[EKS] [request]: Provide correct jwks_uri from the Kubernetes API
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
**Tell us about your request**
I am looking into using Kubernetes ServiceAccounts for inter-service authentication between different services in a Kubernetes cluster using service account token projection. To do this services will need to fetch openid-configuration to validate the signed JWTs
**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We are deploying our applications both to AWS and On-prem. If possible we would like to have as similar configurations as possible, where using Kubernetes has helped us a lot.
The problem I see is that while I can call the default Kubernetes endpoint: `https://kubernetes.default.svc/.well-known/openid-configuration`, the `jwks_uri` parameter is set to an internal hostname, ex: `https://ip-172-16-45-221.eu-west-1.compute.internal:443/openid/v1/jwks`. This is not a part of our VPC so I assume that it is the internal IP address of the instance running the api-server for EKS, so naturally I can not connect to it.
The actual URI for the keys in EKS would be: `https://oidc.eks.eu-west-1.amazonaws.com/id//keys` which works.
**Are you currently working around this issue?**
Calling `https://oidc.eks.eu-west-1.amazonaws.com/id//.well-known/openid-configuration` works as expected, but it would be convenient if we could always rely on `https://kubernetes.default.svc/.well-known/openid-configuration` working within a cluster
Contributor guide
Research direction
No repository files, tests, or entry points are named in the issue. Start by reviewing the Kubernetes API openid-configuration endpoint and comparing its current jwks_uri with the EKS OIDC discovery URL described in the request. Done means the in-cluster endpoint returns a reachable, correct jwks_uri for EKS.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- api, authentication, cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100