Trust an AWS EKS issued token and reissue DEX token

[marianobilli]

I have an AWS EKS cluster and an JWT token issued by the EKS OIDC IDP, is it possible to have DEX trust that ticket and reissue his own?

Same question if my upstream IDP would be Azure AD.

Example of the ticket issued by the EKS OIDC IDP.

{
  "aud": [
    "sts.amazonaws.com"
  ],
  "exp": 1688048818,
  "iat": 1687962418,
  "iss": "https://oidc.eks.eu-west-1.amazonaws.com/id/D68CA188311524742239F478DE97DE57",
  "kubernetes.io": {
    "namespace": "jenkins-devops",
    "pod": {
      "name": "ds-projects-automations-projects-creation-4343-0qzxr-q4dd-jcnsf",
      "uid": "0b3d6d6e-57a8-4cde-afe9-edcf32d83d7b"
    },
    "serviceaccount": {
      "name": "projects-creation",
      "uid": "7d0d2822-2504-4b6d-adfc-125ed9f90177"
    }
  },
  "nbf": 1687962418,
  "sub": "system:serviceaccount:jenkins-devops:projects-creation"
}

Thanks.

[nabokihms]

Hello, @marianobilli.
It is not possible right now, but the feature is in development
#2806

[marianobilli]

Thanks for the info!