OIDC Authentication in Chaos-Mesh Dashboard
Author: jzangariCreated Aug 4, 2023Updated Aug 14, 2026
Labelstype/enhancement
Feature Request
Describe the feature you'd like:
Kubernetes supports native OIDC authentication when configured correctly. Chaos Mesh should be able to support OIDC authentication using the id_token similar to how it uses the current RBAC token. I have actually already confirmed this by putting an id_token with the correct group and RoleBinding / ClusterRoleBinding configured into the Chaos Mesh Dashboard.
Functionality Required to use OIDC:
- OIDC Configuration for Provider URL, Client ID, and Redirect URL
- Redirect Handling Logic to exchange an auth code for
id_tokenandrefresh_token- There may be React Libraries for this.
- Logic to detect 'id_token' expiration and refresh before retry.
- Documentation for generating the required combinations of:
RoleandRoleBindingwith associated OIDC GroupClusterRoleandClusterRoleBindingwith associated OIDC Group
Most of the work should be accomplishable from the frontend.
Describe alternatives you've considered:
- Caddy or some other reverse proxy solution for access to Chaos Mesh Dashboard after disabling the RBAC auth.
- Automation for generating tokens and the management of roles and role bindings
Source: chaos-mesh/chaos-mesh