News for hackers. Stuff that matters.

A comment on Launch HN: Infra (YC W21) – Open-source access management for Kubernetes. Parent comment

Re:Launch HN: Infra (YC W21) – Open-source access management... by AETackaberry on Tuesday May 17, 2022 @05:25PM (#31416478)
How does the API server verify the user's token?
[ Parent | on HN ]
Re:Launch HN: Infra (YC W21) – Open-source access management... by jmorgan on Tuesday May 17, 2022 @05:52PM (#31416725)
Tokens are verified by intercepting API server requests in-cluster against a central root of trust. This is similar to how OpenID tokens from identity providers such as Okta or Active Directory are verified by destination web applications. This works no matter where clusters are hosted (including GKE/AKS/EKS or self-hosted clusters).
[ Parent | on HN ]
Re:Launch HN: Infra (YC W21) – Open-source access management... by AETackaberry on Tuesday May 17, 2022 @07:43PM (#31417538)
How do you avoid configuring the API server to support OIDC?

https://kubernetes.io/docs/reference/access-authn-authz/auth...

[ Parent | on HN ]
Re:Launch HN: Infra (YC W21) – Open-source access management... by AETackaberry on Tuesday May 17, 2022 @07:46PM (#31417558)
Seems like you intercept the request and use an admin service account token then impersonate?
[ Parent | on HN ]
Re:Launch HN: Infra (YC W21) – Open-source access management... by jmorgan on Tuesday May 17, 2022 @07:49PM (#31417578)
Great question! Most managed Kubernetes services don't support OIDC (and for EKS, which does support custom OIDC providers, it requires restarting the entire control plane to edit the configuration).

Infra runs a lightweight process in-cluster that intercepts requests and verifies them - and yes, this process intercepts requests and then impersonates the correct users and groups.

[ Parent | on HN ]