aws / aws/containers-roadmap

[EKS] [request]: Provide correct jwks_uri from the Kubernetes API

Open
#2,234 1 comment 19 reactions 0 assignees View on GitHub
EKS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

**Tell us about your request**
I am looking into using Kubernetes ServiceAccounts for inter-service authentication between different services in a Kubernetes cluster using service account token projection. To do this services will need to fetch openid-configuration to validate the signed JWTs

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We are deploying our applications both to AWS and On-prem. If possible we would like to have as similar configurations as possible, where using Kubernetes has helped us a lot.

The problem I see is that while I can call the default Kubernetes endpoint: `https://kubernetes.default.svc/.well-known/openid-configuration`, the `jwks_uri` parameter is set to an internal hostname, ex: `https://ip-172-16-45-221.eu-west-1.compute.internal:443/openid/v1/jwks`. This is not a part of our VPC so I assume that it is the internal IP address of the instance running the api-server for EKS, so naturally I can not connect to it.

The actual URI for the keys in EKS would be: `https://oidc.eks.eu-west-1.amazonaws.com/id//keys` which works.

**Are you currently working around this issue?**
Calling `https://oidc.eks.eu-west-1.amazonaws.com/id//.well-known/openid-configuration` works as expected, but it would be convenient if we could always rely on `https://kubernetes.default.svc/.well-known/openid-configuration` working within a cluster

Contributor guide

Open the contributing guide

Research direction

No repository files, tests, or entry points are named in the issue. Start by reviewing the Kubernetes API openid-configuration endpoint and comparing its current jwks_uri with the EKS OIDC discovery URL described in the request. Done means the in-cluster endpoint returns a reachable, correct jwks_uri for EKS.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
api, authentication, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.