How do you deploy Identity Server on Kubernetes?

Question

I want to deploy Identity Server 4 on Kubernetes 1.8, and use this as a Federation Gateway between my web application and Azure Active Directory (to begin with).

If I call Identity Server from my web application using the local k8s service name, my users are redirected to the wrong Identity Server URL (containing the local k8s service name) during Sign in which clearly won't work. We are using an implicit flow.

I therefore setup a Azure Load balancer with dns name and configured Identity Server to be externally accessible with the domain name as the PublicOrigin URL.

However, my web application which runs in the same cluster cannot access Identity Server using the external URL of the Identity Server (discovery fails).

If I run Identity Server on another Kubernetes cluster then everything works fine.

My question is:

How do you properly deploy Identity Server in Kubernetes? Do I really need another Kubernetes cluster?

Note: I am using Kubernetes on Azure created with ACS engine (because we have mixed windows and linux containers).

Answer 1

I'm using AKS (Azure managed kubernetes) and have a single client asp.net core 2 web app in the same cluster as my IS4 service with no issues. Both webapps are fronted by Nginx with kube-lego for LetsEncrpyt TLS support, and DNS is provided by Azure DNS.

I'm not using the PublicOrigin but instead the client app's Authority (in the openidconnect setup) uses the full (external Azure) DNS name of the IS4 service. You can use PublicOrigin if you want to use the cluster service naming from your clients