Description

Ensure each Managed Kubernetes cluster is connected to an OpenID Connect (OIDC) provider, so users authenticate to the cluster with their company identity, and access is controlled with Kubernetes RBAC instead of shared admin kubeconfig files.

Rationale

The default admin kubeconfig gives full control of the cluster and is often shared between people and tools, which makes it impossible to tell who did what or to remove access for one person. OIDC lets each user sign in with their own identity, with permissions controlled by RBAC and removed centrally.

Impact

  • Each user signs in with their own identity

  • Access is removed centrally in the identity provider

  • RBAC roles must be defined for users and groups

Default Value

By default, no OIDC provider is configured, and access uses the admin kubeconfig.

Pre-Requisites

  • Permission to manage the Kubernetes cluster

  • An OIDC provider with a client ID and issuer URL

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. Open the OIDC tab and check whether an OIDC provider is configured.

  5. If no OIDC provider is configured, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. Open the OIDC tab and, in the OIDC provider section, click the button to configure the provider.

  5. Enter the Provider URL (the OIDC issuer URL) and the Client ID, plus any optional claims and CA content, then save.

  6. Create Kubernetes RBAC role bindings for the OIDC users and groups.

  7. Limit use of the admin kubeconfig to emergencies.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. Open the OIDC tab and remove the OIDC provider configuration.

Reference