Pinniped: A Unified Framework for User Authentication to Kubernetes Cluster
summary
Pinniped provides a Kubernetes-native authentication stack that installs with kubectl apply and runs two core components, the pinniped supervisor (TLS ingress + cert-manager + DNS + LB) and the pinniped concierge on each cluster. It uses OIDC/AD via Kubernetes custom resources (an ActiveDirectory CR with bind creds), issues cluster-scoped audiences, caches credentials for SSO across clusters in a federation domain, and claims runtime add/remove of IDPs; demoed GKE setup works end-to-end and is Apache-2.0 open source.
AI-written summary · about
chapters (3)
related talks
43mSharing is NOT Caring: Stop Sharing Your Kubernetes Cluster Credentials
01h 59mBuilding Secure Kubernetes Clusters with Identity Management
33mPortable, Universal Single Sign-On for Your Clusters
41mKubernetes Auth and Access Control
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
26mFine-Grained User Authorization for Kubernetes with OPA and LDAP
31mConnecting Dots: Unified Hybrid Multi-Cluster Auth Experience With SPIFFE and Cluster Inventory API
24mOne stop talk for kubernetes security !!