Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(authentication): update docs to reflect the Go SDK kubernetes provider support #178

Merged
merged 5 commits into from
Jan 26, 2024
Merged

chore(authentication): update docs to reflect the Go SDK kubernetes provider support #178

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c362b8b
chore(authentication): update docs to reflect the Go SDK kubernetes p…
GeorgeMac Jan 26, 2024
2d74f34
chore: format code
GeorgeMac Jan 26, 2024
1946277
fix(authentication/methods): formatting due to code group spacing
GeorgeMac Jan 26, 2024
1812a88
fix(authentication/methods): indentation
GeorgeMac Jan 26, 2024
73deedf
chore(authentication/methods): remove now void note around k8s auth
GeorgeMac Jan 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
104 changes: 43 additions & 61 deletions authentication/methods.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,11 +152,8 @@
## Kubernetes

<Note>
This method is designed for automatically authenticating applications with Flipt.

We're actively designing and developing client-side implementations to leverage this method seamlessly.
However, for now, the API must be managed manually by your implementation.

This method is designed for automatically authenticating applications with
Flipt.
</Note>

The `kubernetes` authentication method supports the ability to exchange [Kubernetes service account](https://kubernetes.io/docs/concepts/security/service-accounts) tokens with Flipt for client tokens.
Expand All @@ -176,12 +173,51 @@

The client token produced can be used in subsequent API requests with the rest of the Flipt API to gain authenticated access.

### Via the SDK

Check warning on line 176 in authentication/methods.mdx

View workflow job for this annotation

GitHub Actions / Vale 

[vale] reported by reviewdog 🐶
[Openly.Titles] 'Via the SDK' should be in sentence case

Raw Output:
{"message": "[Openly.Titles] 'Via the SDK' should be in sentence case", "location": {"path": "authentication/methods.mdx", "range": {"start": {"line": 176, "column": 5}}}, "severity": "WARNING"}

Check warning on line 176 in authentication/methods.mdx

View workflow job for this annotation

GitHub Actions / Vale 

[vale] reported by reviewdog 🐶
[Microsoft.HeadingAcronyms] Avoid using acronyms in a title or heading.

Raw Output:
{"message": "[Microsoft.HeadingAcronyms] Avoid using acronyms in a title or heading.", "location": {"path": "authentication/methods.mdx", "range": {"start": {"line": 176, "column": 13}}}, "severity": "WARNING"}

Some of our SDKs support automatic authentication via the Kubernetes authentication method.

Check warning on line 178 in authentication/methods.mdx

View workflow job for this annotation

GitHub Actions / Vale 

[vale] reported by reviewdog 🐶
[Microsoft.We] Try to avoid using first-person plural like 'our'.

Raw Output:
{"message": "[Microsoft.We] Try to avoid using first-person plural like 'our'.", "location": {"path": "authentication/methods.mdx", "range": {"start": {"line": 178, "column": 9}}}, "severity": "WARNING"}
These clients do not require you to have to manually invoke the verify service account.

Check failure on line 179 in authentication/methods.mdx

View workflow job for this annotation

GitHub Actions / Vale 

[vale] reported by reviewdog 🐶
[Microsoft.Contractions] Use 'don't' instead of 'do not'.

Raw Output:
{"message": "[Microsoft.Contractions] Use 'don't' instead of 'do not'.", "location": {"path": "authentication/methods.mdx", "range": {"start": {"line": 179, "column": 15}}}, "severity": "ERROR"}
Instead, they do this operation for you, and they ensure that the retrieved client token from Flipt is automatically refreshed.

The SDKs that currently support this include:
GeorgeMac marked this conversation as resolved.
Show resolved Hide resolved

- Go

<CodeGroup>

```go sdk.go
package main

import (
http "go.flipt.io/flipt/sdk/go/http"
sdk "go.flipt.io/flipt/sdk/go"
)

func main() {
// The following constructs an instance of the SDK which communicates with
// instances of Flipt deployed in the same cluster.
// In this example, we assume Flipt is reachable via a k8s service named
// `flipt` deployed into the namespace `flipt`.
//
// The kubernetes provider automatically authenticates the client with this
// Flipt service. It also ensures that the credentials are kept up to date
// and automatically refreshed before they expire.
transport := http.NewTransport("http://flipt.flipt.svc.cluster.local:8080")
sdk := sdk.New(transport, sdk.WithAuthenticationProvider(
sdk.NewKubernetesAuthenticationProvider(transport),
))
}
```

