From a556f8f2bf65720e12c4c14e5cc9e1f46fbe3442 Mon Sep 17 00:00:00 2001 From: Florian Ruynat <16313165+floryut@users.noreply.github.com> Date: Fri, 11 Sep 2020 09:30:14 +0200 Subject: [PATCH] Remove deprecated (and removed in 1.19) flag and function --basic-auth-file (#6655) --- docs/getting-started.md | 2 +- docs/vars.md | 8 -------- .../group_vars/k8s-cluster/k8s-cluster.yml | 16 +--------------- .../ansible/templates/dashboard.yml.j2 | 2 +- roles/kubernetes/master/defaults/main/main.yml | 1 - roles/kubernetes/master/tasks/main.yml | 4 ---- roles/kubernetes/master/tasks/users-file.yml | 14 -------------- .../master/templates/known_users.csv.j2 | 4 ---- .../templates/kubeadm-config.v1beta2.yaml.j2 | 10 +--------- roles/kubespray-defaults/defaults/main.yaml | 11 ----------- ...acket_ubuntu18-flannel-containerd-ha-once.yml | 1 - .../packet_ubuntu18-flannel-containerd-ha.yml | 1 - 12 files changed, 4 insertions(+), 70 deletions(-) delete mode 100644 roles/kubernetes/master/tasks/users-file.yml delete mode 100644 roles/kubernetes/master/templates/known_users.csv.j2 diff --git a/docs/getting-started.md b/docs/getting-started.md index f208892a8..ab1d6e79f 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -95,7 +95,7 @@ the Kubernetes [documentation](https://kubernetes.io/docs/tasks/access-applicati Supported version is kubernetes-dashboard v2.0.x : -- Login options are : token/kubeconfig by default, basic can be enabled with `kube_basic_auth: true` inventory variable - not recommended because this requires ABAC api-server which is not tested by kubespray team +- Login option : token/kubeconfig by default - Deployed by default in "kube-system" namespace, can be overridden with `dashboard_namespace: kubernetes-dashboard` in inventory, - Only serves over https diff --git a/docs/vars.md b/docs/vars.md index 53e55b91c..710695e2b 100644 --- a/docs/vars.md +++ b/docs/vars.md @@ -209,11 +209,3 @@ in the form of dicts of key-value pairs of configuration parameters that will be * *helm_version* - Defaults to v3.x, set to a v2 version (e.g. `v2.16.1` ) to install Helm 2.x (will install Tiller!). Picking v3 for an existing cluster running Tiller will leave it alone. In that case you will have to remove Tiller manually afterwards. - -## User accounts - -The variable `kube_basic_auth` is false by default, but if set to true, a user with admin rights is created, named `kube`. -The password can be viewed after deployment by looking at the file -`{{ credentials_dir }}/kube_user.creds` (`credentials_dir` is set to `{{ inventory_dir }}/credentials` by default). This contains a randomly generated -password. If you wish to set your own password, just precreate/modify this -file yourself or change `kube_api_pwd` var. diff --git a/inventory/sample/group_vars/k8s-cluster/k8s-cluster.yml b/inventory/sample/group_vars/k8s-cluster/k8s-cluster.yml index ad88ac380..a52834af8 100644 --- a/inventory/sample/group_vars/k8s-cluster/k8s-cluster.yml +++ b/inventory/sample/group_vars/k8s-cluster/k8s-cluster.yml @@ -14,9 +14,6 @@ kube_cert_dir: "{{ kube_config_dir }}/ssl" # This is where all of the bearer tokens will be stored kube_token_dir: "{{ kube_config_dir }}/tokens" -# This is where to save basic auth file -kube_users_dir: "{{ kube_config_dir }}/users" - kube_api_anonymous_auth: true ## Change this to use another Kubernetes version, e.g. a current beta release @@ -41,19 +38,8 @@ kube_log_level: 2 # Directory where credentials will be stored credentials_dir: "{{ inventory_dir }}/credentials" -# Users