Reference Material

• The sysadmin Account
• Types of System Accounts
• Linux User Accounts
  • The sysadmin Account
  • Local LDAP Linux User Accounts
    • Default LDAP User Accounts
  • Create LDAP Linux Accounts
  • Create LDAP Linux Groups
  • Delete LDAP Linux Accounts
  • Remote Access for Linux Accounts
  • Password Recovery for Linux User Accounts
    • Linux System Users
    • LDAP System Users
  • Local LDAP user password expiry control
    • Setting shadow password expiry information in local LDAP server
    • Password Expiry behavior on a running system
  • Establish Credentials for Linux User Accounts
  • For StarlingX and Platform OpenStack CLIs from a Local LDAP Linux Account Login
  • For StarlingX, Platform OpenStack and Kubernetes CLIs from the ‘sysadmin’ Linux Account Login
  • For Kubernetes CLI from a Local LDAP Linux Account Login
  • Manage Composite Local LDAP Accounts at Scale
    • Create inventory file using Ansible-Vault
    • Run the playbook
    • Use the created composite Local LDAP accounts
    • Troubleshooting
  • Selectively Disable SSH for Local LDAP and WAD Users
    • Deny SSH Access Local LDAP Users
    • Deny SSH Access for WAD Users
  • Add LDAP Users to Linux Groups Using PAM Configuration
• Keystone Accounts
  • Keystone Accounts
  • Keystone Account Authentication
  • Keystone Account Roles
    • Creation of user with specific role for Horizon only
    • Creation of user with specific role for Horizon and CLI
  • Manage Keystone Accounts
  • Configure the Keystone Token Expiration Time
  • Keystone Password Recovery
  • Keystone Security Compliance Configuration
• LDAP Accounts
  • Local LDAP Accounts
    • Local LDAP Linux User Accounts
      • Default LDAP User Accounts
    • Create LDAP Linux Accounts
    • Create LDAP Linux Groups
    • Delete LDAP Linux Accounts
    • Remote Access for Linux Accounts
    • Password Recovery for Linux User Accounts
      • Linux System Users
      • LDAP System Users
    • Local LDAP user password expiry control
      • Setting shadow password expiry information in local LDAP server
      • Password Expiry behavior on a running system
    • Establish Credentials for Linux User Accounts
    • Manage Composite Local LDAP Accounts at Scale
      • Create inventory file using Ansible-Vault
      • Run the playbook
      • Use the created composite Local LDAP accounts
      • Troubleshooting
  • Remote Windows Active Directory accounts
    • SSH User Authentication using Windows Active Directory (WAD)
      • Install WAD CA Certificate
      • Add Remote WAD Domain
      • SSH using the WAD domain user
      • Modify/Delete WAD Domain parameters
      • Delete a WAD Domain configuration
      • Default Local OpenLDAP Domain Configuration
      • SSSD logs
  • Selectively Disable SSH for Local LDAP and WAD Users
    • Deny SSH Access Local LDAP Users
    • Deny SSH Access for WAD Users
  • Manage Composite Local LDAP Accounts at Scale
    • Create inventory file using Ansible-Vault
    • Run the playbook
    • Use the created composite Local LDAP accounts
    • Troubleshooting
  • Kubernetes API User Authentication Using LDAP Server
    • Overview of LDAP Servers
    • Centralized vs Distributed OIDC Authentication Setup
      • Distributed Setup
      • Centralized Setup
    • Configure Kubernetes for OIDC Token Validation while Bootstrapping the System
    • Configure Kubernetes for OIDC Token Validation after Bootstrapping the System
    • Set up OIDC Auth Applications
      • Configure OIDC Auth Applications
      • Default helm overrides for oidc-auth-apps application
    • Configure Users, Groups, and Authorization
      • Grant Kubernetes permissions through direct role binding
      • Grant Kubernetes permissions through groups
    • Configure Kubernetes Client Access
      • Configure Kubernetes Local Client Access
      • Configure Kubernetes Remote Client Access
    • Deprovision LDAP Server Authentication
• Password Rules
  • System Account Password Rules
  • Linux Accounts Password Rules
    • Verify Changes
• Access the System
  • Configure Local CLI Access
  • Remote CLI Access
    • Configure Remote CLI Access
    • Configure Container-backed Remote CLIs and Clients
    • Use Container-backed Remote CLIs and Clients
    • Install Kubectl and Helm Clients Directly on a Host
  • Access the GUI
    • Configure HTTP and HTTPS Ports for Horizon Using the CLI
    • Configure Horizon User Lockout on Failed Logins
    • Install the Kubernetes Dashboard
  • REST API Access
    • Kubernetes
  • Connect to Container Registries through a Firewall or Proxy
• Private Namespace and Restricted RBAC
• Resource Management
  • LimitRange
  • ResourceQuota
• Pod Security Admission Controller
  • Pod Security levels
  • Pod Security Admission labels for namespaces
  • Enable Pod Security Admission
  • Configure defaults for the Pod Security Admission Controller
  • Platform namespaces configuration
  • Pod Security Admission Controller - Usage Example