</CodeGroup>

### Via the API

The following can be issued from inside a pod with a valid service account token in the default location for Kubernetes.
It assumes that Flipt is reachable and deployed in the same cluster with a service name of `flipt`.
Acquiring a client token via this method can be performed manually from inside a pod.
The following uses `curl` to illustrate how a local, valid service account token can be used in this way.

<CodeGroup>

```bash client-token.sh
# assumes both curl and jq are installed
curl -s -X POST http://flipt:8080/auth/v1/method/kubernetes/serviceaccount \
Expand All @@ -206,60 +242,6 @@
}
```

```go client_http.go
package client

import (
"fmt"
"encoding/json"
"net/http"
"os"
)

type Response struct {
ClientToken string `json:"clientToken"`
Authentication struct {
ExpiresAt time.Time `json:"expiresAt"`
} `json:"authentication"`
}

func getClientToken(ctx context.Context) (*Response, error) {
saToken, err := os.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/token")
if err != nil {
return nil, err
}

req, err := http.NewRequestWithContext(
ctx,
http.MethodPost,
"http://flipt:8080/auth/v1/method/kubernetes/serviceaccount",
map[string]string{
"service_account_token": saToken,
})
if err != nil {
return nil, err
}

resp, err := http.Do(req)
if err != nil {
return nil, err
}

defer resp.Body.Close()

if resp.Status != http.StatusOK {
return nil, fmt.Errorf("unexpected status code: %q", resp.Status)
}

response := &Response{}
if err := json.NewDecoder(resp.Body).Decode(response); err != nil {
return nil, err
}

return response, nil
}
```

</CodeGroup>

The client token found in the body of the response can then be used to authenticate with Flipt as outlined in [Using Client Tokens](/authentication/using-tokens).
Expand Down
3 changes: 3 additions & 0 deletions guides/deploy-to-kubernetes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,3 +142,6 @@
You should be able to take the knowledge you've gained in this guide and deploy Flipt in to a real Kubernetes cluster.

Please refer to the [Flipt Helm chart repository](https://github.com/flipt-io/helm-charts) for more information on how to configure Flipt using the Helm chart.

Additionally, you should checkout our documentation on our native [Kubernetes authentication method](/authentication/methods#kubernetes).

Check warning on line 146 in guides/deploy-to-kubernetes.mdx

View workflow job for this annotation

GitHub Actions / Vale 

[vale] reported by reviewdog 🐶
[Microsoft.We] Try to avoid using first-person plural like 'our'.

Raw Output:
{"message": "[Microsoft.We] Try to avoid using first-person plural like 'our'.", "location": {"path": "guides/deploy-to-kubernetes.mdx", "range": {"start": {"line": 146, "column": 35}}}, "severity": "WARNING"}

Check warning on line 146 in guides/deploy-to-kubernetes.mdx

View workflow job for this annotation

GitHub Actions / Vale 

[vale] reported by reviewdog 🐶
[Microsoft.We] Try to avoid using first-person plural like 'our'.

Raw Output:
{"message": "[Microsoft.We] Try to avoid using first-person plural like 'our'.", "location": {"path": "guides/deploy-to-kubernetes.mdx", "range": {"start": {"line": 146, "column": 56}}}, "severity": "WARNING"}
This method can be leverage to automatically authenticate clients, without the need to manually manage credentials, for applications deployed into the same Kubernetes cluster as Flipt.

Check warning on line 147 in guides/deploy-to-kubernetes.mdx

View workflow job for this annotation

GitHub Actions / Vale 

[vale] reported by reviewdog 🐶
[Openly.SentenceLength] Write short sentences (less than 25 words).

Raw Output:
{"message": "[Openly.SentenceLength] Write short sentences (less than 25 words).", "location": {"path": "guides/deploy-to-kubernetes.mdx", "range": {"start": {"line": 147, "column": 1}}}, "severity": "WARNING"}
Loading