OpenID authentication in GKE with DEX

[ezhiryakov]

Hi there!
GKE allow external oidc provider now.

So I'm trying to configure authentication with OpenID.
Unfortenly without success.

apiVersion: authentication.gke.io/v2alpha1
kind: ClientConfig
metadata:
  creationTimestamp: "2022-02-10T11:28:06Z"
  generation: 22
  name: default
  namespace: kube-public
  resourceVersion: "95539825"
  uid: 56106c0f-4c2b-4949-8049-5d5fa5439967
spec:
  authentication:
  - name: oidc
    oidc:
      clientID: infrastructure-cluster-client-id
      clientSecret: DATA+OMITTED
      extraParams: resource=token-groups-claim,prompt=consent,access_type=offline
      groupsClaim: groups
      issuerURI: https://example.com
      kubectlRedirectURI: http://localhost
      scopes: profile email offline_access groups
      userClaim: email
  certificateAuthorityData: DATA+OMITTED
  internalServer: ""
  name: infrastructure
  server: https://DATA+OMITTED
status: {}

With this ClientConfig I can generate kubeconfig with JWT token.

sudo kubectl oidc login --cluster=CLUSTER_NAME --login-config=login-config.yaml
2022/02/11 15:04:39 Started webserver on localhost:80.
2022/02/11 15:04:39 Attempting to open http://127.0.0.1:80/login in default browser.
2022/02/11 15:04:46 OIDC Authentication successful.

But I can't connect to k8s cluster then:

sudo kubectl get pods
error: You must be logged in to the server (Unauthorized)

Before experimenting with GKE, I tried configure k3s cluster with OpenID authentication and dex-k8s-authenticator.
With k3s, dex and dex-k8s-authenticator all works as expected.

Please help with this.

[youvegotmoxie]

I had the same issue and it ended up being due to a misconfiguration in the default ClientConfig as the documentation isn't very clear on what value should be set and it wasn't immedately obvious that the default one that is generated when installing the OIDC connector was the external IP of the gke-oidc-envoy service (I had originally set this to the IP of the apiserver endpoint since normally you configure kube-apiserver with flags to allow OIDC so I made a bad assumption on how the GKE components for OIDC work together as it's not really explained in the documentation). So make sure you have spec.server set to the IP of the gke-oidc-envoy service as that is what's handling authz for the k8s apiserver after you retrieve your kubeconfig from the kubectl oidc plugin.

Additionally, since by default the gke-oidc-envoy service gets an internal IP and isn't accessible from outside the VPC or cluster depending on what type of networking you chose for GKE, you'll need to change the service to an external LoadBalancer type and ensure that gets a public IP and then set that in spec.server for the default ClientConfig both in the cluster and for the login-config.yaml you provide to kubectl when logging into Dex.

[mohsin-786]

Hi I'm getting the unauthorised error like above. Can u show me client and login config? And the load balancer of envoy too