Talos API: Support OIDC

[flokli]

Feature Request

On a fresh install, talosconfig contains a 10 year valid certificate, signed by the CA from machine.ca.crt.

While it's possible to create a shorter-living and more restricted talosconfig, by picking a shorter --crt-ttl and a more restricted role via --roles:

❯ talosctl config new

Usage:
  talosctl config new [<path>] [flags]

Flags:
      --crt-ttl duration   certificate TTL (default 87600h0m0s)
  -h, --help               help for new
      --roles strings      roles (default [os:admin])

Global Flags:
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file

… there's no OIDC support in Talos API.

[smira]

As Talos API is really low-level, and e.g. networking might be restricted (blocking OIDC requests), what we considered as an option: having external system handle OIDC and issue client certs. Also we could add additional certs to the machine configuration so that Talos will accept client certs issued by extra CAs (which might live in the external PKI system)

[flokli]

The idea would be a similar support as kube-apiserver - if enabled, the Talos API itself only periodically fetches JWKS.

Users can keep using client certs for auth, or if they present a valid JWT, only the things in the tokens are considered (so assuming fat tokens, no profile lookup by the apiserver)

[Ulexus]

I'm in the process of designing exactly this. However, as Andrey says, it's going to take a number of changes in the way we handle authentication. It's definitely something we want to support, but it will take some time.

[Ulexus]

See rfcs/8

[flokli]

Seems to be a dup of #3306 ?

[github-actions]

This issue is stale because it has been open 180 days with no activity. Remove stale label or comment or this will be closed in 7 days.

[github-actions]

This issue was closed because it has been stalled for 7 days with no activity.