Authentication
Service Mesh Manager leverages the Kubeconfig, the official client libraries and the Kubernetes API to perform authentication and authorization for its users.
If you’re allowed to add, edit or delete specific Istio custom resources, you’ll have the same permissions from Service Mesh Manager as well.
Authentication overview
The authentication flow consists of the following steps:
- The CLI extracts authentication credentials from the user’s Kubeconfig the same way
kubectl
would do - The CLI sends these credentials (client certificate or bearer token) to Service Mesh Manager during the login process
- Service Mesh Manager validates these credentials against the Kubernetes API Server Service Mesh Manager doesn’t store these credentials afterwards)
- Once the credentials are proved to be valid Service Mesh Manager generates it’s own ID token (JWT) and encodes relevant user information in it
- The user - in possession of the ID token - can then use the token to authenticate against Service Mesh Manager until it expires
- Service Mesh Manager will send subsequent requests to the API server with impersonation headers set to the user’s name and groups to delegate Authorization entirely to Kubernetes
Test authentication
Dashboard access
smm dashboard
When you open the dashboard through the recommended way of typing smm dashboard
,
you’re seamlessly authenticated with your Kubeconfig, logged in automatically and redirected
to a browser tab with the Service Mesh Manager Dashboard open.
Login
smm login
You can explicitly log in any time using the smm login
command, which gives you a short lifetime (10s), encrypted token to use
over the UI login window.
Troubleshooting
The ID token will be saved to the current context’s config to reuse for subsequent CLI commands for efficiency.
You can check or edit this config any time using the smm config get
, smm config edit
commands respectively.
Once the token expires (10h) the CLI performs a new login automatically within the next command.
If the token seems to be invalid for any reason you can always reauthenticate with the smm login
command.
Anonymous mode
Service Mesh Manager provides a way to disable user authentication and use its own service account token for all communication with the Kubernetes API server.
Use the --anonymous-auth
flag of the install
command to disable authentication.
smm install --anonymous-auth