Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add External Identity Providers support in AKS #2861

Open
miwithro opened this issue Mar 22, 2022 · 72 comments
Open

Add External Identity Providers support in AKS #2861

miwithro opened this issue Mar 22, 2022 · 72 comments
Assignees
@charleswool
Labels
feature-request Requested Features security

Comments

@miwithro
Copy link
Contributor

miwithro commented Mar 22, 2022 •
edited
Loading

Currently planned for AKS 1.30 Enable OIDC Federation support to enable multi-cloud or alternative identity solutions in AKS.

https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens
@mjsabby
Copy link

mjsabby commented Mar 23, 2022

What is the ETA for this in a public AKS release? I'm assuming this feature is required to implement equivalent functionality that we had with aad pod identity?

@miwithro
Copy link
Contributor Author

Workload Identity is using OIDC Issuer which we have already published. This is adding additional OIDC Federation capabilities. We don't have an ETA yet, as we are still doing planning.

@ghost
Copy link

ghost commented Mar 23, 2022

@Azure/aks-pm issue needs labels

@CocoWang-wql CocoWang-wql changed the title Add OIDC Federation support in AKS Add External Identity Providers support in AKS Mar 24, 2022
@CocoWang-wql
Copy link
Contributor

The OIDC federation feature would be named "External Identity Providers" in AKS cluster.

@ghost
Copy link

ghost commented Mar 30, 2022

@Azure/aks-pm issue needs labels

@UXabre UXabre mentioned this issue Apr 2, 2022
Open
@NeelavaChatterjee
Copy link

Will this feature be available within 3 or 6 months?

@CocoWang-wql
Copy link
Contributor

This feature is in plan and checking internally about the ETA. Will update soon.

@CocoWang-wql
Copy link
Contributor

The tentative date for public preview is Oct.

@miwithro miwithro reopened this Apr 27, 2022
@CocoWang-wql CocoWang-wql mentioned this issue Apr 30, 2022
Closed
@ghost ghost added the action-required label May 22, 2022
@ghost
Copy link

ghost commented May 27, 2022

Action required from @Azure/aks-pm

@ghost ghost added the Needs Attention 👋 Issues needs attention/assignee/owner label May 27, 2022
@CocoWang-wql CocoWang-wql removed action-required Needs Attention 👋 Issues needs attention/assignee/owner labels May 28, 2022
@ghost ghost added the action-required label Jun 22, 2022
@ghost
Copy link

ghost commented Jun 27, 2022

Action required from @Azure/aks-pm

@ghost ghost added the Needs Attention 👋 Issues needs attention/assignee/owner label Jun 27, 2022
@ghost
Copy link

ghost commented Jul 12, 2022

Issue needing attention of @Azure/aks-leads

1 similar comment
@ghost
Copy link

ghost commented Jul 27, 2022

Issue needing attention of @Azure/aks-leads

@miwithro miwithro removed action-required Needs Attention 👋 Issues needs attention/assignee/owner labels Jul 27, 2022
@ghost ghost added the action-required label Aug 22, 2022
@artificial-aidan
Copy link

Yes. I'm using that along with dex to do GitHub Oauth to an AKS cluster.

I don't have any specific documentation. But the oidc proxy should have setup instructions. I haven't touched it in 6 months so don't really remember exactly how I set it up

@sspreitzer
Copy link

I mean, 2 years later, waiting for feature that other clouds had... it should be many other benefits that keeping you with this cloud.

I am fighting very hard not to add cynical jokes about this situation.

@maheshrajrp
Copy link

maheshrajrp commented Jan 25, 2024 •
edited
Loading

I mean, 2 years later, waiting for feature that other clouds had... it should be many other benefits that keeping you with this cloud.

I am fighting very hard not to add cynical jokes about this situation.

Ah, humor based on my pain...

btwn, cant help but notice @sspreitzer are you the guy who owns this ?
https://git.spreitzer.ch/sspreitzer

im guessing yes, I have few questions,

Why do would we need a Ingress for the kube-oidc-proxy ? Couldn't understand that part.

ingress:
enabled: true
annotations:
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/preserve-trailing-slash: "true"
cert-manager.io/cluster-issuer: letsencrypt-production
hosts:
- k.mycluster.k8s.example.com

@sspreitzer
Copy link

btwn, cant help but notice @sspreitzer are you the guy who owns this ? https://git.spreitzer.ch/sspreitzer

yes, I host my code at home and mirror it to GitHub.

