What web UI should I provide for internal Kubernetes users?
I manage several Kubernetes clusters on AWS EKS and want to provide internal users with a web interface for viewing and managing the resources they're allowed to access.…
OIDC
What’s the safest way to manage CI/CD credentials?
When I first built a deployment pipeline, I put database passwords and API keys in GitHub Actions Secrets and assumed encryption made them safe. I'm now realizing that…
How do you manage third-party API keys when edge functions use OIDC?
OIDC makes a lot of sense for cloud services because edge functions can exchange a runtime identity for short-lived credentials instead of storing permanent AWS access keys in…
What’s the safest way to manage CI/CD credentials?
When I first built a deployment pipeline, I stored database passwords and API keys in the platform's encrypted secrets store and assumed that was sufficient. I've since realized…
After moving to workload identity, how much secret management is actually left?
I'm trying to understand what remains after replacing long-lived cloud credentials with workload identity and OIDC. Using identities for services like AWS or S3 seems to eliminate a…
What are the options for scoped machine authentication with AWS?
AWS identity integration can be difficult in regulated environments that require federated credentials and machine-level authentication. I'm looking for an approach where individual workloads or resources can present…
What’s the best way to support secure human API access without long-lived tokens?
We run an internal self-service platform API, and people need to access it from CLI tools and scripts. Right now, we create a static token, display it once…
What’s the best way to manage human access to an internal API?
We run an internal self-service platform API, and employees sometimes need to access it from command-line tools or scripts. Right now, we issue a static token, display it…
What are some Open Source User Authentication Tools for Kubernetes?
Hey everyone! I'm managing a cluster with Ionos and I'm looking to set up user authentication to avoid downloading the kubeconfig file. I'm hoping to implement OIDC and…
Issues with JWT and OIDC Authentication on the Same Application Load Balancer
I've set up JWT authentication on my Application Load Balancer (ALB) and I'm running into issues. Even after configuring it on a different host header and a sub-path,…
How can I set up SSO for Microsoft using my self-hosted identity provider?
Hey everyone! I'm trying to implement Single Sign-On (SSO) for our Microsoft services, but I'm hitting a wall. We're currently using Google Workspace for our business, but some…
OIDC vs. Access Keys: What's the Best Approach for AWS Authentication?
I'm looking for advice on the best way to handle authentication for our service users that interact with AWS and Azure. We're currently automating the rotation of access…
How can I effectively implement S3 API for an application on Azure Kubernetes Service?
Hey everyone! I'm looking to deploy an application on Azure Kubernetes Service (AKS), but I come from an on-premise background and I'm not too familiar with Azure yet.…
Best Practices for Debugging OIDC Issues
As someone who builds SSO integrations, I often find that debugging OIDC can be quite frustrating. Common problems I encounter include missing claims, redirect mismatches, and PKCE errors.…
Need Help with OIDC Setup Using Traefik, Dex, and Authelia
Hey everyone! I'm in a bit of a bind and could really use some advice on my OIDC setup with Traefik, Dex, and Authelia. I've already posted in…
How can we implement SAML for a new client in our existing OAuth setup?
Hey everyone! We've developed several applications mainly for our internal organization, which are set up with app registrations in Entra and use OAuth/OIDC for login with the MSAL…
How can I safely share Kubernetes access with limited permissions?
Hey everyone! I've mainly worked with GKE, Digital Ocean, and self-hosted Kubernetes clusters where they generate a kubeconfig file that gives admin access. I'm wondering how to manage…
Why is my ALB losing the OIDC client secret?
I'm having a strange issue with my Application Load Balancer (ALB) that authenticates with Okta using OpenID Connect (OIDC). It seems to lose the client secret configured in…
What's the Easiest Way to Get an OIDC ID Token from AWS Session Credentials?
Hey there! I'm trying to figure out the easiest method to obtain an OpenID Connect (OIDC) ID token using AWS session credentials. As I understand it, the AWS…