Channels
academy
amazon
arm
azure
cabpr
chinese
ci-cd
danish
deutsch
developer
elemental
epinio
espanol
events
extensions
fleet
français
gcp
general
harvester
harvester-dev
hobbyfarm
hypper
japanese
k3d
k3os
k3s
k3s-contributor
kim
kubernetes
kubewarden
lima
logging
longhorn-dev
longhorn-storage
masterclass
mesos
mexico
nederlands
neuvector-security
office-hours
one-point-x
onlinemeetup
onlinetraining
opni
os
ozt
phillydotnet
portugues
rancher-desktop
rancher-extensions
rancher-setup
rancher-wrangler
random
rfed_ara
rio
rke
rke2
russian
s3gw
service-mesh
storage
submariner
supermicro-sixsq
swarm
terraform-controller
terraform-provider-rancher2
terraform-provider-rke
theranchcast
training-0110
training-0124
training-0131
training-0207
training-0214
training-1220
ukranian
v16-v21-migration
vsphere
windows
Title
a
abundant-noon-17295
05/23/2023, 8:27 AMis it possible to config api-server
dnsPolicyClusterFirstdnsPolicydefaultc
creamy-pencil-82913
05/23/2023, 8:29 AMTo what end?
a
abundant-noon-17295
05/23/2023, 8:34 AMtrying to build webhook authentication
api-server talks to a ldap-auth service inside cluster
just wondering why dnsPolicy is not set to
ClusterFirstWithHostNetc
creamy-pencil-82913
05/24/2023, 3:31 PMYou're supposed to specify the service info in the webhook clientConfig, instead of using the url. I linked you to the docs in the GH issue you opened.
a
abundant-noon-17295
05/24/2023, 3:33 PMclientconfig is for admission webhook, but for webhook authentication from official doc, the config is different
c
creamy-pencil-82913
05/24/2023, 3:37 PMHmm, interesting that is true.
We don't want it to use cluster DNS because then it is dependent on something else within the cluster; the apiserver should be standalone. I'm not sure what the suggested pattern is for auth webhooks deployed within the cluster. I suspect that these are usually used to auth to services outside the cluster, such as a cloud provider.
a
abundant-noon-17295
05/24/2023, 4:00 PMit’s common to auth against ldap for corp AD
i understand your point, to avoid circular dependency
for now i just use external dns for the auth proxy inside the cluster, but it’s a waste routing