Skip to content

Authentication options#

Local users are not supported. As such, for authentication you should use OIDC, SAML, or LDAP.

Refer to Basic authentication for more details.

Supplying credentials for child clusters#

Child clusters use the same OIDC, SAML, and LDAP settings as management clusters.

For the sensitive values (LDAP bind password, OIDC client ID and client secret), Mirantis recommends that you create a Secret in the same namespace as the child cluster configuration object and reference it with credentialsSecretName. For more information, refer to Supply authentication credentials.

spec:
  authentication:
    credentialsSecretName: my-auth-credentials

Depracation

Setting the credential fields inline in a child cluster configuration is deprecated and will be removed in a future API version. Instead, reference a Secret with credentialsSecretName.

Notes

  • Trust certificates, such as ldap.caData, saml.caData, amd oidc.rootCAs, are public configurations and are set directly in the child cluster configuration and not in the credentials Secret.
  • The SAML ssoMetadataURL parameter is not supported for child clusters. As such, you must directly configure ssoURL and caData.

Pre-Logon Message#

Child clusters support the authentication.preLogonMessage field, which displays a banner above the login form. Refer to Set a pre-logon message for more information.