Understanding OpenID Connect
OpenID Connect is a standard identity federation protocol. It’s built on the OAuth2 specification and has some very powerful features that make it the preferred choice to interact with Kubernetes clusters.
The main benefits of OpenID Connect are as follows:
- Short-lived tokens: If a token is leaked, such as via a log message or breach, you want the token to expire as quickly as possible. With OIDC, you’re able to specify tokens that can live for 1–2 minutes, which means the token will likely have expired by the time an attacker attempts to use it.
- User and group memberships: When we start discussing authorization in Chapter 7, RBAC Policies and Auditing, we’ll see immediately that it’s important to manage access by group instead of managing access by referencing users directly. OIDC tokens can embed both the user’s identifier and their groups, leading to easier access management.
- Refresh...
