Comments (5)
As much as I like the proposal, kubelogin is just a recipient of the AAD token and there is no way we can modify that. There are other projects such as https://github.com/kubeguard/guard that can address this limitation. If you need help in that regard, let me know. Otherwise, closing this issue for now
from kubelogin.
kubelogin cannot modify the JWT. The tokens are digitally signed by Azure. Changing it will break the checksum and the validation.
from kubelogin.
@weinong is there any other solution which can decode the token which has more than 200 groups.. We are using kube-oidc-proxy plugin on EKS which seems to be now maintained by Tremolo..They think this has to be done at kubelogin level and we also donot want to change too many configs in our existing clusters(huge footprint)looks like many of the users are hitting similar issue. Is there a solution where we can fix this from azure side in any way?
from kubelogin.
Groups > 200. It's an Azure issue. But limiting the number of groups to 200 in an Access Token or an ID Token actually seems rather reasonable. (to me anyway, where I suffer from the same issue)
You would have to change the EKS OIDC Provider configuration, but you could do something where you configure 'roles' for your AzureAD (or similar) App Registration and have it add 'roles' as a claim to the tokens. Then have the EKS Identity Provider use 'roles' rather than 'groups' as the "Groups" claim.
You could do something similar with any custom claim.
from kubelogin.
I'd recommend configuring app roles and configure k8s to use roles
claim instead of using groups
.
from kubelogin.
Related Issues (20)
- No possibility to use Service Principal when Workload Identity is enabled in the Pod HOT 7
- Rename `master` to `main` branch for this repo.
- Expose kubelogin cli flags in library mode HOT 1
- Query Regarding Autorest Library Usage HOT 2
- weird authorization error when authenticating via service principal HOT 6
- Azure AD v2 endpoints doesn't work HOT 2
- Issues when using Azure DevOps federated identity token HOT 4
- Kubectl is returning 'Unable to connect to the server' and 'couldn't get current server API group list' all of a sudden HOT 1
- Token expires immediately HOT 1
- kubelogin enabled cluster device login takes CLIENT ID from ENV variable HOT 1
- Kubelogin.exe spams multiple times
- Update golang.org/x/net to fix CVE-2023-45288 HOT 2
- Allow Access to PoP package when importing kubelogin. HOT 2
- kubelogin get-token --login azurecli stuck on cloudshell HOT 2
- kubelogin convert-kubeconfig is not converting the config
- Private App registration HOT 2
- `interactive` mode results in an empty refresh_token
- azure kubelogin doesn't respect KUBECACHEDIR
- AzureUsGovernment get-token does not work HOT 1
- Just tried to install from winget, but looks like kubelogin is not properly added on path (or alias is not working as expected) as kubelogin is not available on command line, even after a machine restart. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kubelogin.