Using dex-k8s-authenticator with AWS EKS

[jeffisabelle]

Hey there, is it possible to use this authenticator with EKS? I was trying to set this up, but apparently it is not possible to update Kubernetes API Server parameters in EKS and thus dex does not work directly with OIDC. [1]

There is also a way to enable dex on EKS with a proxy [2], but I couldn't match the puzzle pieces together.

Has anybody done this before?

1 - aws/containers-roadmap#166
2 - https://github.com/jetstack/kube-oidc-proxy

Thanks!

[petrokashlikov]

There is good blog regarding option #2
https://aws.amazon.com/blogs/opensource/consistent-oidc-authentication-across-multiple-eks-clusters-using-kube-oidc-proxy/

[jeffisabelle]

Thanks!

I saw that yesterday but that seemed a bit complicated. (more pieces into the puzzle) In that case, I'm replacing dex-k8s-authenticator completely with gangway, right?

I'll give that a go today, let's see..

[jeffisabelle]

Ok, I was able to use dex-k8s-authenticator on EKS. This obviously requires kube-oidc-proxy setup, and instead of configuring dex-k8s-authenticator to talk with EKS directly, you configure it to talk with kube-oidc-proxy.

It works quite well!

[primeroz]

@jeffisabelle that is great to hear.

Would you mind writing something in the docs folder and MR it ?

thanks

[jeffisabelle]

Yes, of course. I can create a PR on this weekend with a runbook for the EKS setup. Cheers,