Service Mesh Manager leverages the Kubeconfig, the official client libraries and the Kubernetes API to perform authentication and authorization for its users.
If you’re allowed to add, edit or delete specific Istio custom resources, you’ll have the same permissions from Service Mesh Manager as well.
The authentication flow consists of the following steps:
- The CLI extracts authentication credentials from the user’s Kubeconfig the same way
- The CLI sends these credentials (client certificate or bearer token) to Service Mesh Manager during the login process
- Service Mesh Manager validates these credentials against the Kubernetes API Server Service Mesh Manager doesn’t store these credentials afterwards)
- Once the credentials are proved to be valid Service Mesh Manager generates it’s own ID token (JWT) and encodes relevant user information in it
- The user - in possession of the ID token - can then use the token to authenticate against Service Mesh Manager until it expires
- Service Mesh Manager will send subsequent requests to the API server with impersonation headers set to the user’s name and groups to delegate Authorization entirely to Kubernetes
When you open the dashboard through the recommended way of typing
you’re seamlessly authenticated with your Kubeconfig, logged in automatically and redirected
to a browser tab with the Service Mesh Manager Dashboard open.
You can explicitly log in any time using the
smm login command, which gives you a short lifetime (10s), encrypted token to use
over the UI login window.
The ID token will be saved to the current context’s config to reuse for subsequent CLI commands for efficiency.
You can check or edit this config any time using the
smm config get,
smm config edit commands respectively.
Once the token expires (10h) the CLI performs a new login automatically within the next command.
If the token seems to be invalid for any reason you can always reauthenticate with the
smm login command.
Service Mesh Manager provides a way to disable user authentication and use its own service account token for all communication with the Kubernetes API server.
--anonymous-auth flag of the
install command to disable authentication.
smm install --anonymous-auth