Authentication

Service Mesh Manager leverages the Kubeconfig, the official client libraries and the Kubernetes API to perform authentication and authorization for its users.

If you’re allowed to add, edit or delete specific Istio custom resources, you’ll have the same permissions from Service Mesh Manager as well.

Authentication overview

The authentication flow consists of the following steps:

  • The CLI extracts authentication credentials from the user’s Kubeconfig the same way kubectl would do
  • The CLI sends these credentials (client certificate or bearer token) to Service Mesh Manager during the login process
  • Service Mesh Manager validates these credentials against the Kubernetes API Server Service Mesh Manager doesn’t store these credentials afterwards)
  • Once the credentials are proved to be valid Service Mesh Manager generates it’s own ID token (JWT) and encodes relevant user information in it
  • The user - in possession of the ID token - can then use the token to authenticate against Service Mesh Manager until it expires
  • Service Mesh Manager will send subsequent requests to the API server with impersonation headers set to the user’s name and groups to delegate Authorization entirely to Kubernetes

Test authentication

Dashboard access

smm dashboard

When you open the dashboard through the recommended way of typing smm dashboard, you’re seamlessly authenticated with your Kubeconfig, logged in automatically and redirected to a browser tab with the Service Mesh Manager Dashboard open.

Login

smm login

You can explicitly log in any time using the smm login command, which gives you a short lifetime (10s), encrypted token to use over the UI login window.

Troubleshooting

The ID token will be saved to the current context’s config to reuse for subsequent CLI commands for efficiency. You can check or edit this config any time using the smm config get, smm config edit commands respectively.

Once the token expires (10h) the CLI performs a new login automatically within the next command.

If the token seems to be invalid for any reason you can always reauthenticate with the smm login command.

Anonymous mode

Service Mesh Manager provides a way to disable user authentication and use its own service account token for all communication with the Kubernetes API server.

Use the --anonymous-auth flag of the install command to disable authentication.

smm install --anonymous-auth