From 50ca14309ab0c635e36c75a66d484e1e07a6a76f Mon Sep 17 00:00:00 2001 From: Max Sokolovsky Date: Thu, 2 Mar 2023 15:48:39 -0500 Subject: [PATCH 1/4] [2.6] Add notes about disabling an auth provider --- .../authentication-config.md | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md b/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md index c61ade4854d..a67bd206a64 100644 --- a/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md +++ b/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md @@ -109,3 +109,30 @@ If you need to reconfigure or disable then re-enable a provider that had been pr is logged in to Rancher as an external user, not the local admin. ::: + +## Disabling An Auth Provider + +When you disable an auth provider, Rancher deletes all resources associated with it, such as: +- Secrets +- Global role bindings +- Cluster role template bindings +- Project role template bindings +- External users associated with the provider, who never logged in as local users to Rancher + +As this operation may lead to a loss of many resources, you may want to add a safeguard on the provider. +To ensure this cleanup process doesn't run when the auth provider is disabled, add a special annoation to the corresponding auth config. + +For example, to add a safeguard to the Azure AD provider, annotate the `azuread` authconfig object: + +`kubectl annotate --overwrite authconfig azuread management.cattle.io/auth-provider-cleanup='user-locked'` + +Rancher won't perform cleanup until you set the annotation to `unlocked`. + +### Running Resource Cleanup Manually + +Rancher might retain resources from a disabled auth provider configuration in the local cluster, even after you configure another auth provider. +For example, if you used Provider A, then disabled it and started using Provider B, when you upgrade to a new version of Rancher, +you can manually trigger cleanup on resources configured by Provider A. + +To manually trigger cleanup for a disabled auth provider, add the `management.cattle.io/auth-provider-cleanup` annotation with the `unlocked` value +to its auth config. From 650427834821328ae548343bbf87b619607aae01 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Mon, 6 Mar 2023 16:52:28 -0500 Subject: [PATCH 2/4] Update versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md --- .../version-2.6/pages-for-subheaders/authentication-config.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md b/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md index a67bd206a64..b106d3a728a 100644 --- a/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md +++ b/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md @@ -130,7 +130,7 @@ Rancher won't perform cleanup until you set the annotation to `unlocked`. ### Running Resource Cleanup Manually -Rancher might retain resources from a disabled auth provider configuration in the local cluster, even after you configure another auth provider. +Rancher might retain resources from a previously disabled auth provider configuration in the local cluster, even after you configure another auth provider. For example, if you used Provider A, then disabled it and started using Provider B, when you upgrade to a new version of Rancher, you can manually trigger cleanup on resources configured by Provider A. From 6b4b8e06753189e75162bd1dff5cfc358fd931b8 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Mon, 6 Mar 2023 16:53:02 -0500 Subject: [PATCH 3/4] Update versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md --- .../version-2.6/pages-for-subheaders/authentication-config.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md b/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md index b106d3a728a..ef588409140 100644 --- a/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md +++ b/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md @@ -131,8 +131,7 @@ Rancher won't perform cleanup until you set the annotation to `unlocked`. ### Running Resource Cleanup Manually Rancher might retain resources from a previously disabled auth provider configuration in the local cluster, even after you configure another auth provider. -For example, if you used Provider A, then disabled it and started using Provider B, when you upgrade to a new version of Rancher, -you can manually trigger cleanup on resources configured by Provider A. +For example, if you used Provider A, then disabled it and started using Provider B, when you upgrade to a new version of Rancher, you can manually trigger cleanup on resources configured by Provider A. To manually trigger cleanup for a disabled auth provider, add the `management.cattle.io/auth-provider-cleanup` annotation with the `unlocked` value to its auth config. From e133c0aae4b631f22b4339a45136cab7cf548263 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Mon, 6 Mar 2023 16:53:34 -0500 Subject: [PATCH 4/4] Update versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md --- .../version-2.6/pages-for-subheaders/authentication-config.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md b/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md index ef588409140..c1787591568 100644 --- a/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md +++ b/versioned_docs/version-2.6/pages-for-subheaders/authentication-config.md @@ -130,8 +130,7 @@ Rancher won't perform cleanup until you set the annotation to `unlocked`. ### Running Resource Cleanup Manually -Rancher might retain resources from a previously disabled auth provider configuration in the local cluster, even after you configure another auth provider. -For example, if you used Provider A, then disabled it and started using Provider B, when you upgrade to a new version of Rancher, you can manually trigger cleanup on resources configured by Provider A. +Rancher might retain resources from a previously disabled auth provider configuration in the local cluster, even after you configure another auth provider. For example, if you used Provider A, then disabled it and started using Provider B, when you upgrade to a new version of Rancher, you can manually trigger cleanup on resources configured by Provider A. To manually trigger cleanup for a disabled auth provider, add the `management.cattle.io/auth-provider-cleanup` annotation with the `unlocked` value to its auth config.