Access kubernetes cluster that has oidc configured via an application inside the cluster

Question

I want my in-cluster deployment of a app to access the kubernetes cluster that has oidc configured, how do i do that, I know one way is via service accounts but do we have something where we can use the oidc flow and the token received to make request to the cluster from within the app?

Here is the app deployment config https://gist.github.com/ashu8912/97cf92ce9b4df2f9c71671cbe45b4625

Answer 1

Let me start first with the short summary of your intention, so that we have a common baseline.

You want to talk to remote cluster (2) with oidc authentication configured, and this communication ought to be initiated by client (headlamp app) running inside your mother cluster (1).

If this is the case, the way to achieve it, is to use out-of-cluster client configuration by your headlamp app.

I assume your app is similar to Kubernetes Dashboard, and is written in Go as well, so here is the corresponding example of such an out-of-cluster configuration.

In short, this is where you should point to the existing kubeconfig file, which I assumed you previously configured with kubectl according the official documentation for the oidc-auth provider plugin. Because this kubeconfig file usually stay at your client's computer side, you should copy it to the headlamp container.