· updated · Permalink
Slowly patching all of the OAuth2/OpenID Connect clients in my k8s cluster to use RFC7523 JWT Bearer client auth with a projected service account token for auth as part of my mission to eliminate all long lived bearer secrets ( ˘ω˘ )
Comments
On the negative hand, they are still bearer tokens. On the positive hand, they're valid in exactly one place and valid for 10 minutes and you can actively check their validity with the Kubernetes API Server
@erincandescent hell yeah, we love to see it!
Getting rid of long-lived secrets is the right goal. We still hand out static API keys to partners far too often in payments, and rotating them is always the part that hurts.
For the cases I can't avoid I want to at least do DPoP or some other key binding. But generally I hate secrets