What is the biggest challenge you/your org faces while running k8s in production?

• lens

  113 22,198 9.3 TypeScript

  Lens - The way the world runs Kubernetes

  

https://k8slens.dev/ solves this exact issue via a feature called Spaces... Long story short, Cluster admin can give specific access to a Kubernetes cluster without sharing the KubeConfig file... You can create specific teams for your "Space" and give different access to each team via role bindings etc... It's pretty neat. Here's a blog that explains this in depth and how to do it... https://medium.com/k8slens/how-to-give-developers-secure-access-to-kubernetes-clusters-c6025f0dd288

• kube-oidc-proxy

  5 476 1.8 Go

  Reverse proxy to authenticate to managed Kubernetes API servers via OIDC.

  

We use Keycloak for this purpose. We deploy an OIDC-proxy to the kube-api (https://github.com/jetstack/kube-oidc-proxy), then use the kubectl plugin 'kubelogin' (aka oidc-login if you use krew - https://github.com/int128/kubelogin). This gives us the ability to have no user secrets in our KUBECONFIG, and to use Keycloak's Active Directory/LDAP user & group federation to control access to clusters. With this, downloading the KUBECONFIG is self-service, and adding users to new clusters is as easy as adding them to a group in AD.

• SurveyJS

  surveyjs.io featured

  Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App. With SurveyJS form UI libraries, you can build and style forms in a fully-integrated drag & drop form builder, render them in your JS app, and store form submission data in any backend, inc. PHP, ASP.NET Core, and Node.js.

  

• kubelogin

  14 1,534 8.8 Go

  kubectl plugin for Kubernetes OpenID Connect authentication (kubectl oidc-login)

We use Keycloak for this purpose. We deploy an OIDC-proxy to the kube-api (https://github.com/jetstack/kube-oidc-proxy), then use the kubectl plugin 'kubelogin' (aka oidc-login if you use krew - https://github.com/int128/kubelogin). This gives us the ability to have no user secrets in our KUBECONFIG, and to use Keycloak's Active Directory/LDAP user & group federation to control access to clusters. With this, downloading the KUBECONFIG is self-service, and adding users to new clusters is as easy as adding them to a group in AD.

Suggest a related project