Kubernetes OIDC Authentication Mechanism Enforces Authentication on OIDC Provider Endpoints

Oct 13, 2025 by wbrum.org 136 views

What Happened?

Kubernetes OIDC Authentication Mechanism Enforces Authentication on OIDC Provider Endpoints

Kubernetes' OIDC authentication mechanism enforces authentication when querying the OIDC provider's /.well-known/openid-configuration and JWKS (/keys) endpoints. This behavior contradicts the OIDC specification, which states that these endpoints must be publicly accessible. The OIDC specification emphasizes the importance of making these endpoints publicly accessible to ensure seamless OIDC token validation and authentication flows.

Primary Issue: Enforced Authentication on OIDC Endpoints

The primary issue is that many services supporting resource server authentication (such as RabbitMQ and OpenSearch) rely on OIDC token validation but fail to work with Kubernetes OIDC due to the enforced authentication on these endpoints. These services expect to fetch the discovery and public keys without authentication, as per the OIDC spec, but Kubernetes' behavior prevents this, breaking compatibility with standard OIDC validation flows.

What Did You Expect to Happen?

Kubernetes Should Allow Unauthenticated Access to OIDC Endpoints

Kubernetes should allow unauthenticated access to these endpoints, as OIDC-compliant providers may not require authentication for retrieving discovery (/.well-known/openid-configuration) and signing keys (/keys). This behavior aligns with the OIDC specification, ensuring seamless OIDC token validation and authentication flows.

How Can We Reproduce It (As Minimally and Precisely as Possible)?

Reproducing the Issue with OIDC Endpoints

To reproduce the issue, follow these steps:

**GET https://api.k8s.example:6443/.well-known/openid-configuration**: Attempt to fetch the OIDC provider's discovery endpoint without authentication.
Expected Result: The OIDC provider should return the discovery endpoint configuration without requiring authentication.
Actual Result: Kubernetes enforces authentication, preventing unauthenticated access to the discovery endpoint.

Anything Else We Need to Know?

No Response

Kubernetes Version

Kubernetes Version Information

The following is the Kubernetes version information:

$ kubectl version
Client Version: v1.30.0
Server Version: v1.30.1

Cloud Provider

Cloud Provider Information

The cloud provider is:

On Premies

OS Version

OS Version Information

The OS version information is:

# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here

Install Tools

No Response

Container Runtime (CRI) and Version (If Applicable)

No Response

Related Plugins (CNI, CSI, ...) and Versions (If Applicable)

No Response

Conclusion

Kubernetes OIDC requires authentication for well-known and JWKS endpoints, contrary to the OIDC specification. This behavior prevents seamless OIDC token validation and authentication flows, breaking compatibility with standard OIDC validation flows. To resolve this issue, Kubernetes should allow unauthenticated access to these endpoints, as OIDC-compliant providers may not require authentication for retrieving discovery and signing keys.

Recommendations

To resolve this issue, follow these recommendations:

Update Kubernetes to the latest version: Ensure that Kubernetes is updated to the latest version, which may address this issue.
Configure OIDC authentication: Configure OIDC authentication to allow unauthenticated access to the discovery and signing key endpoints.
Use a different OIDC provider: Consider using a different OIDC provider that aligns with the OIDC specification and allows unauthenticated access to the discovery and signing key endpoints.

Q: What is the issue with Kubernetes OIDC authentication mechanism?

A: The issue is that Kubernetes OIDC authentication mechanism enforces authentication when querying the OIDC provider's /.well-known/openid-configuration and JWKS (/keys) endpoints, which contradicts the OIDC specification.

Q: Why is this behavior a problem?

A: This behavior prevents seamless OIDC token validation and authentication flows, breaking compatibility with standard OIDC validation flows. Many services supporting resource server authentication (such as RabbitMQ and OpenSearch) rely on OIDC token validation but fail to work with Kubernetes OIDC due to the enforced authentication on these endpoints.

Q: What is the expected behavior according to the OIDC specification?

A: According to the OIDC specification, the /.well-known/openid-configuration and JWKS (/keys) endpoints must be publicly accessible, allowing unauthenticated access to these endpoints.

Q: How can we reproduce the issue?

A: To reproduce the issue, follow these steps:

**GET https://api.k8s.example:6443/.well-known/openid-configuration**: Attempt to fetch the OIDC provider's discovery endpoint without authentication.
Expected Result: The OIDC provider should return the discovery endpoint configuration without requiring authentication.
Actual Result: Kubernetes enforces authentication, preventing unauthenticated access to the discovery endpoint.

Q: What are the implications of this issue?

A: The implications of this issue are that many services supporting resource server authentication may not work with Kubernetes OIDC due to the enforced authentication on these endpoints. This can lead to compatibility issues and prevent seamless OIDC token validation and authentication flows.

Q: How can we resolve this issue?

A: To resolve this issue, follow these recommendations:

Update Kubernetes to the latest version: Ensure that Kubernetes is updated to the latest version, which may address this issue.
Configure OIDC authentication: Configure OIDC authentication to allow unauthenticated access to the discovery and signing key endpoints.
Use a different OIDC provider: Consider using a different OIDC provider that aligns with the OIDC specification and allows unauthenticated access to the discovery and signing key endpoints.

Q: What are the benefits of resolving this issue?

A: Resolving this issue will ensure seamless OIDC token validation and authentication flows, allowing services supporting resource server authentication to work with Kubernetes OIDC without compatibility issues.

Q: How can we ensure that our OIDC provider is OIDC-compliant?

A: To ensure that your OIDC provider is OIDC-compliant, follow these best practices:

Implement OIDC specification: Implement the OIDC specification, including the /.well-known/openid-configuration and JWKS (/keys) endpoints.
Allow unauthenticated access: Allow unauthenticated access to the discovery and signing key endpoints.
Test OIDC compliance: Test OIDC compliance to ensure that your OIDC provider aligns with the OIDC specification.

Q: What are the consequences of not resolving this issue?

A: The consequences of not resolving this issue are that many services supporting resource server authentication may not work with Kubernetes OIDC, leading to compatibility issues and preventing seamless OIDC token validation and authentication flows.

Q: How can we prevent similar issues in the future?

A: To prevent similar issues in the future, follow these best practices:

Stay up-to-date with OIDC specification: Stay up-to-date with the OIDC specification and its changes.
Implement OIDC specification: Implement the OIDC specification, including the /.well-known/openid-configuration and JWKS (/keys) endpoints.
Test OIDC compliance: Test OIDC compliance to ensure that your OIDC provider aligns with the OIDC specification.

By following these best practices and recommendations, you can resolve the issue and ensure seamless OIDC token validation and authentication flows.