My Notes

Dex as k8s oidc provider

1 min read

talosctl gen config dev-talos-cluster https://192.168.1.95:6443 --output-dir _out-new --with-secrets ../secrets.yaml --config-patch @patch.yaml

patch.yaml :

cluster:
  apiServer:
    extraArgs:
      oidc-issuer-url: "https://dex-dev.toolsera.fr/dex/"
      oidc-client-id: "kubernetes"
      oidc-username-claim: "email"
      oidc-groups-claim: "groups"

==============================================================

talosctl patch mc --nodes 192.168.1.50,192.168.1.95,192.168.1.101 --patch @patch.yaml -m reboot #only on control plane node

Create a user named “oidc”

The client id and secret id comes from file config.yaml of dex.

kubectl config set-credentials oidc \
  --exec-api-version=client.authentication.k8s.io/v1beta1 \
  --exec-command=kubectl \
  --exec-arg=oidc-login \
  --exec-arg=get-token \
  --exec-arg=--oidc-issuer-url="https://dex-dev.toolsera.fr/dex/" \
  --exec-arg=--oidc-client-id="kubernetes" \
  --exec-arg=--oidc-extra-scope="email" \
  --exec-arg=--oidc-client-secret="YOUR_OIDC_CLIENT_SECRET_HERE"

    kubectl create clusterrolebinding oidc-cluster-admin --clusterrole=cluster-admin --user='markkpamy@gmail.com'

Graph View