Kubernetes

Let your engineers sign in to Kubernetes clusters with their Fob account, and grant cluster access by Fob group. kubectl signs users in through the browser with the kubelogin plugin.

Permission

Needs Manage apps.

1. Add an app for the cluster

1. Open Apps > Apps, choose Add app, and choose Desktop or mobile app. Name it after the cluster, such as prod-eu.
2. Under Redirect addresses, enter http://localhost:8000.
3. On the app's Assignments tab, assign the groups that should reach the cluster, such as Platform, and remove Everyone. See Assignments.
4. Copy the app's client ID.

2. Configure the API server

Give the API server, or your managed cluster's OIDC settings, your organization's URL and the app's client ID:

--oidc-issuer-url=https://acme.fobauth.com
--oidc-client-id=<client ID>
--oidc-username-claim=email
--oidc-groups-claim=groups

3. Grant access with RBAC

Bind roles to Fob group names or user emails. For example, to make Platform cluster admins:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: fob-platform-admins
subjects:
  - kind: Group
    name: Platform
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

4. Set up kubectl

On each engineer's computer, install kubelogin and add a user to the kubeconfig:

users:
  - name: fob
    user:
      exec:
        apiVersion: client.authentication.k8s.io/v1
        command: kubectl
        args:
          - oidc-login
          - get-token
          - --oidc-issuer-url=https://acme.fobauth.com
          - --oidc-client-id=<client ID>
          - --oidc-extra-scope=email
          - --oidc-extra-scope=groups

5. Test it

kubectl --user=fob auth whoami

Your browser opens Fob's sign-in page. After you sign in, kubectl prints your email and your Fob groups.

The app's sign-on policy applies, so you can require a passkey or the office network for the cluster like any other app.