Pinniped k8s auth provider

[waldirmontoya25]

Feature suggestion

We are researching if a Pinniped k8s auth provider would be of interest to the Backstage community

Context

Pinniped is a great solution to federate access to multiple k8s clusters; it brings additional security benefits like short-lived tokens associated with user identity and short-lived TLS certificates for mutual TLS.

Recently a Dynamic OAuth Client is being added to Pinniped and could be leveraged by the k8s plugin.

cc @jamieklassen

[jhaals]

ping @mclarke47 :)

[mclarke47]

Don't see a reason why not

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[benjdlambert]

@waldirmontoya25 is this something that you want to contribute? 🙏

[waldirmontoya25]

@benjdlambert yeah this is something we are working on.

[benjdlambert]

Nice! will just assign you to it so we can keep track 🙏

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[voor]

Activity to remove stale, this is still very much desired

[benjdlambert]

@waldirmontoya25 do you have any updates on this? 🙏

[waldirmontoya25]

Hi @benjdlambert Yeah, sorry about the delay shipping this. @RubenV-dev is already on top of it.

[benjdlambert]

Nice! No worries! thanks for the update!

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[jamieklassen]

This issue is active, just not in a way that the stalebot respects:

• 🚀 Feature: integrators bring their own kubernetes auth providers #19530 is probably going to be an important part of this for configurations which use a WebhookAuthenticator
• @RubenV-dev is indeed still working on a regular auth provider for getting cluster-scoped ID tokens from a Pinniped Supervisor to support configurations which use a JWTAuthenticator keyed to the supervisor