Skip to content

Enable automatic OIDC integration for created kubernetes cluster #604

Closed
Feature
Closed
Enable automatic OIDC integration for created kubernetes cluster#604
Feature
Labels
area/keycloakIssues or PRs related to Keycloak (SSO / identity)area/kubernetesIssues or PRs related to the tenant Kubernetes appkind/featureCategorizes issue or PR as related to a new featurelifecycle/frozenIndicates that an issue or PR should not be auto-closed due to stalenesstriage/not-reproducibleIndicates an issue can not be reproduced as described

Description

@c42-konstantin
c42-konstantin
opened on Jan 23, 2025

Description

When users create a kubernetes cluster they often want to have a seamless single sign-on (SSO) using the same OIDC provider used by platform (CozyStack) itself. Something like it's done in hyperscalers.
Currently kubernetes clusters require additional configuration to use platform keycloak (or other IDP) provider for authentication.

Proposed solution

Add an (optional) parameter to the 'kind: Kubernetes' spec, that allows user to specify authentication configuration of the kubernetes cluster that is going to be created. So that if cozystack has been configured with OIDC enabled a user can select this parameter as 'platform-oidc' (or something like this), if not - user can specify any another IDP that is compatible with kubernets or don't specify anything.

Activity

  1. dosubot
    added
    kind/featureCategorizes issue or PR as related to a new feature
    on Jan 23, 2025

  2. kvaps commented on Feb 6, 2025

    @kvaps
    Andrei Kvapil (kvaps)
    on Feb 6, 2025
    Member

    Totally makes sense, we'll consider the implementation.

  3. kvaps commented on Feb 6, 2025

    @kvaps
    Andrei Kvapil (kvaps)
    on Feb 6, 2025
    Member

    To implement this we need to add extra options --oicd-* into KamajiControlPlane resource

    https://github.com/aenix-io/cozystack/blob/1a88883a3b1dc5c4ac69f100501f982b86d02159/packages/apps/kubernetes/templates/cluster.yaml#L95-L128

  4. Nick Volynkin (NickVolynkin)
    added the
    Feature
    issue type on Mar 25, 2025
  5. Nick Volynkin (NickVolynkin)
    changed the title [-]Feature request: enable automatic OIDC integration for creaetd kubernetes cluster[/-] [+]Enable automatic OIDC integration for created kubernetes cluster[/+] on Apr 3, 2025

  6. dosubot commented on Oct 19, 2025

    @dosubot
    dosubotbot
    on Oct 19, 2025 – with DosuBot

    Hi, c42-konstantin. I'm Dosu, and I'm helping the cozystack team manage their backlog and am marking this issue as stale.

    Issue Summary:

    • You proposed adding an optional parameter for automatic OIDC integration during Kubernetes cluster creation to enable seamless SSO.
    • The maintainer, kvaps, responded positively and is considering the implementation.
    • Implementation would require adding extra --oidc-* options to the KamajiControlPlane resource.
    • Relevant code references were shared to guide the potential development.
    • The issue remains unresolved with no recent updates.

    Next Steps:

    • Please let me know if this feature is still relevant to the latest version of the cozystack repository by commenting on this issue.
    • If I do not hear back within 7 days, the issue will be automatically closed.

    Thank you for your understanding and contribution!

  7. dosubot
    added
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    on Oct 19, 2025

  8. kvaps commented on Oct 20, 2025

    @kvaps
    Andrei Kvapil (kvaps)
    on Oct 20, 2025
    Member

    This is still on a row

  9. Andrei Kvapil (kvaps)
    added
    lifecycle/frozenIndicates that an issue or PR should not be auto-closed due to staleness
    on Oct 20, 2025
  10. dosubot
    removed
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    on Oct 20, 2025
  11. github-actions
    added
    triage/needs-triageIndicates an issue needs triage by a maintainer
    on Aug 12, 2026
  12. Aleksei Sviridkin (lexfrei)
    added
    area/kubernetesIssues or PRs related to the tenant Kubernetes app
    area/keycloakIssues or PRs related to Keycloak (SSO / identity)
    triage/not-reproducibleIndicates an issue can not be reproduced as described
    and removed
    triage/needs-triageIndicates an issue needs triage by a maintainer
    on Sep 23, 2026

  13. lexfrei commented on Sep 23, 2026

    @lexfrei
    Aleksei Sviridkin (lexfrei)
    on Sep 23, 2026
    Contributor

    Landed in #3044: the Kubernetes app has spec.oidc.mode (System or CustomConfig) and spec.oidc.users. The guide is docs/oidc-tenant.md.

  14. Aleksei Sviridkin (lexfrei)
    closed this as completedon Sep 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/keycloakIssues or PRs related to Keycloak (SSO / identity)area/kubernetesIssues or PRs related to the tenant Kubernetes appkind/featureCategorizes issue or PR as related to a new featurelifecycle/frozenIndicates that an issue or PR should not be auto-closed due to stalenesstriage/not-reproducibleIndicates an issue can not be reproduced as described

    Type

    Feature

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions