From 0b12b30cb1ec33335cfeaaa512a6d30961ffcb7b Mon Sep 17 00:00:00 2001 From: Andrew Keesler Date: Fri, 18 Dec 2020 14:13:29 -0800 Subject: [PATCH] Updated diagrams and architecture text Signed-off-by: Margo Crawford --- site/content/docs/architecture.md | 47 ++++++++++++++++--- ...iped_architecture_concierge_supervisor.svg | 3 ++ ...inniped_architecture_concierge_webhook.svg | 3 ++ 3 files changed, 46 insertions(+), 7 deletions(-) create mode 100644 site/content/docs/img/pinniped_architecture_concierge_supervisor.svg create mode 100644 site/content/docs/img/pinniped_architecture_concierge_webhook.svg diff --git a/site/content/docs/architecture.md b/site/content/docs/architecture.md index c3bfb5319..9919cce03 100644 --- a/site/content/docs/architecture.md +++ b/site/content/docs/architecture.md @@ -19,7 +19,7 @@ credential from an identity source (e.g., Pinniped Supervisor, proprietary IDP), authenticates the user via that credential, and returns another credential which is understood by the host Kubernetes cluster. -![Pinniped Architecture Sketch](/docs/img/pinniped_architecture.svg) +![Pinniped Architecture Sketch](/docs/img/pinniped_architecture_concierge_supervisor.svg) Pinniped supports various IDP types and implements different integration strategies for various Kubernetes distributions to make authentication possible. @@ -111,16 +111,21 @@ cluster-specific credential via a Users may use the Pinniped CLI as the credential plugin, or they may use any proprietary CLI built with the [Pinniped Go client library](https://github.com/vmware-tanzu/pinniped/tree/main/generated). -## Example Cluster Authentication Sequence Diagrams -### Concierge With Webhook +## Pinniped Deployment Strategies +Pinniped can be configured to authenticate users in a variety of scenarios. +Depending on the use case, administrators can deploy the Supervisor, the Concierge, +both, or neither. -This diagram demonstrates using `kubectl get pods` with a [Kubernetes client-go credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) -that obtains an external credential to be sent to a webhook authenticator via the Pinniped Concierge. +### Full Integration-- Concierge, Supervisor, and CLI -![concierge-with-webhook-sequence-diagram](/docs/img/pinniped-concierge-sequence.svg) +Users can authenticate with the help of the Supervisor, which will issue tokens that +can be exchanged at the Concierge for a credential that is understood by the host Kubernetes +cluster. +The Supervisor enables users to log in to their external identity provider +once per day and access each cluster in a domain with a distinct scoped-down token. -### Concierge with Supervisor +![concierge-with-supervisor-architecture-diagram](/docs/img/pinniped_architecture_concierge_supervisor.svg) This diagram demonstrates using `kubectl get pods` with the Pinniped CLI functioning as a [Kubernetes client-go credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) @@ -128,3 +133,31 @@ that obtains a federation ID token from the Pinniped Supervisor to be sent to a JWT authenticator via the Pinniped Concierge. ![concierge-with-supervisor-sequence-diagram](/docs/img/pinniped-concierge-supervisor-sequence.svg) + +### Dynamic Cluster Authentication-- Concierge and CLI + +Users can authenticate directly with their OIDC compliant external identity provider to get credentials which +can be exchanged at the Concierge for a credential that is understood by the host Kubernetes +cluster. + +![concierge-with-webhook-architecture-diagram](/docs/img/pinniped_architecture_concierge_webhook.svg) + +This diagram demonstrates using `kubectl get pods` with a [Kubernetes client-go credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) +that obtains an external credential to be sent to a webhook authenticator via the Pinniped Concierge. + +![concierge-with-webhook-sequence-diagram](/docs/img/pinniped-concierge-sequence.svg) + +### Static Cluster Integration-- Supervisor and CLI + +Users can authenticate with the help of the Supervisor, which will issue tokens that +can be given directly to a Kubernetes API Server that has been configured with +[OIDC Authentication.](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) +The Supervisor enables users to log in to their external identity provider +once per day and access each cluster in a domain with a distinct scoped-down token. + +### Minimal-- CLI only + +Users can authenticate directly with their OIDC compliant external identity provider to get credentials +that can be given directly to a Kubernetes API Server that has been configured with +[OIDC Authentication.](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) + diff --git a/site/content/docs/img/pinniped_architecture_concierge_supervisor.svg b/site/content/docs/img/pinniped_architecture_concierge_supervisor.svg new file mode 100644 index 000000000..a03718295 --- /dev/null +++ b/site/content/docs/img/pinniped_architecture_concierge_supervisor.svg @@ -0,0 +1,3 @@ + + +
Identity Provider
Identity Provider
Workload Kubernetes Cluster
Workload Kubernetes...
Client Machine
Client Machine
Pinniped Concierge
Pinniped Concier...
Pod
Pod
Pod
Pod
Pinniped's Aggregated API
Pinniped's Ag...
Pinniped's exec plugin
Pinniped's ex...
"kubectl get pods"
"kubectl get pods"
3.) Credential Exchange Request
3.) Credential...
5.) "get pods" Request Including Auth
5.) "get pods"...
Kubernetes API Server
Kubernetes API Server
4.) Confirm User Identity
4.) Confirm Us...
Supervisor Kubernetes Cluster
Supervisor Kubernet...
Pinniped Supervisor
Pinniped Supervi...
Pod
Pod
Pod
Pod
1.) Perform federated OIDC login
1.) Perform fe...
2.) Perform OIDC login to external IDP
2.) Perform OI...Viewer does not support full SVG 1.1 \ No newline at end of file diff --git a/site/content/docs/img/pinniped_architecture_concierge_webhook.svg b/site/content/docs/img/pinniped_architecture_concierge_webhook.svg new file mode 100644 index 000000000..eb69bf0e7 --- /dev/null +++ b/site/content/docs/img/pinniped_architecture_concierge_webhook.svg @@ -0,0 +1,3 @@ + + +
Identity Provider
Identity Provider
Kubernetes Cluster
Kubernetes Cluster
Client Machine
Client Machine
Pinniped Concierge
Pinniped Concier...
Pod
Pod
Pod
Pod
Pinniped's Aggregated API
Pinniped's Ag...
Pinniped's exec plugin
Pinniped's ex...
"kubectl get pods"
"kubectl get pods"
1.) Credential Exchange Request
1.) Credential...
3.) "get pods" Request Including Auth
3.) "get pods"...
Kubernetes API Server
Kubernetes API Server
2.) Confirm User Identity
2.) Confirm Us...Viewer does not support full SVG 1.1 \ No newline at end of file