Add External Identity Providers support in AKS

[miwithro]

Currently planned for AKS 1.30 Enable OIDC Federation support to enable multi-cloud or alternative identity solutions in AKS.

https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens

[mjsabby]

What is the ETA for this in a public AKS release? I'm assuming this feature is required to implement equivalent functionality that we had with aad pod identity?

[miwithro]

Workload Identity is using OIDC Issuer which we have already published. This is adding additional OIDC Federation capabilities. We don't have an ETA yet, as we are still doing planning.

[ghost]

@Azure/aks-pm issue needs labels

[CocoWang-wql]

The OIDC federation feature would be named "External Identity Providers" in AKS cluster.

[ghost]

@Azure/aks-pm issue needs labels

[NeelavaChatterjee]

Will this feature be available within 3 or 6 months?

[CocoWang-wql]

This feature is in plan and checking internally about the ETA. Will update soon.

[CocoWang-wql]

The tentative date for public preview is Oct.

[ghost]

Action required from @Azure/aks-pm

[ghost]

Action required from @Azure/aks-pm

[ghost]

Issue needing attention of @Azure/aks-leads

[ghost]

Issue needing attention of @Azure/aks-leads

[maheshrajrp]

Why would we need an Ingress for the kube-oidc-proxy ? Couldn't understand that part.

ingress:
enabled: true
annotations:
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/preserve-trailing-slash: "true"
cert-manager.io/cluster-issuer: letsencrypt-production
hosts:

• k.mycluster.k8s.example.com

Would be helpful if there is a way I could reach out to you regarding this. Thanks in advance.

[sspreitzer]

Why would we need an Ingress for the kube-oidc-proxy ? Couldn't understand that part.

ingress: enabled: true annotations: nginx.ingress.kubernetes.io/backend-protocol: HTTPS nginx.ingress.kubernetes.io/force-ssl-redirect: "true" nginx.ingress.kubernetes.io/preserve-trailing-slash: "true" cert-manager.io/cluster-issuer: letsencrypt-production hosts:

• k.mycluster.k8s.example.com

Would be helpful if there is a way I could reach out to you regarding this. Thanks in advance.

You can open a new issue at https://git.spreitzer.ch/helm/kube-oidc-proxy/-/issues/new. Be warned, I am currently finishing a thesis paper and will not have time to reply by mid of February.

[maheshrajrp]

Understood, Raised one.. Thanks.

https://git.spreitzer.ch/helm/kube-oidc-proxy/-/issues/1

[artificial-aidan]

I mean, 2 years later, waiting for feature that other clouds had... it should be many other benefits that keeping you with this cloud.

I am fighting very hard not to add cynical jokes about this situation.

Ah, humor based on my pain...

btwn, cant help but notice @sspreitzer are you the guy who owns this ?
https://git.spreitzer.ch/sspreitzer

im guessing yes, I have few questions,

Why do would we need a Ingress for the kube-oidc-proxy ? Couldn't understand that part.

ingress:
enabled: true
annotations:
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/preserve-trailing-slash: "true"
cert-manager.io/cluster-issuer: letsencrypt-production
hosts:
- k.mycluster.k8s.example.com

Ingress is needed because kube-oidc-proxy is how you access the cluster. The proxy is the entry point, if you look at the diagrams in the original oidc proxy documentation it shows the flow.

https://github.com/jetstack/kube-oidc-proxy

I believe I used the forked and maintained version of that.

[maheshrajrp]

@artificial-aidan Thanks alot. This really helps.

[microsoft-github-policy-service]

Action required from @Azure/aks-pm

[CocoWang-wql]

We start the design. And we will share the progress here.

[maheshrajrp]

another month passed guys, any updates ?

[sspreitzer]

I just returned from a physical meeting at Microsoft in Zurich, Switzerland with Brian Redmond (@chzbrgr71). He is one of the product managers for AKS. We discussed this issue and Brian assured me that holding Microsoft accountable for implementing this feature is good and Microsoft will take a closer look on this topic, and will definitely follow-up.

I just wanted this community to know and document today's event.

[palakchheda]

hi, any progress/update on this? Seems like upstream kubernetes now support multiple OIDC identity provider configurations.

[harjain99]

Hi! Just checking in here to see if there any updates on this issue.

[qudongfang]

Any updates?

[qudongfang]

Currently planned for AKS 1.30 Enable OIDC Federation support to enable multi-cloud or alternative identity solutions in AKS.

AKS 1.30 was released in July 2024, and this feature is still in the backlog https://github.com/orgs/Azure/projects/685/views/1

https://learn.microsoft.com/en-us/azure/aks/supported-kubernetes-versions?tabs=azure-cli#aks-kubernetes-release-calendar

[palakchheda]

Is there an ETA or any workaround on this?