Serve openid configuration and public key used for service account token signing to enable support for workload identity

[bmiddha]

This manifest adds a nginx container that serves the following

jwks: https://k8s-oidc.acmuic.org/openid/v1/jwks
openid-configuration: https://k8s-oidc.acmuic.org/.well-known/openid-configuration

The files to serve are obtained by an init container which gets the jwks, openid-configuration from the api server via kubectl

Changed made in machine config:

• Add args to api server with the new issuer
• Generate new RSA key to be use for service account token signing

Keys generated and applied with this script

#!/bin/bash

set -v

TALOSCONFIG=./k8s-talosconfig
KUBECONFIG=./k8s-kubeconfig
ISSUER=https://k8s-oidc.acmuic.org
JWKS_URI=https://k8s-oidc.acmuic.org/openid/v1/jwks

RSA_KEY=$(openssl genrsa 4096 2> /dev/null | openssl pkey -traditional)
RSA_KEY_ENCODED=$(echo "${RSA_KEY}" | base64 -w 0)

CONTROL_PLANE_NODES=( "k8s-01" "k8s-02" "k8s-03" )
ENDPOINTS="k8s-01.acmuic.org,k8s-02.acmuic.org,k8s-03.acmuic.org"

API_SERVER_PATCH=$(cat <<EOF
[
  {
    "op": "add",
    "path": "/cluster/apiServer",
    "value": {
      "disablePodSecurityPolicy": true,
      "extraArgs": {
        "service-account-issuer": "${ISSUER}",
        "service-account-jwks-uri": "${JWKS_URI}"
      }
    }
  },
  {
    "op": "replace",
    "path": "/cluster/serviceAccount",
    "value": {
      "key": "${RSA_KEY_ENCODED}"
    }
  }
]
EOF
)

for NODE in "${CONTROL_PLANE_NODES[@]}"; do
    echo ${NODE}
    talosctl \
        --talosconfig ${TALOSCONFIG} \
	--endpoints "${ENDPOINTS}" \
        --nodes "${NODE}" \
        patch mc \
        --patch "${API_SERVER_PATCH}"
done

[clee231]

😍 This is looking pretty sweet!