Gitlab Authenticator

Guard installation guide can be found here. To use Gitlab, you need a client cert with Organization set to Gitlab. To ease this process, use the Guard cli to issue a client cert/key pair.

$ guard init client {common-name} -o Gitlab

Deploy Guard Server

To generate installer YAMLs for guard server you can use the following command.

$ guard get installer \
    --auth-providers="gitlab" \
    > installer.yaml

$ kubectl apply -f installer.yaml

Additional flags for gitlab:

# Base url for GitLab, keep empty to use default gitlab base url
--gitlab.base-url=<base_url>

# Use group ID for authentication instead of group full path (default: false)
--gitlab.use-group-id

The GitLab base-url needs to include the path to the API. For example https://<base-url>/api/v4

Please note that, since 0.3.0 release, Guard server will return group full path as groups in UserInfo. This will cahnge how subgroups are returned in UserInfo. Also note that, group names are not stable and editable in Gitlab. To returns group ids (stable) in UserInfo, set --gitlab.use-group-id=true in guard server binary.

$ guard get installer \
    --auth-providers="gitlab" \
    --gitlab.use-group-id=true \
    > installer.yaml

Issue Token

To use Gitlab authentication, you can use your personal access token with scope api. You can use the following command to issue a token:

$ guard get token -o gitlab

gitlab-token

Guard uses the token found in TokenReview request object to read user’s profile information and list of groups this user is member of. In the TokenReview response, status.user.username is set to user’s Gitlab login, status.user.groups is set to the list of the groups where this user is a member.

gitlab-webhook-flow

{
  "apiVersion": "authentication.k8s.io/v1",
  "kind": "TokenReview",
  "status": {
    "authenticated": true,
    "user": {
      "username": "<gitlab-login>",
      "uid": "<gitlab-id>",
      "groups": [
        "<group-1>",
        "<group-2>"
      ]
    }
  }
}

Configure Kubectl

kubectl config set-credentials <user_name> --token=<token>

Or You can add user in .kube/confg file

...
users:
- name: <user_name>
  user:
    token: <token>
$ kubectl get pods --all-namespaces --user <user_name>
NAMESPACE     NAME                               READY     STATUS    RESTARTS   AGE
kube-system   etcd-minikube                      1/1       Running   0          7h
kube-system   kube-addon-manager-minikube        1/1       Running   0          7h
kube-system   kube-apiserver-minikube            1/1       Running   1          7h
kube-system   kube-controller-manager-minikube   1/1       Running   0          7h
kube-system   kube-dns-6f4fd4bdf-f7csh           3/3       Running   0          7h