Tech Stories Tech Brief By HackerNoon

HackerNoon

Learn the latest tech-stories updates in the tech world.

  1. 2 hr ago

    Building a Kubernetes Operator for Workload Identity Federation Across AWS and GCP

    This story was originally published on HackerNoon at: https://hackernoon.com/building-a-kubernetes-operator-for-workload-identity-federation-across-aws-and-gcp. myceliam turns Kubernetes Namespaces and ServiceAccounts into the source of truth for identity, create counterpart resources in IDPs and cloud providers. Check more stories related to tech-stories at: https://hackernoon.com/c/tech-stories. You can also check exclusive content about #kubernetes-operators, #oidc, #auth0, #oauth2-client-credentials, #gcp-workload-identity, #aws-iam, #myceliam, #hackernoon-top-story, and more. This story was written by: @myceliam-dev. Learn more about this writer by checking @myceliam-dev's about page, and for more stories, please visit hackernoon.com. I wanted pods in any cluster to get short-lived AWS and GCP credentials using nothing but their Kubernetes identity. No static keys. Doing that by hand means an OIDC provider, an audience, a trust-policy statement and a GCP IAM binding for every namespace, ServiceAccount and cloud account. So I wrote a Kubernetes operator in Go that creates and reconciles all of it from ServiceAccount labels and two small CRDs. This article walks through how it's built, why I made the design choices I did, and about a dozen undocumented-feeling behaviors of AWS STS, GCP Workload Identity, Keycloak and Auth0 that I only found by testing against the real services. The project is open source (Apache 2.0) and early-stage. It works end to end, but it isn't hardened for production.

    Building a Kubernetes Operator for Workload Identity Federation Across AWS and GCP

About

Learn the latest tech-stories updates in the tech world.