Cannot connect to cluster using OIDC about lens HOT 15 CLOSED

That works! I'm able to connect to my cluster.

from lens.

OIDC kubeconfig is not directly supported yet but it's possible to use https://github.com/int128/kubelogin .

Root cause: missing OIDC support in kubernetes typescript library. Should be fixed in next release where we use latest kubernetes client version.

from lens.

Lens 2.1.0-beta.3 should have working OIDC support, could you test it?

https://kontena-lens-desktop.s3-eu-west-1.amazonaws.com/Lens%20Setup%202.1.0-beta.3.exe

from lens.

from lens.

Workaround (using kubelogin):

- name: oidc-example
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - oidc-login
      - get-token
      - --oidc-issuer-url=https://idp.example.com
      - --oidc-client-id=<client-id>
      - --oidc-client-secret=<secret>
      command: kubectl

from lens.

I don't think AKS works that way. They have their own built in process. The flow goes like this:

1. Add cluster from their CLI
2. Run kubectl proxy
3. A message is shown with a link and a code.
4. Click the link, sign in with your domain credentials, enter the code.
5. Authorization is routed back to kubectl and the portal is opened

from lens.

@cwoolum Lens v2.1.4 has OIDC related fixes. Could you test if it fixes your use case?

from lens.

Definitely making progress but got a 401. The add cluster process makes debugging much easier! Here's my kubeconfig and the error returned.

apiVersion: v1
kind: Config
preferences: {}
current-context: kube-api-staging
clusters:
  - name: kube-api-staging
    cluster:
      certificate-authority-data: >-
        {Redacted}
      server: >-
        https://server.hcp.westus.azmk8s.io:443
      insecure-skip-tls-verify: false
contexts:
  - name: kube-api-staging
    context:
      cluster: kube-api-staging
      user: my_user_account
users:
  - name: my_user_account
    user:
      auth-provider:
        config:
          access-token: >-
            {Redacted}
          tenant-id: 3b******-e6f7-4a4e-9fc6-f0********83
        name: azure

{ "response": { "statusCode": 401, "body": { "kind": "Status", "apiVersion": "v1", "metadata": {}, "status": "Failure", "message": "Unauthorized", "reason": "Unauthorized", "code": 401 }, "headers": { "audit-id": "9a6a109b-7b2f-4902-89c1-e4fa64fc2664", "content-type": "application/json", "date": "Wed, 16 Oct 2019 15:54:22 GMT", "content-length": "129", "connection": "close" }, "request": { "uri": { "protocol": "https:", "slashes": true, "auth": null, "host": "server.hcp.westus.azmk8s.io:443", "port": "443", "hostname": "server.hcp.westus.azmk8s.io", "hash": null, "search": null, "query": null, "pathname": "/version/", "path": "/version/", "href": "https://server.hcp.westus.azmk8s.io:443/version/" }, "method": "GET", "headers": { "authorization": "", "Authorization": "Bearer *Redacted*", "accept": "application/json" } } }, "body": {} }

from lens.

@cwoolum Did you manage to get this working with AKS?

from lens.

No, because of the way that AKS wraps all of the auth pieces, I think the only way to make it work is to surface the login message.

from lens.

😞 Thought that might be the case!

Great tool to use with the cluster admin context but I'd want people using their AAD accounts to login.

Maybe it's something that will come soon! Thanks for replying.

from lens.

update: this will be fixed in upcoming 2.6.0 release where we do complete re-write for the auth "proxy" we use within the app. We're gonna ditch the k8s JS client for that as it has some serious bugs & shortcomings for many cases, not only this Azure AAD case. The potential prompt for user will be surfaced in the initial connection to the cluster.

from lens.

Awesome! Please let me know when a beta is available and I'll be glad to test.

from lens.

@cwoolum beta download is available here: https://kontena-lens-desktop.s3-eu-west-1.amazonaws.com/Lens%20Setup%202.6.0-beta.3.exe

(Remember to install stable version once it's out)

from lens.

2.6.0 is now shipped with complete re-write for auth proxying. 🎉

from lens.