OAuth clients on Kubernetes, in detail.
How Nauthera's operator, admission rules, secret delivery and tenants work, each checked against the server's code when it was published. Every manifest applies against the resource definitions, and every claim about the product links the docs page that states it.
Atom feedMichael Beutler
Why we built a Kubernetes operator for OAuth clients
An app's OAuth client changes with the app, so it belongs in the app's manifests. What we wanted from an OIDCClient resource, and what it costs.
Read the articleMichael Beutler
What a Kubernetes operator can do that Terraform cannot
Managing OAuth clients with a reconciling operator or with Terraform: drift, secrets in state, who holds the admin credential, and where Terraform wins.
Read the articleMichael Beutler
Designing multi-tenant OIDC issuers for Kubernetes
Why each Nauthera organization is its own OIDC issuer with its own keys, and how namespaces decide which tenant a Kubernetes resource configures.
Read the articleMichael Beutler
Delivering OIDC client secrets without storing them in Git
How spec.secret.generate works: the server mints the secret, the operator writes it into a Secret with its fingerprint, and deleting it rotates.
Read the articleMichael Beutler
Refusing unsafe OAuth client configurations at admission time
The nine CEL rules on Nauthera's OIDCClient definition, what each refuses at kubectl apply, and what only the server can refuse after it.
Read the article
Hear when the operator ships
One email when the operator ships. No newsletter.
By joining, you agree to our Privacy Policy and Terms.