Expand documentation on token exchange based login#332
Conversation
WalkthroughThe documentation has been updated to simplify the OIDC setup for the Jumpstarter system. Instead of patching clients and exporters using Changes
Sequence Diagram(s)sequenceDiagram
participant User as User
participant CLI as Jumpstarter CLI
participant API as Jumpstarter API
participant Dex as Dex Server
User->>CLI: Execute "jmp admin create --oidc-username"
CLI->>API: Request client/exporter creation
API->>Dex: Verify OIDC credentials
Dex-->>API: Return OIDC validation result
API-->>CLI: Respond with creation confirmation
sequenceDiagram
participant Admin as System Admin
participant K8s as Kubernetes API
participant Dex as Dex Server
Admin->>K8s: Initialize self-signed CA and create TLS secret
Admin->>K8s: Install Dex via Helm with OIDC configuration
K8s-->>Dex: Deploy Dex with provided settings
Admin->>K8s: Create cluster role binding for unauthenticated OIDC discovery
Possibly related PRs
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
✅ Deploy Preview for jumpstarter-docs ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
docs/source/config/oidc.md (3)
52-66: Dex Certificate Setup Documentation
The steps for initializing a self-signed CA, building the server certificate, and creating the TLS secret for Dex are clear and sequential. Consider adding a brief troubleshooting note or a pointer to further documentation in case certificate generation fails.
125-142: Configuring Jumpstarter to Trust Dex
The YAML snippet for setting up Jumpstarter’s authentication configuration is clear and aligns with the Dex setup. However, ensure that the code block is properly closed (i.e. terminated with triple backticks) in the final document to avoid markdown rendering issues. Additionally, a brief note on how users might obtain or generate the<content of pki/ca.crt>would make this section even clearer.
146-163: Login Command Instructions and Markdown Formatting
The login command examples for both clients and exporters are straightforward. To improve readability and adhere to markdown best practices, please specify a language for the fenced code block. For example, change the opening fence from:-``` +```shellAdditionally, consider using the phrasal verb “log in” instead of “login” (when used as a verb) for grammatical consistency.
🧰 Tools
🪛 LanguageTool
[misspelling] ~146-~146: Did you mean the verb “log in”?
Context: ...igured. Finally, instruct the users to login with the following commands in pods con...(LOG_IN)
🪛 markdownlint-cli2 (0.17.2)
148-148: Fenced code blocks should have a language specified
null(MD040, fenced-code-language)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
docs/source/config/oidc.md(2 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/source/config/oidc.md
[uncategorized] ~144-~144: If this is a compound adjective that modifies the following noun, use a hyphen.
Context: ...:test-service-account`. Just prefix the full service account name with "dex:", as previously...
(EN_COMPOUND_ADJECTIVE_INTERNAL)
[misspelling] ~146-~146: Did you mean the verb “log in”?
Context: ...igured. Finally, instruct the users to login with the following commands in pods con...
(LOG_IN)
🪛 markdownlint-cli2 (0.17.2)
docs/source/config/oidc.md
148-148: Fenced code blocks should have a language specified
null
(MD040, fenced-code-language)
⏰ Context from checks skipped due to timeout of 90000ms (6)
- GitHub Check: pytest-matrix (3.11)
- GitHub Check: pytest-matrix (3.12)
- GitHub Check: pytest-matrix (3.13)
- GitHub Check: e2e
- GitHub Check: build-and-push-image (jumpstarter-dev/jumpstarter-devspace .devfile/Containerfile.client)
- GitHub Check: build-and-push-image (jumpstarter-dev/jumpstarter-dev .devfile/Containerfile)
🔇 Additional comments (4)
docs/source/config/oidc.md (4)
30-30: Streamlined Client/Exporter Creation Instructions
The updated instructions using the--oidc-usernameflag simplify the process by eliminating the need for separate patching viakubectlcommands. Please verify that any prior references to patching are removed for consistency.
68-113: Comprehensive Dex Helm Configuration
The provided YAML configuration (dex.values.yaml) is well-structured and covers key settings (HTTPS enablement, TLS paths, storage configuration, static clients, and connectors). Ensure that the certificate paths (e.g./etc/dex/tls/tls.crt) match those generated previously and that the in-cluster storage settings are valid for your deployment environment.
115-123: RBAC and Helm Commands for Dex Installation
The instructions for creating a cluster role binding to allow unauthenticated access for OIDC discovery and for installing Dex via Helm are precise. For environments with strict RBAC policies, please verify whether additional permissions may be necessary.
143-145: Client and Exporter Creation with Dex
The instructions to create clients and exporters using thejmp admin createcommand—with the requirement to prefix the service account name with"dex:"—are consistent with the updated configuration.🧰 Tools
🪛 LanguageTool
[uncategorized] ~144-~144: If this is a compound adjective that modifies the following noun, use a hyphen.
Context: ...:test-service-account`. Just prefix the full service account name with "dex:", as previously...(EN_COMPOUND_ADJECTIVE_INTERNAL)
|
Looks great! |
2 participants
Summary by CodeRabbit