{"id":28239698,"url":"https://github.com/miscord-dev/dexsidecar","last_synced_at":"2026-05-02T10:42:22.409Z","repository":{"id":267150274,"uuid":"900328048","full_name":"miscord-dev/dexsidecar","owner":"miscord-dev","description":"Issue access token via Dex Machine Authentication with Kubernetes SA tokens","archived":false,"fork":false,"pushed_at":"2024-12-30T09:54:58.000Z","size":20,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-05-19T02:13:01.184Z","etag":null,"topics":["kubernetes","oidc","sidecar"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/miscord-dev.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-08T13:55:10.000Z","updated_at":"2024-12-30T09:54:02.000Z","dependencies_parsed_at":"2024-12-29T14:20:46.286Z","dependency_job_id":null,"html_url":"https://github.com/miscord-dev/dexsidecar","commit_stats":null,"previous_names":["miscord-dev/dexsidecar"],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miscord-dev%2Fdexsidecar","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miscord-dev%2Fdexsidecar/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miscord-dev%2Fdexsidecar/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miscord-dev%2Fdexsidecar/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/miscord-dev","download_url":"https://codeload.github.com/miscord-dev/dexsidecar/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miscord-dev%2Fdexsidecar/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259255549,"owners_count":22829485,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["kubernetes","oidc","sidecar"],"created_at":"2025-05-19T02:13:00.646Z","updated_at":"2026-05-02T10:42:22.368Z","avatar_url":"https://github.com/miscord-dev.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Dex Sidecar for Kubernetes\n## What this does?\n* Issue access_token from dex using Kubernetes ServiceAccount token\n    * [Dex Machine Authentication](https://dexidp.io/docs/guides/token-exchange/)\n    * [ServiceAccount token volume projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection)\n* Why we don't set Kubernetes directly to the provider of clients?\n    * Some clients doesn't allow to specify multiple clients.\n    * Combine multiple connectors with Dex\n\n## Example\n* Example Dex config\n```yaml\n...\nconnectors:\n- type: oidc\n  id: k3s\n  name: k8s.tsuzu.dev\n  config:\n    issuer: https://k8s.tsuzu.dev:6443\n    clientID: dex\n    scopes:\n      - openid\n      - federated:id\n    userNameKey: sub\n    getUserInfo: false\n    issuerAlias: https://kubernetes.default.svc.cluster.local\n    insecureSkipVerify: true\noauth2:\n  skipApprovalScreen: true\n  grantTypes:\n    - \"authorization_code\"\n    - \"urn:ietf:params:oauth:grant-type:token-exchange\"\n    - \"urn:ietf:params:oauth:grant-type:device_code\"\nstaticClients:\n- id: incus\n  redirectURIs:\n    - 'https://incus.tsuzu.dev:8443/oidc/callback'\n    - '/device/callback'\n  name: 'Incus'\n  public: true\n```\n\n* Example Kubernetes manifest\n```yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: nginx\nspec:\n  selector:\n    matchLabels:\n      app: nginx\n  replicas: 1\n  template:\n    metadata:\n      labels:\n        app: nginx\n    spec:\n      initContainers:\n        - name: init-incus\n          image: ghcr.io/miscord-dev/dexsidecar@sha256:40fd19cc52734740277a805f4a56db5684965275f8dd7c996d4f2496150018e0\n          restartPolicy: Always\n          env:\n            - name: dex_access_token_file\n              value: /var/run/secrets/miscord.win/dex/token\n            - name: dex_endpoint\n              value: \"https://dex.tsuzu.dev/token\"\n            - name: dex_basic_auth\n              value: \"user:\"\n            - name: dex_connector_id\n              value: k3s\n            - name: dex_grant_type\n              value: urn:ietf:params:oauth:grant-type:token-exchange\n            - name: dex_scope\n              value: \"openid federated_id\"\n            - name: dex_requested_token_type\n              value: urn:ietf:params:oauth:token-type:access_token\n            - name: dex_file_subject_token\n              value: /var/run/secrets/kubernetes.io/dex/token\n            - name: dex_subject_token_type\n              value: urn:ietf:params:oauth:token-type:id_token\n          volumeMounts:\n            - name: incus-api-key\n              mountPath: /var/run/secrets/miscord.win/dex\n            - name: dex\n              mountPath: /var/run/secrets/kubernetes.io/dex\n      containers:\n        - name: manager\n          image: nginx\n          volumeMounts:\n            - name: incus-api-key\n              mountPath: /var/run/secrets/miscord.win/dex\n      volumes:\n        - name: incus-api-key\n          emptyDir: {}\n        - name: dex\n          projected:\n            defaultMode: 420\n            sources:\n            - serviceAccountToken:\n                audience: dex\n                expirationSeconds: 7200\n                path: token\n\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmiscord-dev%2Fdexsidecar","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmiscord-dev%2Fdexsidecar","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmiscord-dev%2Fdexsidecar/lists"}