{"id":49895,"date":"2025-07-01T01:54:44","date_gmt":"2025-07-01T01:54:44","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=49895"},"modified":"2025-07-01T01:54:44","modified_gmt":"2025-07-01T01:54:44","slug":"what-is-oidc-identity-provider","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/what-is-oidc-identity-provider\/","title":{"rendered":"What is OIDC identity provider?"},"content":{"rendered":"\n

Great question! Here\u2019s a clear, non-technical explanation and then a technical one for OIDC identity provider<\/strong>, especially in the context of Kubernetes and AWS.<\/p>\n\n\n\n

\n\n\n\n

In Simple Words:<\/strong><\/h2>\n\n\n\n

OIDC<\/strong> stands for OpenID Connect<\/strong>.
An OIDC identity provider<\/strong> is like a trusted gatekeeper that verifies \u201cwho you are\u201d on the internet or within an organization.<\/p>\n\n\n\n

    \n
  • If you\u2019ve ever logged into a website using Google, Facebook, or Apple<\/strong>, you used an OIDC identity provider.<\/li>\n\n\n\n
  • In Kubernetes and AWS, the OIDC identity provider lets AWS \u201ctrust\u201d that a Kubernetes pod is really who it says it is.<\/li>\n<\/ul>\n\n\n\n
    \n\n\n\n

    In the Context of AWS EKS and Kubernetes:<\/strong><\/h2>\n\n\n\n
      \n
    • Every EKS cluster can have an OIDC provider URL<\/strong> (something like https:\/\/oidc.eks.us-west-2.amazonaws.com\/id\/EXAMPLED539D4633E53DE1B71EXAMPLE<\/code>).<\/li>\n\n\n\n
    • AWS uses this OIDC provider to verify which Kubernetes service account<\/strong> (and thus which pod) is asking for permissions.<\/li>\n\n\n\n
    • This enables IAM Roles for Service Accounts (IRSA)<\/strong>\u2014so specific pods can get their own AWS permissions, safely and securely.<\/li>\n<\/ul>\n\n\n\n

      Analogy:<\/strong>
      Imagine you\u2019re at a club. The bouncer (AWS) will only let you in (give you permissions) if your ID badge (from OIDC provider) matches what\u2019s on their approved list (IAM role trust policy).<\/p>\n\n\n\n

      \n\n\n\n

      In Technical Terms:<\/strong><\/h2>\n\n\n\n
        \n
      • OIDC (OpenID Connect)<\/strong> is an identity layer built on top of OAuth 2.0, an open standard for authentication.<\/li>\n\n\n\n
      • An OIDC identity provider<\/strong> is a service that can:\n
          \n
        • Issue identity tokens<\/strong> (JWTs) after authenticating a user or system.<\/li>\n\n\n\n
        • Sign these tokens<\/strong> so other systems (like AWS) can trust them.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
        • In AWS EKS, the OIDC provider<\/strong> is set up for your cluster, and AWS recognizes the tokens your Kubernetes cluster issues to service accounts.<\/li>\n<\/ul>\n\n\n\n
          \n\n\n\n

          Why is this important?<\/strong><\/h2>\n\n\n\n
            \n
          • Secure authentication:<\/strong> Lets AWS know exactly which K8s pod\/service account is making a request.<\/li>\n\n\n\n
          • Fine-grained permissions:<\/strong> Only the pod with the right service account and OIDC-issued token gets the IAM role.<\/li>\n<\/ul>\n\n\n\n
            \n\n\n\n

            In Summary:<\/strong><\/h2>\n\n\n\n
              \n
            • OIDC identity provider<\/strong> = a system that can vouch for identities in a secure, trusted way.<\/li>\n\n\n\n
            • In EKS, it\u2019s the bridge between AWS IAM and Kubernetes service accounts for secure, pod-level permissions.<\/li>\n<\/ul>\n\n\n\n
              \n\n\n\n

              Here\u2019s how to check if your AWS EKS cluster has an OIDC identity provider set up, and how to set it up if it\u2019s missing<\/strong>.<\/p>\n\n\n\n

              \n\n\n\n

              A. How to Check If OIDC Provider Is Already Set Up for Your EKS Cluster<\/strong><\/h1>\n\n\n\n
                \n
              1. Get your EKS cluster name and region.<\/strong><\/li>\n\n\n\n
              2. List the OIDC provider for your cluster with the AWS CLI:<\/strong>aws eks describe-cluster --name <your-cluster-name> --region <region><\/code>\n
                  \n
                • Look for the identity<\/code> section in the output: \"identity\": { \"oidc\": { \"issuer\": \"https:\/\/oidc.eks.<region>.amazonaws.com\/id\/XXXXXXXXXXXXXXX\" } }<\/code><\/li>\n\n\n\n
                • If you see the issuer<\/code> URL, your EKS cluster has an OIDC provider endpoint.<\/strong><\/li>\n<\/ul>\n<\/li>\n\n\n\n
                • Check if the OIDC provider is associated with your AWS account:<\/strong>aws iam list-open-id-connect-providers<\/code>\n
                    \n
                  • Look for one that matches your EKS cluster\u2019s OIDC issuer<\/code> URL.<\/li>\n\n\n\n
                  • Optionally, verify in the AWS Console under IAM > Identity providers<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
                    \n\n\n\n

                    B. How to Set Up (Associate) an OIDC Provider for Your EKS Cluster<\/strong><\/h1>\n\n\n\n

                    If you do not<\/strong> see your OIDC provider listed, run:<\/p>\n\n\n

                    eksctl utils associate-iam-oidc-provider \\\n  --region <region<\/span>><\/span> \\\n  --cluster <your-cluster-name<\/span>><\/span> \\\n  --approve\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
                      \n
                    • This command checks if the provider exists and creates it if missing<\/strong>.<\/li>\n\n\n\n
                    • It associates your EKS cluster\u2019s OIDC issuer URL with your AWS account, enabling IAM Roles for Service Accounts (IRSA).<\/li>\n<\/ul>\n\n\n\n
                      \n\n\n\n
                      C. How to Check in the AWS Console<\/strong><\/h1>\n\n\n\n
                        \n
                      1. Go to IAM > Identity providers<\/strong> in the AWS Management Console.<\/li>\n\n\n\n
                      2. You should see an entry of Provider Type: OpenID Connect<\/strong> with the URL that matches your EKS cluster\u2019s OIDC issuer URL.<\/li>\n<\/ol>\n\n\n\n
                        \n\n\n\n
                        Summary Table<\/strong><\/h2>\n\n\n\n
                        Step<\/th>Command<\/th><\/tr><\/thead>
                        Check OIDC in EKS cluster<\/td>aws eks describe-cluster --name <name> --region <region><\/code><\/td><\/tr>
                        List OIDC providers (AWS)<\/td>aws iam list-open-id-connect-providers<\/code><\/td><\/tr>
                        Associate OIDC with cluster<\/td>eksctl utils associate-iam-oidc-provider ...<\/code><\/td><\/tr>
                        AWS Console<\/td>IAM > Identity Providers<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                        \n\n\n\n
                        <\/p>\n","protected":false},"excerpt":{"rendered":"
                        Great question! Here\u2019s a clear, non-technical explanation and then a technical one for OIDC identity provider, especially in the context of Kubernetes and AWS. In Simple Words: OIDC stands for… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-49895","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=49895"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49895\/revisions"}],"predecessor-version":[{"id":49896,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49895\/revisions\/49896"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=49895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=49895"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=49895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}