Configure Google OAuth2 Authentication

To enable Google OAuth2, you must register a new application with Google.

Create Google OAuth2 Keys

In the Google environment, follow these steps:

  1. Navigate to the Google Credentials page.

  2. Click Create credentials > OAuth client ID.

  3. Select the Web application type.

  4. Enter Name , such as Kloudfuse.

  5. Enter URL of the kloudfuse installation in the Authorized JavaScript Origins.

    Example: kloudfuse.yourcompany.com

  6. Enter URL that has the /oauth2/callback of the kloudfuse in the Authorized redirect URIs.

    Example: kloudfuse.yourcompany.com/oauth2/callback

  7. Click Create.

  8. Copy the Client ID and Client Secret from the OAuth Client modal.

    Save it for next steps.

Enable Google Auth in Kloudfuse

Option 1: Use Client ID and Secret

In your custom-values.yaml file, add google client ID and secret:

 kfuse-auth:
   oauth2-proxy:
     config:
       clientID: "REPLACE_CLIENT_ID"
       clientSecret: "REPLACE_CLIENT_SECRET"
yaml

Option 2: Use Kubernetes secrets

In the kfuse namespace, create 2 kubernetes secrets:

  1. Create a secret called kfuse-auth-users as mentioned here.

  2. Create a new kubernetes secret, kfuse-auth-users; you can also update an existing secret.

    Use the output of cat users.txt| base64 as the value of users.txt entry in the secret.

    Use the edit command if editing an existing secret.

Edit Secret
kubectl edit secret kfuse-auth-users
Create kubernetes secret kfuse-auth-users
apiVersion: v1
data:
  users.txt: |-
    <base64-encoded-value-from-above>
kind: Secret
metadata:
  name: kfuse-auth-users
type: Opaque
yaml

  1. Create a new kubernetes secret, kfuse-auth-google.

    Use base64-encoded values for client id and client secret from kfuse-auth-users secret.

    To generate cookie secret, see the OAuth2 Proxy documentation for Generating a Cookie Secret.

    Create kubernetes secret kfuse-auth-google
    apiVersion: v1
data:
  client-id: <base 64 encoded google client id>
  client-secret: <base 64 encoded google client secret>
  cookie-secret: <base 64 encoded random value>
kind: Secret
metadata:
   name: kfuse-auth-google
type: Opaque
    yaml

  2. Include the two secrets in your custom-values.yaml file:

    Add secrets to custom-values.yaml
    kfuse-auth:
  oauth2-proxy:
    config:
      existingSecret: "kfuse-auth-google"
    htpasswdFile:
      existingSecret: "kfuse-auth-users"
    yaml