5 parts — deep technical series.
Many enterprises struggle to implement Kubernetes SSO.
This series is about implementing SSO for kubernetes with vault. Obtain short-lived Kubernetes ServiceAccount tokens for any number of clusters through Vault’s OIDC auth method and Kubernetes secrets engines. Manage Enterprise users in Keycloak or Anyother OIDC provider like Google/Azure Entra ID. Use kubectl plugin to wire these all.
Let's begin by launching a Vault development server and exploring the core building blocks you'll use throughout this series: authentication methods, secrets engines, paths, and policies. Everything is kept deliberately simple so you can clearly see how these pieces fit together — before you swap in OIDC from Keycloak and the Kubernetes secrets engine in later parts.
Read Part 1 →In Part 1 you explored auth methods, secrets engines, and policies with a local dev server. Now you will build the actual lab environment on an AWS EC2 instance: Keycloak for identity, a Vault server reachable from your laptop, and two separate kind clusters. Everything you do here sets the stage for replacing the demo auth and KV engine with...
Read Part 2 →In Part 2 you provisioned the lab on EC2: Keycloak on 8080, Vault listening on all interfaces at 8200, and two kind clusters. Now you will configure identity in Keycloak and enable the two building blocks in Vault (OIDC auth and the Kubernetes secrets engines) that will later let a human obtain short-lived tokens for either cluster.
Read Part 3 →In Part 3 we enabled the OIDC auth method and the two Kubernetes secrets engines, but they were not yet connected to anything real. In this post we wire everything together using only the EC2 public DNS name for external references. We configure Vault OIDC to trust Keycloak, we tell the k8s engines how to reach the kind clusters, we...
Read Part 4 →In Part 4 you ran vault login -method=oidc role=human, then copied service_account_token from vault write k8s-*/creds/… into kubectl --token …. This final post removes that copy step with a small kubectl credential plugin. It picks the target cluster from your context, reuses a valid Vault token when possible, opens the Keycloak browser login only when needed, mints a short-lived SA...
Read Part 5 →