Configuring your cluster for impersonation

Let’s deploy an impersonating proxy for our cluster. Just like integrating our cluster directly into OpenUnison using OpenID Connect, we’ve automated the deployment so that you don’t need to manually configure OpenUnison. We’ll clear out our old cluster and start afresh:

cd Kubernetes-An-Enterprise-Guide-Third-Edition/chapter2
kind delete cluster -n cluster01
./create-cluster.sh
cd  ../chapter6/user-auth
./deploy_openunison_imp_impersonation.sh

The differences between this script and our original script are:

• Configuring OpenUnison to generate NetworkPolicy objects to limit access to just requests from our NGINX Ingress controller and the API server
• Configuring OpenUnison’s ServiceAccount token to only be valid for 10 minutes instead of the typical hour or day
• Configuring the OpenUnison values.yaml to deploy the kube-oidc-proxy to handle incoming API server requests
• Creating...