Dex Federated OIDC Provider Guide

Without Dex:
  User → Service Account token → kubectl (shared credentials, no audit)

With Dex:
  User → GitHub login → Dex → OIDC token → kubectl (personal identity, audited)

helm install dex dex/dex \
  --namespace auth --create-namespace \
  --values dex-values.yaml

# dex-values.yaml
config:
  issuer: https://dex.myorg.com
  
  storage:
    type: kubernetes
    config:
      inCluster: true
  
  connectors:
    - type: github
      id: github
      name: GitHub
      config:
        clientID: $GITHUB_CLIENT_ID
        clientSecret: $GITHUB_CLIENT_SECRET
        redirectURI: https://dex.myorg.com/callback
        orgs:
          - name: myorg
  
  staticClients:
    - id: kubernetes
      name: Kubernetes
      secret: kubernetes-client-secret
      redirectURIs:
        - http://localhost:8000
        - http://localhost:18000

  oauth2:
    skipApprovalScreen: true

# kube-apiserver flags
--oidc-issuer-url=https://dex.myorg.com
--oidc-client-id=kubernetes
--oidc-username-claim=email
--oidc-groups-claim=groups

# Install kubelogin
brew install int128/kubelogin/kubelogin

# Configure kubectl
kubectl config set-credentials oidc \
  --exec-api-version=client.authentication.k8s.io/v1beta1 \
  --exec-command=kubectl \
  --exec-arg=oidc-login \
  --exec-arg=get-token \
  --exec-arg=--oidc-issuer-url=https://dex.myorg.com \
  --exec-arg=--oidc-client-id=kubernetes \
  --exec-arg=--oidc-client-secret=kubernetes-client-secret

kubectl get pods
# Browser opens → GitHub login → OIDC token returned → kubectl works

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: myorg-admins
subjects:
  - kind: Group
    name: "myorg:platform-team"  # GitHub team
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: developers
  namespace: staging
subjects:
  - kind: Group
    name: "myorg:developers"  # GitHub team
roleRef:
  kind: ClusterRole
  name: edit
  apiGroup: rbac.authorization.k8s.io

connectors:
  # GitHub for developers
  - type: github
    id: github
    name: GitHub
    config:
      clientID: $GITHUB_CLIENT_ID
      clientSecret: $GITHUB_CLIENT_SECRET
      orgs:
        - name: myorg

  # LDAP for corporate users
  - type: ldap
    id: ldap
    name: Corporate LDAP
    config:
      host: ldap.myorg.com:636
      rootCA: /etc/dex/ldap-ca.pem
      bindDN: cn=dex,ou=service,dc=myorg,dc=com
      bindPW: $LDAP_BIND_PW
      userSearch:
        baseDN: ou=users,dc=myorg,dc=com
        filter: "(objectClass=person)"
        username: uid
        emailAttr: mail
      groupSearch:
        baseDN: ou=groups,dc=myorg,dc=com
        filter: "(objectClass=groupOfNames)"
        userMatchers:
          - userAttr: DN
            groupAttr: member
        nameAttr: cn

  # Google Workspace
  - type: google
    id: google
    name: Google
    config:
      clientID: $GOOGLE_CLIENT_ID
      clientSecret: $GOOGLE_CLIENT_SECRET
      redirectURI: https://dex.myorg.com/callback

staticClients:
  - id: kubernetes
    name: Kubernetes
    secret: k8s-secret
    redirectURIs: ["http://localhost:8000"]
  
  - id: argocd
    name: Argo CD
    secret: argocd-secret
    redirectURIs: ["https://argocd.myorg.com/auth/callback"]
  
  - id: grafana
    name: Grafana
    secret: grafana-secret
    redirectURIs: ["https://grafana.myorg.com/login/generic_oauth"]
  
  - id: harbor
    name: Harbor
    secret: harbor-secret
    redirectURIs: ["https://registry.myorg.com/c/oidc/callback"]