feat(ske): support stateless WIF kubeconfig login - #1477
feat(ske): support stateless WIF kubeconfig login#1477Galin-Karabadzhakov wants to merge 11 commits into
Conversation
|
This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it. |
|
Hi team, could you please confirm whether this approach aligns with the intended direction for non-interactive SKE authentication? |
|
This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it. |
| if clusterName := flags.FlagToStringValue(p, cmd, clusterNameFlag); clusterName != "" { | ||
| clusterConfig.ClusterName = clusterName | ||
| } | ||
| if organizationID := flags.FlagToStringValue(p, cmd, organizationFlag); organizationID != "" { | ||
| clusterConfig.OrganizationID = organizationID | ||
| } | ||
| globalFlags := globalflags.Parse(p, cmd) | ||
| if clusterConfig.STACKITProjectID == "" { | ||
| clusterConfig.STACKITProjectID = globalFlags.ProjectId | ||
| } | ||
| if clusterConfig.Region == "" { | ||
| clusterConfig.Region = globalFlags.Region | ||
| } |
There was a problem hiding this comment.
It looks like --cluster-name and --organization-id override the values configured from the clusterConfig, while --region and --project-id are only used as fallbacks when the clusterConfig has not defined them. I think they should behave the same.
There was a problem hiding this comment.
Good catch. I made the behavior consistent across all four values: cluster configuration from KUBERNETES_EXEC_INFO takes precedence, while CLI/global values are used only as fallbacks. I also added a regression test with conflicting values.
| // GetIDPTokenEndpoint returns the configured IdP token endpoint without requiring | ||
| // authentication storage. Persisted configuration is reused when available. | ||
| func GetIDPTokenEndpoint(p *print.Printer) (string, error) { | ||
| tokenEndpoint, err := GetAuthField(IDP_TOKEN_ENDPOINT) |
There was a problem hiding this comment.
We should only call GetAuthField if we are in stateless mode, since GetAuthField can try to write to the system when no there is no auth keyring, since it calls getAuthFieldFromEncodedTextFile from storage.go.
I would suggest to implement another function like GetIDPTokenEndpointStateless that recieves the tokenEndpoint information like so: wellKnownConfig, err := retrieveIDPWellKnownConfigWithStorage(p, false) and call this new function when we are in stateless mode, instead of GetIDPTokenEndpoint
There was a problem hiding this comment.
Agreed. I added GetIDPTokenEndpointStateless, which performs endpoint discovery without reading from or writing to authentication storage. Stateless WIF and STACKIT_ACCESS_TOKEN flows now use this function, while stateful flows continue using the stored endpoint when available. Regression coverage was added for this behavior.
4 participants
Description
Enable
stackit ske kubeconfig login --idpto operate as a stateless Kubernetes exec credential provider using STACKIT Workload Identity Federation.Kubernetes clients do not always include cluster information in
KUBERNETES_EXEC_INFO, and in-cluster workloads should not require persisted CLI credentials or cache state.This change:
STACKIT_FEDERATED_TOKEN_FILE.STACKIT_ACCESS_TOKEN.Relates to #1327.
This is complementary to #1424, which introduces general WIF authentication support.
Validation
make fmtmake generate-docsmake lintmake buildgo test ./internal/pkg/auth ./internal/cmd/ske/kubeconfig/loginThe repository-wide
make testcurrently reports two unrelated failures that were reproduced on an unchangedmaincheckout.Checklist
make fmtmake generate-docsmake lint