lambda-k8s-oidc-keys

🔑 Lambda K8s OIDC Keys

This directory contains an AWS Lambda function that generates and publishes OpenID Connect (OIDC) keys for Kubernetes clusters.

The Lambda function performs the following operations:

• Retrieves a Kubernetes service account private key from AWS Secrets Manager
• Generates the corresponding public key
• Creates OIDC-compliant JSON Web Keys (JWKs) from the public key
• Uploads these keys to an S3 bucket for OIDC discovery

🔧 Configuration

The function requires the following environment variables:

• SECRET_NAME - Name of the AWS Secrets Manager secret containing the Kubernetes service account private key
• BUCKET_NAME - Name of the S3 bucket where the OIDC keys will be uploaded
• OBJECT_KEY - Object key (path) within the S3 bucket where the OIDC keys will be stored

The AWS Secrets Manager secret is expected to contain a JSON document with the following structure:

{
  "certs": {
    "k8s_serviceaccount": {
      "key": "<base64-encoded-private-key>"
    }
  }
}

🔗 Related Resources

• AWS Lambda with Go
• Kubernetes OIDC Configuration
• AWS IAM OIDC Provider

💡 Sources

For original licences and attributions, see NOTICE.