Portable, Universal Single Sign-On for Your Clusters
summary
Shows a practical SSO path that avoids editing cluster API flags by wiring an OIDC-capable proxy in front of apps and, when flags are immutable, a second proxy that injects Kubernetes impersonation headers so the API server accepts requests. Demos run on minikube with oauth2-proxy (or gatekeeper) yielding JWTs that the API server accepts once configured, and a GKE-style demo using Jetstack’s impersonation-proxy that mints service-account tokens and works for the Dashboard; exec/streaming behavior remains unclear.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:07Miguel Martinez
- 1:18Agenda
- 4:04Client Certs
- 9:58Json Web Token
- 13:44Install the Proxy
- 15:27Configuring the Api Server
- 23:44Impersonation Proxy
- 24:41Logs
related talks
31mConnecting Dots: Unified Hybrid Multi-Cluster Auth Experience With SPIFFE and Cluster Inventory API
43mSharing is NOT Caring: Stop Sharing Your Kubernetes Cluster Credentials
01h 59mBuilding Secure Kubernetes Clusters with Identity Management
21mSecure ArgoCD Multi-Cluster Management Across Clouds Without Static Tokens
29mEverything Wrong with K8s Authentication and How We Worked Around It
36mAdvanced Authentication patterns at the Edge
31mKubernetes OIDC That Works in Practice: Keycloak + RBAC + Kubelogin Without Day‑2 Pain
26mSecuring Access to Kubernetes Infrastructure with Kubernetes Zero Trust Principles