Exchanging third-party tokens in Dex and how it helps you to build a secure cloud native environment
summary
Dex adds a token exchange feature merged Nov 2023 and available Jan 2024 that validates any JWT via the OIDC discovery endpoint and issues Dex-native tokens. It runs as a 35 MB single binary, has ~9k stars, 1.6k forks and ~25 known adopters. Practical builds: CI/CD pipelines (GitLab token → Dex token → Kubernetes API), multicluster auth mesh (service account token → Dex token across clusters) and SPIFFE/SPIRE integration that replaces long-lived service accounts; the feature is implemented and demonstrably works.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker intro
- 1:05What is Dex and its history
- 3:36Why engineers love Dex
- 4:57Dex architecture overview
- 7:07What is token exchange
- 9:17How token exchange works in Dex
- 12:12Real-world use cases for token exchange
- 12:32CI/CD integration with token exchange
- 15:44Kubernetes authentication mesh
- 19:46SPIFFY tokens and Kubernetes access
- 22:00Summary and closing remarks
- 23:26Q&A session
related talks
01h 07mK8s and Active Directory Can Be Friends! How to Use Dex to Bridge the Gap
41mKubernetes Auth and Access Control
49mToken It Up A Notch: Elevating Payment Security
46mBearer of Good News
43mSharing is NOT Caring: Stop Sharing Your Kubernetes Cluster Credentials
34mThrow Away Your Passwords: Trusting Workload Identity
25mBridging the Gap Between Human and Workload Identity: SPIFFE Support in Keycloak
58mOAuth and the long way to Proof of Possession