5 ms·
How do you avoid configuring the API server to support OIDC? https://kubernetes.io/docs/reference/access-authn-authz/authentication/#configuring-the-api-server
by AETackaberry 4y ago
How do you avoid configuring the API server to support OIDC?
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#configuring-the-api-server https://kubernetes.io/docs/reference/access-authn-authz/auth...
- AETackaberry 4y agoSeems like you intercept the request and use an admin service account token then impersonate?
- jmorgan 4y agoGreat question! Most managed Kubernetes services don't support OIDC (and for EKS, which does support custom OIDC providers, it requires restarting the entire control plane to edit the configuration). Infra runs a lightweight process in-cluster that intercepts requests and verifies them - and yes, this process intercepts requests and then impersonates the correct users and groups.