T8: k8s-apiserver OIDC flags (flux-clusters) #11

New issue

Closed

opened 2026-08-11 15:20:51 +00:00 by ginjiruu · 1 comment

ginjiruu commented

2026-08-11 15:20:51 +00:00

Owner

Parent

Spec: catalog-driven app bootstrapping and capability groups (#2)

What to build

The RKE2 bootstrap kube-apiserver flags get --oidc-issuer-url etc. so Kubernetes authenticates the capability-group identities (kubelogin helper). Lives in flux-clusters, parallel to the iac-repo sequence.

Acceptance criteria

flux-clusters/bootstrap/configs/think-0{1,2,3}.yaml kube-apiserver-arg gains OIDC flags (issuer, client-id, groups-claim, username-claim)
kubelogin helper can authenticate a Kanidm identity to k8s
groups claim wired so capability groups map to k8s RBAC

Blocked by

None — can start immediately (flux-clusters ticket, parallel).

## Parent Spec: catalog-driven app bootstrapping and capability groups (#2) ## What to build The RKE2 bootstrap kube-apiserver flags get `--oidc-issuer-url` etc. so Kubernetes authenticates the capability-group identities (kubelogin helper). Lives in flux-clusters, parallel to the iac-repo sequence. ## Acceptance criteria - [ ] `flux-clusters/bootstrap/configs/think-0{1,2,3}.yaml` `kube-apiserver-arg` gains OIDC flags (issuer, client-id, groups-claim, username-claim) - [ ] kubelogin helper can authenticate a Kanidm identity to k8s - [ ] groups claim wired so capability groups map to k8s RBAC ## Blocked by None — can start immediately (flux-clusters ticket, parallel).

ginjiruu added the

ready-for-agent

label

2026-08-11 15:21:00 +00:00

ginjiruu referenced this issue

2026-08-11 20:24:47 +00:00

T7: Root wiring + pilot apps (integration) #9

ginjiruu referenced this issue

2026-08-12 02:28:41 +00:00

T13: kubeconfig distribution & connectivity architecture (kubectl access) #28

ginjiruu referenced this issue

2026-08-12 16:50:02 +00:00

Kanidm: provision per-cluster OAuth2 clients + machine SAs for cluster tooling #35

ginjiruu referenced this issue

2026-08-12 18:24:13 +00:00

Kanidm RFC 8693 conformance: issued_token_type serialization breaks agentgateway token exchange #39

ginjiruu referenced this issue

2026-08-12 18:24:33 +00:00

Research: short-lived id_token refresh for static cluster credentials #38

ginjiruu referenced this issue

2026-08-12 18:25:40 +00:00

Argo CD: in-place migration of cluster auth from static SA to Kanidm SA + OIDC #37

ginjiruu referenced this issue

2026-08-12 18:25:40 +00:00

Migrate Sveltos cluster auth from static SA to Kanidm SA + OIDC #36

ginjiruu referenced this issue

2026-08-13 01:55:14 +00:00

T14: Vault Kubernetes auth backend + per-app VSO roles #29

ginjiruu commented

2026-08-19 01:26:43 +00:00

Author

Owner

OIDC flags (issuer, client-id, groups-claim, username-claim, signing-algs) added to all think-*.yaml, applied via Ansible, apiservers restarted. kubelogin authenticated and kubectl get nodes works.

ginjiruu closed this issue

2026-08-19 01:26:44 +00:00