Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add support for Azure oidc auth #501

Closed
clux opened this issue Apr 22, 2021 · 5 comments · Fixed by #1082
Closed

add support for Azure oidc auth #501

clux opened this issue Apr 22, 2021 · 5 comments · Fixed by #1082
Labels
client kube Client related wontfix This is unlikely to be worked on

Comments

@clux
Copy link
Member

clux commented Apr 22, 2021

Azure auth provider was working before we refactored it (as we fixed #238), but it was always shoehorned into the load_gcp fn at the time. Now it's done better, but looks like people are having issues now: Dentrax/kubesql#1
Edit: This probably never worked.

The source for the azure auth can be found in https://github.com/kubernetes/client-go/tree/master/plugin/pkg/client/auth/azure in client-go.

Support for this should probably exist elsewhere than in kube, like in tame-oauth (which we use for the gcp flow) is open to supporting other flows.

We need a handler in token_from_provider. It's even possible that the token_from_gcp_provider one even works, but we had quite a bit of changes to simplify our oauth stuff by using tame_oauth, so not sure if that's true anymore.

Similar PR: https://github.com/clux/kube-rs/pull/419/files

@clux clux added client kube Client related help wanted Not immediately prioritised, please help! labels Apr 22, 2021
@kazk
Copy link
Member

kazk commented Apr 22, 2021

Azure auth provider was working before we refactored it

I don't think so? #238 fixed the panic when kubeconfig had Azure auth, but kube didn't have Azure auth provider support. There was no code to make requests to Azure.

I don't think we should implement OAuth for Azure in kube. We should use optional dependency. I believe https://github.com/EmbarkStudios/tame-oauth is open to adding Azure support.

@clux
Copy link
Member Author

clux commented Apr 22, 2021

Ah right! I thought we had unintentional support, but I guess not.
Yeah, tame-oauth is probably the better place for it based on their description:

The only auth flow that is currently implemented is the service account flow for GCP. Other flows can be added, but right now that is the only one we need. I'll reword the issue.

@clux clux changed the title Implement Azure auth provider add support for Azure oidc auth Apr 22, 2021
@clux clux added blocked awaiting upstream work and removed help wanted Not immediately prioritised, please help! labels Apr 22, 2021
@clux clux added this to Kube Roadmap Nov 3, 2021
@clux clux moved this to Defining in Kube Roadmap Nov 3, 2021
@bocc
Copy link

bocc commented Dec 16, 2021

Sorry for asking here, but do you have any updates on this one? I'd like to authenticate with Azure, but I have no leads currently.

@kazk
Copy link
Member

kazk commented Dec 16, 2021

Similar to GCP OAuth, it's now deprecated:

	// deprecated in v1.22, remove in v1.25
	// this should be updated to use klog.Warningf in v1.24 to more actively warn consumers
	warnOnce.Do(func() {
		klog.V(1).Infof(`WARNING: the azure auth plugin is deprecated in v1.22+, unavailable in v1.25+; use https://github.com/Azure/kubelogin instead.
To learn more, consult https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins`)
	})

Replaced by Azure/kubelogin, which is an exec plugin, so that should be supported. Please open an issue if that doesn't work.

If you really need OAuth support, I'd recommend working with tame-oauth to add Azure support first.

@bocc
Copy link

bocc commented Dec 16, 2021

Thank you for pointing this out! kubelogin convert-kubeconfig did the trick.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
client kube Client related wontfix This is unlikely to be worked on
Projects
Archived in project
Development

Successfully merging a pull request may close this issue.

3 participants