Talos

Talos is a lightweight, API-driven, full-stack Kubernetes system. As with any Kubernetes server, you can set it up to authenticate users with OIDC. This guide configures Talos to use Pocket ID as the authentication and authorization server.

Create the client in Pocket ID

In Pocket ID, open Administration → OIDC Clients and click Add OIDC Client.
Enter a name such as Talos and add the callback URL http://localhost:8000.
Click Create and copy the Client ID and the Client secret. The client secret is only shown once.
On the client’s Access tab, select the groups that may sign in under Allowed User Groups, or choose All Users.

Configure Talos

Modify the cluster.apiServer block to include the following:

cluster:
    apiServer:
        image: registry.k8s.io/kube-apiserver:v1.33.1 # The container image used in the API server manifest.
       extraArgs:
           oidc-issuer-url: https://id.example.com
           oidc-client-id: <client-id>
           oidc-username-claim: sub
           oidc-groups-claim: groups
           oidc-groups-prefix: "oidc:"

Create a cluster role binding that links the admin group you want to use to Kubernetes. In the following example, there is a group called kubernetes in Pocket ID that the user is assigned to.

# filename=crb.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-admins-from-pass-keys
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: oidc:kubernetes

Apply it:

kubectl apply -f crb.yaml

Modify the kubeconfig file

Install the command line tool kubelogin. Refer to its GitHub repository for instructions for your system.

Run the following command to generate a config and validate that the token works:

kubectl oidc-login setup \
--oidc-issuer-url=https://id.example.com \
--oidc-client-id=<client-id> \
--oidc-client-secret=<client-secret> \
--oidc-extra-scope=groups,email,name,sub,email_verified

Make sure that your email is verified, as Kubernetes requires this when working with OIDC.

You should get a response similar to this:

{
  "aud": "a60960a8-c856-43b7-add7-50d83bf7eeab",
  "email": "[email protected]",
  "email_verified": true,
  "exp": 1749867571,
  "groups": ["kubernetes"],
  "iat": 1749863971,
  "iss": "https://id.example.com",
  "nonce": "sLY0SUaiLxe9JDfUpNEsBDbhKceOB-T1zxxRYJPQbvk",
  "sub": "643c3fba-370a-4738-92a6-9ergec96cd99"
}

Create a new user in your ~/.kube/config file:

- name: pocket-id
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
        - oidc-login
        - get-token
        - --oidc-issuer-url=<pocket ID url>
        - --oidc-client-id=<pocket ID url>
        - --oidc-client-secret=<pocket ID url>
        - --oidc-extra-scope=groups
        - --oidc-extra-scope=email
        - --oidc-extra-scope=name

Then update your current context to use this user:

- context:
    cluster: testing
    namespace: default
    user: admin@testng
    user: pocket-id
   name: testing

Talos

Create the client in Pocket ID

Configure Talos

Modify the kubeconfig file

Further reading