Fixing Headlamp OIDC login with Tailscale and tsidp
AI Summary
This article details how to configure the Headlamp Kubernetes dashboard to use Tailscale's tsidp as an OIDC identity provider. It explains the five trust relationships required for authentication, focusing on configuring the Kubernetes API server to trust the OIDC issuer and map claims to RBAC permissions.
Key Takeaways
- Headlamp handles the front-end login, but the Kubernetes API server must be configured to validate tokens from the OIDC issuer.
- Five trust relationships must be established between the browser, Headlamp, tsidp, and the Kubernetes API server.
- Kubernetes RBAC can then map token claims, such as email and tags, into subjects and roles like cluster-admin.
Why it matters
Using a unified identity provider like Tailscale for both cluster access and dashboard authentication eliminates the need for managing separate kubeconfigs, service accounts, or static tokens, streamlining secure access to Kubernetes environments.
Conversation 0
Be the first to share your perspective.