Configure Google OAuth2 Authentication :: Kloudfuse Docs

Configure Google OAuth2 Authentication

To enable Google OAuth2, you must register a new application with Google.

Create Google OAuth2 Keys

In the Google environment, follow these steps:

  1. Navigate to the Google Credentials page.
  2. Click Create credentials > OAuth client ID.
  3. Select the Web application type.
  4. Enter Name , such as Kloudfuse.
  5. Enter URL of the kloudfuse installation in the Authorized JavaScript Origins.

Example: kloudfuse.yourcompany.com

  1. Enter URL that has the /oauth2/callback of the kloudfuse in the Authorized redirect URIs.

Example: kloudfuse.yourcompany.com/oauth2/callback

  1. Click Create.
  2. Copy the Client ID and Client Secret from the OAuth Client modal.

Save it for next steps.

Enable Google Auth in Kloudfuse

Option 1: Use Client ID and Secret

In your custom-values.yaml file, add google client ID and secret:

 kfuse-auth:
   oauth2-proxy:
     config:
       clientID: "REPLACE_CLIENT_ID"
       clientSecret: "REPLACE_CLIENT_SECRET"

Option 2: Use Kubernetes secrets

In the kfuse namespace, create 2 kubernetes secrets:

  1. Create a secret called kfuse-auth-users as mentioned here.
  2. Create a new kubernetes secret, kfuse-auth-users; you can also update an existing secret.

Use the output of cat users.txt| base64 as the value of users.txt entry in the secret.

Use the edit command if editing an existing secret.

Edit Secret

   kubectl edit secret kfuse-auth-users

Create kubernetes secret kfuse-auth-users

   apiVersion: v1
   data:
     users.txt: |-
       <base64-encoded-value-from-above>
   kind: Secret
   metadata:
     name: kfuse-auth-users
   type: Opaque
  1. Create a new kubernetes secret, kfuse-auth-google.

Use base64-encoded values for client id and client secret from kfuse-auth-users secret.

To generate cookie secret, see the OAuth2 Proxy documentation for Generating a Cookie Secret.

Create kubernetes secret kfuse-auth-google

   apiVersion: v1
   data:
        client-id: <base 64 encoded google client id>
        client-secret: <base 64 encoded google client secret>
        cookie-secret: <base 64 encoded random value>
   kind: Secret
   metadata:
         name: kfuse-auth-google
   type: Opaque
  1. Include the two secrets in your custom-values.yaml file:

Add secrets to custom-values.yaml

   kfuse-auth:
        oauth2-proxy:
          config:
            existingSecret: "kfuse-auth-google"
          htpasswdFile:
            existingSecret: "kfuse-auth-users"