How to connect Kiali hosted in EKS with Azure AD

[ahergom]

Hi,

We have Kiali installed on an EKS cluster via Terraform helm release. We want to use the OpenID authentication strategy via Azure AD. We have a group of users in Azure AD, and we want only them to have permissions to access Kiali.

Our authentication configuration code in the helm release is as follows, but we don't know how to complete the parameters for "issuer_uri," "authorization_endpoint," and "token_endpoint":

# AUTHENTICATION
"cr.spec.auth"                                 = "openid"
"cr.spec.auth.openid.clientid"                 = "{ClientID from Azure AD app registration}"
"cr.spec.auth.openid.issuer_uri"               = "https://login.microsoftonline.com/{tenantID}/v2.0/"
"cr.spec.auth.openid.authorization_endpoint"   = "https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/authorize"
"cr.spec.auth.openid.token_endpoint"           = "https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/token"
"cr.spec.auth.openid.api_token"                = "access_token"
"cr.spec.auth.openid.authentication_timeout"   = 300
"cr.spec.auth.openid.disable_rbac"             = true
"cr.spec.auth.openid.username_claim"           = "email"
"cr.spec.auth.openid.insecure_skip_verify_tls" = false

In the Kiali documentation, use cases for Azure and GCP are mentioned, but not for AWS.
What steps should we follow to complete our configuration?

Thanks.

[jmazzitelli]

This is the docs that are available for Azure/Kiali OpenID integration: https://kiali.io/docs/configuration/authentication/openid/#using-with-azure-aks-and-aad

[ahergom]

Yes, we have reviewed this documentation, but there are specific configurations for AKS that do not apply to AWS EKS. Is there no specific documentation available for the EKS use case?

[jmazzitelli]

There is no other documentation. We rely on community contributions for documenting the various different provider use-cases. When you get this figured out, please feel free to contribute to our docs in this case or at minimum post the solution here so others can benefit.