@maheshrajrp
Copy link

Why would we need an Ingress for the kube-oidc-proxy ? Couldn't understand that part.

ingress:
enabled: true
annotations:
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/preserve-trailing-slash: "true"
cert-manager.io/cluster-issuer: letsencrypt-production
hosts:

  • k.mycluster.k8s.example.com

Would be helpful if there is a way I could reach out to you regarding this. Thanks in advance.

@sspreitzer
Copy link

Why would we need an Ingress for the kube-oidc-proxy ? Couldn't understand that part.

ingress: enabled: true annotations: nginx.ingress.kubernetes.io/backend-protocol: HTTPS nginx.ingress.kubernetes.io/force-ssl-redirect: "true" nginx.ingress.kubernetes.io/preserve-trailing-slash: "true" cert-manager.io/cluster-issuer: letsencrypt-production hosts:

  • k.mycluster.k8s.example.com

Would be helpful if there is a way I could reach out to you regarding this. Thanks in advance.

You can open a new issue at https://git.spreitzer.ch/helm/kube-oidc-proxy/-/issues/new. Be warned, I am currently finishing a thesis paper and will not have time to reply by mid of February.

@maheshrajrp
Copy link

maheshrajrp commented Jan 25, 2024 •
edited
Loading

Understood, Raised one.. Thanks.

https://git.spreitzer.ch/helm/kube-oidc-proxy/-/issues/1

@artificial-aidan
Copy link

I mean, 2 years later, waiting for feature that other clouds had... it should be many other benefits that keeping you with this cloud.

I am fighting very hard not to add cynical jokes about this situation.

Ah, humor based on my pain...

btwn, cant help but notice @sspreitzer are you the guy who owns this ?
https://git.spreitzer.ch/sspreitzer

im guessing yes, I have few questions,

Why do would we need a Ingress for the kube-oidc-proxy ? Couldn't understand that part.

ingress:
enabled: true
annotations:
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/preserve-trailing-slash: "true"
cert-manager.io/cluster-issuer: letsencrypt-production
hosts:
- k.mycluster.k8s.example.com

Ingress is needed because kube-oidc-proxy is how you access the cluster. The proxy is the entry point, if you look at the diagrams in the original oidc proxy documentation it shows the flow.

https://github.com/jetstack/kube-oidc-proxy

I believe I used the forked and maintained version of that.

@maheshrajrp
Copy link

maheshrajrp commented Jan 25, 2024 •
edited
Loading

@artificial-aidan Thanks alot. This really helps.

@maheshrajrp maheshrajrp mentioned this issue Feb 23, 2024
Closed
@microsoft-github-policy-service Microsoft GitHub Policy Service
Copy link
Contributor

Action required from @Azure/aks-pm

@microsoft-github-policy-service microsoft-github-policy-service bot added the Needs Attention 👋 Issues needs attention/assignee/owner label Feb 25, 2024
@CocoWang-wql CocoWang-wql removed the Needs Attention 👋 Issues needs attention/assignee/owner label Feb 25, 2024
@CocoWang-wql
Copy link
Contributor

We start the design. And we will share the progress here.

@maheshrajrp
Copy link

another month passed guys, any updates ?

@sspreitzer
Copy link

I just returned from a physical meeting at Microsoft in Zurich, Switzerland with Brian Redmond (@chzbrgr71). He is one of the product managers for AKS. We discussed this issue and Brian assured me that holding Microsoft accountable for implementing this feature is good and Microsoft will take a closer look on this topic, and will definitely follow-up.

I just wanted this community to know and document today's event.

@palakchheda
Copy link

hi, any progress/update on this? Seems like upstream kubernetes now support multiple OIDC identity provider configurations.

@harjain99
Copy link

Hi! Just checking in here to see if there any updates on this issue.

@qudongfang
Copy link

Any updates?

@qudongfang
Copy link

Currently planned for AKS 1.30 Enable OIDC Federation support to enable multi-cloud or alternative identity solutions in AKS.

AKS 1.30 was released in July 2024, and this feature is still in the backlog https://github.com/orgs/Azure/projects/685/views/1

https://learn.microsoft.com/en-us/azure/aks/supported-kubernetes-versions?tabs=azure-cli#aks-kubernetes-release-calendar

@charleswool charleswool self-assigned this Sep 14, 2024
@palakchheda
Copy link

Is there an ETA or any workaround on this?

@Richard87 Richard87 mentioned this issue Sep 26, 2024
Open
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@charleswool charleswool

Labels
feature-request Requested Features security
Projects
Azure Kubernetes Service Roadmap (Public)
Status: Backlog
Milestone
No milestone
Development

No branches or pull requests