|
||||||
|
namespace: <jenkins-cr-namespace>
|
||||||
|
stringData:
|
||||||
|
user: <username-for-manager-created-in-ldap>
|
||||||
|
password: <password-for-manager-created-in-ldap>
|
||||||
|
```
|
||||||
|
|
||||||
|
> Note: Values in stringData do not need to be base64 encoded. They are
|
||||||
|
> encoded by Kubernetes when the manifest is applied.
|
||||||
|
|
||||||
Loading…
Reference in New Issue