buzzfeed sso

Heavily inspired by Buzzfeed’s example, this provides a way of protecting Kubernetes services that have no authentication layer globally from a single OAuth proxy.

Blogpost Quickstart guide SSO in Kubernetes with Google Auth Repo

Many of the Kubernetes OAuth solutions require to run an extra container within the pod using oauth2_proxy, but the project seems to not be maintained anymore. The approach used allows to have a global OAuth2 Proxy that can protect services even in different namespaces, thanks to Kube DNS.

We use this chart in production at MindDoc for protecting endpoints that have no built-in authentication (or that would require to run inner containers), like Kibana, Prometheus, etc…