eksctl
eksctl copied to clipboard
eksctl-io
eksctl support for writing out OIDC enabled kubeconfig file
When EKS associated with Identity Provider (for example OKTA), kubectl can be used by adding flag --user=oidc, such option not exists for eksctl, and thus eksctl can't be used with OIDC enabled EKS cluster
Hello leonchik1976 :wave: Thank you for opening an issue in eksctl project. The team will review the issue and aim to respond within 1-5 business days. Meanwhile, please read about the Contribution and Code of Conduct guidelines here. You can find out more information about eksctl on our website
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
OIDC section in KUBECONFIG file:
- name: oidc user: exec: apiVersion: client.authentication.k8s.io/v1beta1 args: - oidc-login - get-token - --oidc-issuer-url= - --oidc-client-id= - --oidc-extra-scope=email - --oidc-extra-scope=offline_access - --oidc-extra-scope=profile - --oidc-extra-scope=openid command: kubectl env: null interactiveMode: IfAvailable provideClusterInfo: false
This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.
This issue was closed because it has been stalled for 5 days with no activity.
@leonchik1976 looks like you're looking for a way to ask eksctl commands to use OIDC authentication instead of IAM-based authentication for communicating with the API server. This feature is not supported in eksctl. The identityProviders feature only associates an OIDC identity provider with an EKS cluster. Subsequent eksctl commands that interact with the API server will still use IAM-based authentication.
We can look into adding support for supplying a kubeconfig file and a context/user that eksctl uses to authenticate with the API server, bypassing the existing STS-based authentication mechanism.
This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.
https://github.com/eksctl-io/eksctl/blob/main/examples/27-oidc-provider.yaml
https://github.com/eksctl-io/eksctl/blob/main/examples/27-oidc-provider.yaml
It doesn't seems it related to original issue for OIDC authentication for EKS Cluster