Talos

Talos is a lightweight API driven full stack Kubernetes system. As with any Kubernetes server, you can set it up to authenticate users using OIDC. This guide details configuring Talos to use Pocket ID as the Authentication and Authorization server

Pocket ID Setup

1. In Pocket-ID create a new OIDC Client, name it i.e. Kubernetes.
2. Set a logo for this OIDC Client if you would like too.
3. Set the callback URL to: http://localhost:8000, or leave blank to autofill on first login.
4. Copy the Client ID, and the Client Secret for use in the next steps.

Talos setup

Modify the cluster.apiServer block to include the below

Create a Cluster role binding linking the admin group you wish to have in to Kubernetes. In the below example, there is a group called kubernetes in Pocket ID that our user is assigned to

Apply this

Modify Kubeconfig file

You will need to install a command line tool kubelogin - Refer to the github repo for instructions related to your system.

Run the below command to generate a config and validate the token is working

You need to ensure that your email is verified as Kubernetes requires this when working with OIDC

You should get a response similar to

Create a new user in your ~/.kube/config file with the below

Then update your current context to use this user

Further Reading

• Kubernetes OIDC
• More indepth documentation and possible errors