Cluster tooling auth -> Kanidm OIDC (Golden Path)

New issue

Move Argo CD, Sveltos, and Vault cluster auth off static bootstrap SAs onto Kanidm SA + OIDC via the agentgateway per-request RFC 8693 token exchange (#38). Shared credential source #35; gateway data plane T13 #28; Vault TokenReview path #29. Cross-repo prerequisite: flux-clusters apiserver OIDC flags (#11/flux-clusters #1522).

No due date

28% Completed

5 Open 2 Closed 7 All

Label

Show archived labels

All labels No label

needs-info

needs-triage

ready-for-agent

ready-for-human

wontfix

Project

All projects No project

Author

All authors

Assignee

All assignees No assignee

ginjiruu

Sort

Relevance Newest Oldest Recently updated Least recently updated Most commented Least commented Nearest due date Farthest due date

Research: short-lived id_token refresh for static cluster credentials

#38 opened 2026-08-12 16:51:36 +00:00 by ginjiruu 4 / 5

Argo CD: in-place migration of cluster auth from static SA to Kanidm SA + OIDC

#37 opened 2026-08-12 16:50:32 +00:00 by ginjiruu 0 / 4

Kanidm: provision per-cluster OAuth2 clients + machine SAs for cluster tooling

#35 opened 2026-08-12 16:50:02 +00:00 by ginjiruu 0 / 4

T14: Vault Kubernetes auth backend + per-app VSO roles

#29 opened 2026-08-12 15:02:23 +00:00 by ginjiruu

T13: kubeconfig distribution & connectivity architecture (kubectl access)

1

#28 opened 2026-08-12 02:28:41 +00:00 by ginjiruu