dweller dweller via FreeIPA-users wrote:
In our environment, we have deployed Dex as an Identity Provider
(IdP) for authentication in various Kubernetes (k8s) clusters. However, we encountered an
issue with configuring Dex to account for nested groups. As a workaround, we implemented a
solution that assigns groups with automembership. Allow me to explain:
Each k8s cluster has Role-Based Access Control (RBAC) configured, which is associated
with four groups retrieved from LDAP via Dex. Consequently, we have the following naming
convention:
k8s-cluster-01-l0
k8s-cluster-01-l1
k8s-cluster-01-l2
k8s-cluster-01-l3
Additionally, we have user groups such as:
team-l0
team-l1
team-l2
team-l3
We add users to the appropriate team group based on their entitlements, and subsequently,
we associate the team-l* groups with their respective k8s-cluster-01-l* group. This
arrangement grants the members of the team-* group specific access rights to the
corresponding k8s cluster. However, initially, Dex was only able to recognize the groups
that a user was directly a member of. To address this limitation, we implemented
automember rules. For example, we created four rules as follows:
k8s-cluster-01-l0 if memberof team-l0
k8s-cluster-01-l1 if memberof team-l1
k8s-cluster-01-l2 if memberof team-l2
k8s-cluster-01-l3 if memberof team-l3
As the number of clusters increased, we ended up with around 52 automember rules
following the same pattern for k8s. Now, whenever I need to add a user or modify
automember rules and trigger an automember rebuild, even for a small set of users (5-10),
FreeIPA experiences a prolonged hang. Eventually, it times out the automember rebuild
task, and this lagging behavior extends to all replicas. In light of this situation, I
would like to clarify the following:
Is my understanding correct that for each user in this setup, I create 52 automember
rebuild tasks?
Not likely. A full rebuild is not triggered on a mod.
What does happen will depend on what version of IPA/389-ds-base you have
installed.
Is it expected for the system to function this way, or am I using the
automember plugin incorrectly? Could it be that the plugin is not intended for such high
membership usage?
Some optimizations have been done. See above.
I would appreciate any insights you can provide to help resolve these
concerns.
P.S.: I found a way to make a Dex to see nested groups membership, but for now I'm
stuck with this workaround, cause it much harder to conform changes now.
memberof can also be an expensive operation so YMMV.
This also depends on the version of IPA and the distribution.
rob