https://johanneskueber.com/tags/oidc/Recent content in Oidc on johanneskueber.comHugoen_USSun, 23 Aug 2026 10:00:00 +0200https://johanneskueber.com/posts/2026-08-23-oidc-kubernetes-talos/Sun, 23 Aug 2026 10:00:00 +0200https://johanneskueber.com/posts/2026-08-23-oidc-kubernetes-talos/<p>Every kubeconfig for my clusters used to be the same thing: a client certificate for <code>system:masters</code>, generated by <code>talosctl kubeconfig</code>, valid for a year. That certificate is effectively root on the cluster. It has no name attached to it, it cannot be revoked without rotating the cluster CA, and it ends up on every device I want to administrate from. Once I copied it to my phone I knew this was the wrong path. And since I already run a <a href="https://www.keycloak.org/">Keycloak</a> for every other application in my homelab, I wantedto simply log in with the same SSO account as everything else.</p>