to create for basic auth in Kubernetes API via HTTP -# Optionally add groups for user -kube_api_pwd: "{{ lookup('password', credentials_dir + '/kube_user.creds length=15 chars=ascii_letters,digits') }}" -kube_users: - kube: - pass: "{{kube_api_pwd}}" - role: admin - groups: - - system:masters - -## It is possible to activate / deactivate selected authentication methods (basic auth, static token auth) +## It is possible to activate / deactivate selected authentication methods (oidc, static token auth) # kube_oidc_auth: false -# kube_basic_auth: false # kube_token_auth: false diff --git a/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 b/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 index 2d8abc4bf..ea8c27845 100644 --- a/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 +++ b/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2 @@ -189,7 +189,7 @@ spec: {% if dashboard_skip_login %} - --enable-skip-login {% endif %} - - --authentication-mode=token{% if kube_basic_auth|default(false) %},basic{% endif %} + - --authentication-mode=token # Uncomment the following line to manually specify Kubernetes API server Host # If not specified, Dashboard will attempt to auto discover the API server and connect # to it. Uncomment only if the default does not work. diff --git a/roles/kubernetes/master/defaults/main/main.yml b/roles/kubernetes/master/defaults/main/main.yml index 4a176e901..01fdd2946 100644 --- a/roles/kubernetes/master/defaults/main/main.yml +++ b/roles/kubernetes/master/defaults/main/main.yml @@ -95,7 +95,6 @@ kube_apiserver_disable_admission_plugins: [] kube_api_runtime_config: [] ## Enable/Disable Kube API Server Authentication Methods -kube_basic_auth: false kube_token_auth: false kube_oidc_auth: false kube_webhook_token_auth: false diff --git a/roles/kubernetes/master/tasks/main.yml b/roles/kubernetes/master/tasks/main.yml index 7fcae51fc..9eb0a56dd 100644 --- a/roles/kubernetes/master/tasks/main.yml +++ b/roles/kubernetes/master/tasks/main.yml @@ -3,10 +3,6 @@ tags: - k8s-pre-upgrade -- import_tasks: users-file.yml - when: - - kube_basic_auth|default(true) - - name: Create webhook token auth config template: src: webhook-token-auth-config.yaml.j2 diff --git a/roles/kubernetes/master/tasks/users-file.yml b/roles/kubernetes/master/tasks/users-file.yml deleted file mode 100644 index 7c94f6e2e..000000000 --- a/roles/kubernetes/master/tasks/users-file.yml +++ /dev/null @@ -1,14 +0,0 @@ ---- -- name: Make sure the users directory exits - file: - path: "{{ kube_users_dir }}" - state: directory - mode: o-rwx - group: "{{ kube_cert_group }}" - -- name: Populate users for basic auth in API - template: - src: known_users.csv.j2 - dest: "{{ kube_users_dir }}/known_users.csv" - mode: 0640 - backup: yes diff --git a/roles/kubernetes/master/templates/known_users.csv.j2 b/roles/kubernetes/master/templates/known_users.csv.j2 deleted file mode 100644 index b6e37d011..000000000 --- a/roles/kubernetes/master/templates/known_users.csv.j2 +++ /dev/null @@ -1,4 +0,0 @@ -{% for user in kube_users %} -{{kube_users[user].pass}},{{user}},{{kube_users[user].role}}{% if kube_users[user].groups is defined %},{% set groups_csv = kube_users[user].groups|join(',') -%}"{{groups_csv}}"{% endif %} - -{% endfor %} diff --git a/roles/kubernetes/master/templates/kubeadm-config.v1beta2.yaml.j2 b/roles/kubernetes/master/templates/kubeadm-config.v1beta2.yaml.j2 index edbdf9fe2..335abdae7 100644 --- a/roles/kubernetes/master/templates/kubeadm-config.v1beta2.yaml.j2 +++ b/roles/kubernetes/master/templates/kubeadm-config.v1beta2.yaml.j2 @@ -126,9 +126,6 @@ apiServer: profiling: "{{ kube_profiling }}" request-timeout: "{{ kube_apiserver_request_timeout }}" enable-aggregator-routing: "{{ kube_api_aggregator_routing }}" -{% if kube_basic_auth|default(true) %} - basic-auth-file: {{ kube_users_dir }}/known_users.csv -{% endif %} {% if kube_token_auth|default(true) %} token-auth-file: {{ kube_token_dir }}/known_tokens.csv {% endif %} @@ -202,18 +199,13 @@ apiServer: {% if kubelet_rotate_server_certificates %} kubelet-certificate-authority: {{ kube_cert_dir }}/ca.crt {% endif %} -{% if kubernetes_audit or kube_basic_auth|default(true) or kube_token_auth|default(true) or kube_webhook_token_auth|default(false) or ( cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws"] ) or apiserver_extra_volumes or ssl_ca_dirs|length %} +{% if kubernetes_audit or kube_token_auth|default(true) or kube_webhook_token_auth|default(false) or ( cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws"] ) or apiserver_extra_volumes or ssl_ca_dirs|length %} extraVolumes: {% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws"] %} - name: cloud-config hostPath: {{ kube_config_dir }}/cloud_config mountPath: {{ kube_config_dir }}/cloud_config {% endif %} -{% if kube_basic_auth|default(true) %} - - name: basic-auth-config - hostPath: {{ kube_users_dir }} - mountPath: {{ kube_users_dir }} -{% endif %} {% if kube_token_auth|default(true) %} - name: token-auth-config hostPath: {{ kube_token_dir }} diff --git a/roles/kubespray-defaults/defaults/main.yaml b/roles/kubespray-defaults/defaults/main.yaml index ca4de5695..095bc36fc 100644 --- a/roles/kubespray-defaults/defaults/main.yaml +++ b/roles/kubespray-defaults/defaults/main.yaml @@ -133,10 +133,6 @@ kube_cert_compat_dir: "/etc/kubernetes/pki" # This is where all of the bearer tokens will be stored kube_token_dir: "{{ kube_config_dir }}/tokens" -# This is where to save basic auth file -kube_users_dir: "{{ kube_config_dir }}/users" - - # This is the group that the cert creation scripts chgrp the # cert files to. Not really changeable... kube_cert_group: kube-cert @@ -144,13 +140,6 @@ kube_cert_group: kube-cert # Cluster Loglevel configuration kube_log_level: 2 -# Users to create for basic auth in Kubernetes API via HTTP -kube_api_pwd: "changeme" -kube_users: - kube: - pass: "{{kube_api_pwd}}" - role: admin - # Choose network plugin (cilium, calico, weave or flannel) # Can also be set to 'cloud', which lets the cloud provider setup appropriate routing kube_network_plugin: calico diff --git a/tests/files/packet_ubuntu18-flannel-containerd-ha-once.yml b/tests/files/packet_ubuntu18-flannel-containerd-ha-once.yml index 283a33b27..3b26f4290 100644 --- a/tests/files/packet_ubuntu18-flannel-containerd-ha-once.yml +++ b/tests/files/packet_ubuntu18-flannel-containerd-ha-once.yml @@ -24,5 +24,4 @@ cert_manager_enabled: true metrics_server_enabled: false metrics_server_kubelet_insecure_tls: true kube_token_auth: true -kube_basic_auth: true enable_nodelocaldns: false diff --git a/tests/files/packet_ubuntu18-flannel-containerd-ha.yml b/tests/files/packet_ubuntu18-flannel-containerd-ha.yml index 283a33b27..3b26f4290 100644 --- a/tests/files/packet_ubuntu18-flannel-containerd-ha.yml +++ b/tests/files/packet_ubuntu18-flannel-containerd-ha.yml @@ -24,5 +24,4 @@ cert_manager_enabled: true metrics_server_enabled: false metrics_server_kubelet_insecure_tls: true kube_token_auth: true -kube_basic_auth: true enable_nodelocaldns: false