Configuring your cluster for impersonation
Let’s deploy an impersonating proxy for our cluster. Just like integrating our cluster directly into OpenUnison using OpenID Connect, we’ve automated the deployment so that you don’t need to manually configure OpenUnison. We’ll clear out our old cluster and start afresh:
cd Kubernetes-An-Enterprise-Guide-Third-Edition/chapter2
kind delete cluster -n cluster01
./create-cluster.sh
cd ../chapter6/user-auth
./deploy_openunison_imp_impersonation.sh
The differences between this script and our original script are:
- Configuring OpenUnison to generate
NetworkPolicyobjects to limit access to just requests from our NGINXIngresscontroller and the API server - Configuring OpenUnison’s
ServiceAccounttoken to only be valid for 10 minutes instead of the typical hour or day - Configuring the OpenUnison
values.yamlto deploy the kube-oidc-proxy to handle incoming API server requests - Creating...
