---
title: Using Cognito for OIDC Integration with MicroK8s
tags: ["Kubernetes", "MicroK8s", "OIDC", "Cognito"]
categories: ["Dev", "CaaS", "Kubernetes", "MicroK8s"]
date: 2025-02-10T04:26:17Z
updated: 2025-02-10T04:28:43Z
---

> ⚠️ This article was automatically translated by OpenAI (gpt-4o-mini).
> It may be edited eventually, but please be aware that it may contain incorrect information at this time.

Using Cognito for [OIDC integration](https://microk8s.io/docs/oidc-dex) with MicroK8s.

Refer to [here](/entries/782) for the installation of MicroK8s.

Assuming that the Cognito User Pool has already been created, create a client.

Click on "Create app client".

<img width="1787" alt="image" src="https://github.com/user-attachments/assets/2e89ec2e-c70c-4409-8255-985f5468180a" />

Set "Application Type" to "Traditional web application" and enter `microk8s` in "Name your application". Set `http://localhost:8000` (the callback URL for [kubelogin](https://github.com/int128/kubelogin)) in "Return URL" and click the "Create app client" button.
(The screenshot shows `http://localhost:18000`, but it should be `http://localhost:8000`.)
<img width="1792" alt="image" src="https://github.com/user-attachments/assets/4d389998-cf4e-4246-b24f-75427a427c65" />

Although not mandatory, it is safer to add `http://localhost:18000` as a fallback port in case the local `8000` port is already in use.

<img width="1428" alt="image" src="https://github.com/user-attachments/assets/ca1289f4-0bb6-4feb-9f15-ed2662cab1c7" />

Copy the "Client ID" and "Client secret" from the "App client information" panel.

<img width="1431" alt="image" src="https://github.com/user-attachments/assets/038b5323-588c-41c4-a5dd-8e314b650879" />

Copy the path up to `/.well-known/jwks.json` from the "Token signing key URL" in the User Pool's "Overview" panel.

<img width="1791" alt="image" src="https://github.com/user-attachments/assets/a970650d-798d-432f-aded-be050b5e71e4" />

Log in to the server where the MicroK8s Controlplane is installed and modify `/var/snap/microk8s/current/args/kube-apiserver`.

Adjust the variables according to your environment and execute the following command.

```
OIDC_ISSUER_URL=https://cognito-idp.ap-northeast-1.amazonaws.com/ap-northeast-1_tv3NHZAKO
OIDC_CLIENT_ID=3ftgo86lgdb2mb0fr0jho761q9
OIDC_USERNAME_CLAIM=email
OIDC_GROUPS_CLAIM=cognito:groups

cat <<EOF | sudo tee -a /var/snap/microk8s/current/args/kube-apiserver
--oidc-issuer-url=${OIDC_ISSUER_URL}
--oidc-client-id=${OIDC_CLIENT_ID}
--oidc-username-claim=${OIDC_USERNAME_CLAIM}
--oidc-username-prefix=oidc:
--oidc-groups-claim=${OIDC_GROUPS_CLAIM}
--oidc-groups-prefix=oidc:
EOF
```

Restart MicroK8s.

```
sudo snap restart microk8s
```

Assume that the group for the admin users belonging to the Cognito users is `platform-engineer`. Execute the following command to assign the `cluster-admin` ClusterRole to this group.

```
kubectl create clusterrolebinding cluster-admin-platform-engineer --clusterrole=cluster-admin --group=oidc:platform-engineer
```

Install kubelogin from https://github.com/int128/kubelogin#getting-started and add the `cognito` user to the current `kubectl` context with the following command.

```
OIDC_ISSUER_URL=https://cognito-idp.ap-northeast-1.amazonaws.com/ap-northeast-1_tv3NHZAKO
OIDC_CLIENT_ID=3ftgo86lgdb2mb0fr0jho761q9
OIDC_CLIENT_SECRET=********

kubectl config set-credentials cognito \
  --exec-api-version=client.authentication.k8s.io/v1beta1 \
  --exec-command=kubectl \
  --exec-arg=oidc-login \
  --exec-arg=get-token \
  --exec-arg=--oidc-issuer-url=${OIDC_ISSUER_URL} \
  --exec-arg=--oidc-client-id=${OIDC_CLIENT_ID} \
  --exec-arg=--oidc-client-secret=${OIDC_CLIENT_SECRET}
 
kubectl config set-context --current --user=cognito
```

Execute the following command.
```
kubectl auth whoami
```

The Cognito login screen will appear, so log in.

<img width="1912" alt="image" src="https://github.com/user-attachments/assets/f21bf2db-4cd5-4d52-93d9-af0f27f233c8" />

Upon successful login,

<img width="1912" alt="image" src="https://github.com/user-attachments/assets/8762f74d-eb70-4e44-8457-9312f5637f9a" />

the Username and Groups will be mapped as follows.

```
$ kubectl auth whoami
ATTRIBUTE   VALUE
Username    oidc:makingx@gmail.com
Groups      [oidc:platform-engineer system:authenticated]
```