Setup Researcher Access Control¶

• Locate the Kubernetes API Server configuration file. The file's location may differ between different Kubernetes distributions. The location for vanilla Kubernetes is /etc/kubernetes/manifests/kube-apiserver.yaml
• Edit the document, under the command tag, add the server configuration text described above.
• Verify that the kube-apiserver-<master-node-name> pod in the kube-system namespace has been restarted and that changes have been incorporated. Run the below and verify that the oidc flags you have added:

kubectl get pods -n kube-system kube-apiserver-<master-node-name> -o yaml

No configuration is needed. Instead, Run:ai assumes that an Identity Provider has been defined at the OpenShift level and that the Run:ai Cluster installation has set the OpenshiftIdp flag to true. For more information see the Run:ai OpenShift control-plane setup.

Edit Rancher cluster.yml (with Rancher UI, follow this). Add the following:

kube-api:
    always_pull_images: false
    extra_args:
        oidc-client-id: runai  # (1)
        ...

1. These are example parameters. Copy the actual parameters from Settings | General | Researcher Authentication as described above.

You can verify that the flags have been incorporated into the RKE cluster by following the instructions here and running docker inspect <kube-api-server-container-id>, where <kube-api-server-container-id> is the container ID of api-server via obtained in the Rancher document.

If working via the RKE2 Quickstart, edit /etc/rancher/rke2/config.yaml. Add the parameters provided in the server configuration section as described above in the following fashion:

kube-apiserver-arg:
- "oidc-client-id=runai" # (1)
...

1. These are example parameters. Copy the actual parameters from Settings | General | Researcher Authentication as described above.

If working via Rancher UI, need to add the flag as part of the cluster provisioning.

Under Cluster Management | Create, turn on RKE2 and select a platform. Under Cluster Configuration | Advanced | Additional API Server Args. Add the Run:ai flags as <key>=<value> (e.g. oidc-username-prefix=-).

Install Anthos identity service by running:

gcloud container clusters update <gke-cluster-name> \
    --enable-identity-service --project=<gcp-project-name> --zone=<gcp-zone-name>

Install the yq utility and run:

For username-password authentication, run:

kubectl get clientconfig default -n kube-public -o yaml > login-config.yaml
yq -i e ".spec +={\"authentication\":[{\"name\":\"oidc\",\"oidc\":{\"clientID\":\"runai\",\"issuerURI\":\"$OIDC_ISSUER_URL\",\"kubectlRedirectURI\":\"http://localhost:8000/callback\",\"userClaim\":\"sub\",\"userPrefix\":\"-\"}}]}" login-config.yaml
kubectl apply -f login-config.yaml

For single-sign-on, run:

kubectl get clientconfig default -n kube-public -o yaml > login-config.yaml
yq -i e ".spec +={\"authentication\":[{\"name\":\"oidc\",\"oidc\":{\"clientID\":\"runai\",\"issuerURI\":\"$OIDC_ISSUER_URL\",\"groupsClaim\":\"groups\",\"kubectlRedirectURI\":\"http://localhost:8000/callback\",\"userClaim\":\"email\",\"userPrefix\":\"-\"}}]}" login-config.yaml
kubectl apply -f login-config.yaml

Where the OIDC flags are provided in the Run:ai server configuration section as described above.

Then update runaiconfig with the Anthos endpoint - gke-oidc-envoy. Get the externel IP of the service in the Anthos namespace.

kubectl get svc -n anthos-identity-service
NAME               TYPE           CLUSTER-IP    EXTERNAL-IP     PORT(S)              AGE
gke-oidc-envoy     LoadBalancer   10.37.3.111   39.201.319.10   443:31545/TCP        12h

Add the IP to runaiconfig

kubectl -n runai patch runaiconfig runai -p '{"spec": {"researcher-service": {"args": {"gkeOidcEnvoyHost": "35.236.229.19"}}}}'  --type="merge"

To create a kubeconfig profile for Researchers run:

kubectl oidc login --cluster=CLUSTER_NAME --login-config=login-config.yaml \
    --kubeconfig=developer-kubeconfig

(this will require installing the kubectl oidc plug-in as described in the Anthos document above gcloud components install kubectl-oidc)

Then modify the developer-kubeconfig file as described in the Command-line Inteface Access section below.

• In the AWS Console, under EKS, find your cluster.
• Go to Configuration and then to Authentication.
• Associate a new identity provider. Use the parameters provided in the server configuration section as described above. The process can take up to 30 minutes.

Please follow the "Vanilla Kubernetes" instructions

Please contact Run:ai customer support.

See specific instructions in the documentation of the Kubernetes distribution.