# Ensure OIDC Authentication Is Configured for the Cluster

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826030884462-ensure-oidc-authentication-is-configured-for-the-cluster
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure each Managed Kubernetes cluster is connected to an OpenID Connect (OIDC) provider, so users authenticate to the cluster with their company identity, and access is controlled with Kubernetes RBAC instead of shared admin kubeconfig files.

**Rationale**

The default admin kubeconfig gives full control of the cluster and is often shared between people and tools, which makes it impossible to tell who did what or to remove access for one person. OIDC lets each user sign in with their own identity, with permissions controlled by RBAC and removed centrally.

**Impact**

-   Each user signs in with their own identity
    
-   Access is removed centrally in the identity provider
    
-   RBAC roles must be defined for users and groups
    

**Default Value**

By default, no OIDC provider is configured, and access uses the admin kubeconfig.

**Pre-Requisites**

-   Permission to manage the Kubernetes cluster
    
-   An OIDC provider with a client ID and issuer URL
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  Open the OIDC tab and check whether an OIDC provider is configured.
    
5.  If no OIDC provider is configured, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  Open the OIDC tab and, in the OIDC provider section, click the button to configure the provider.
    
5.  Enter the Provider URL (the OIDC issuer URL) and the Client ID, plus any optional claims and CA content, then save.
    
6.  Create Kubernetes RBAC role bindings for the OIDC users and groups.
    
7.  Limit use of the admin kubeconfig to emergencies.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  Open the OIDC tab and remove the OIDC provider configuration.
    

**Reference**

-   [https://help.ovhcloud.com/csm/en-public-cloud-kubernetes-configure-oidc-provider?id=kb\_article\_view&sysparm\_article=KB0049671](https://help.ovhcloud.com/csm/en-public-cloud-kubernetes-configure-oidc-provider?id=kb_article_view&sysparm_article=KB0049671)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.