Out-of-tree client authentication providers (UserCredentials exec option) for asp.net core applications #359

ghost · 2020-02-20T12:45:13Z

after facing the same problem described in: #340
I've tried to create a version that will allow me to receive the token using an external command execution (as kubeconfig supports).

Implemented according to:
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/kubectl-exec-plugins.md
and with inspiration from the kubernetes python implementation (https://github.com/kubernetes-client/python-base/blob/master/config/exec_provider.py)

1. I haven't written tests
2. Token refreshment hasn't been implemented meaning that once the token is expired a new token has to be generated, I am currently using my kubernetes "access layer" from the DI with a scoped life time cycle.
3. I've tested it running on Linux (Amazon Linux 2) only, not sure if it works properly on Windows/any other creature ;)

Would appreciate help finishing and wrapping this up for usage.

k8s-ci-robot · 2020-02-20T12:45:17Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please log a ticket with the Linux Foundation Helpdesk: https://support.linuxfoundation.org/
Should you encounter any issues with the Linux Foundation Helpdesk, send a message to the backup e-mail support address at: login-issues@jira.linuxfoundation.org

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-ci-robot · 2020-02-20T12:45:21Z

Welcome @talboren!

It looks like this is your first PR to kubernetes-client/csharp 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-client/csharp has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

ghost · 2020-02-20T13:00:34Z

/assign @krabhishek8260

ghost · 2020-02-20T13:03:20Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.

If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.

If you have done the above and are still having issues with the CLA being reported as unsigned, please log a ticket with the Linux Foundation Helpdesk: https://support.linuxfoundation.org/

Should you encounter any issues with the Linux Foundation Helpdesk, send a message to the backup e-mail support address at: login-issues@jira.linuxfoundation.org

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Signed the CLA

ghost · 2020-02-20T13:35:03Z

Seems like Process and Environment.UserInteractive are not supported by all dependencies.

new file: src/KubernetesClient/KubeConfigModels/ExecCredentialResponse.cs new file: src/KubernetesClient/KubeConfigModels/ExternalExecution.cs modified: src/KubernetesClient/KubeConfigModels/UserCredentials.cs modified: src/KubernetesClient/KubernetesClientConfiguration.ConfigFile.cs

… issues

…hentication in case it is not a asp.net core app

brendandburns · 2020-02-21T03:27:45Z

Thanks for the PR. This looks great to me, but we need unit tests for this before we merge it.

Thanks!

k8s-ci-robot · 2020-02-24T18:17:17Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please log a ticket with the Linux Foundation Helpdesk: https://support.linuxfoundation.org/
Should you encounter any issues with the Linux Foundation Helpdesk, send a message to the backup e-mail support address at: login-issues@jira.linuxfoundation.org

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

…ication) extension

ghost · 2020-02-24T18:21:22Z

@brendandburns I've added 2 tests, let me know if that's OK.

…sor symbol

…he echo command in OSX

ghost · 2020-02-25T14:17:48Z

@brendandburns I'm having trouble making the tests pass with OSX due to some issues I am experiencing with 'echo' (different behavior than Linux?), any chance you have any idea?

brendandburns · 2020-02-25T23:25:34Z

I looked at the error, the JSON parse error is:

k8s.Exceptions.KubeConfigException : external exec failed due to uncaught exception: Newtonsoft.Json.JsonReaderException: Unexpected character encountered while parsing number: n. Path '', line 1, position 1.

You might consider using base64 encoding (e.g. base64 -d <response-string> | echo) to work around quoting/escaping issues.

But I'm not sure what bit is having a problem. I have an old Mac at home, I'll try to repro sometime if you still can't figure it out.

tg123 · 2020-02-26T07:26:01Z

src/KubernetesClient/KubeConfigModels/ExternalExecution.cs

+        /// Environment variables to set when executing the plugin. Optional.
+        /// </summary>
+        [YamlMember(Alias = "env")]
+        public Dictionary<string, string> EnvironmentVariables { get; set; }


IDictionary if possible

tg123

I did not quite catch about why this is related to asp.net core. did not see anything related to asp.net

tg123 · 2020-02-26T07:26:19Z

src/KubernetesClient/KubeConfigModels/ExternalExecution.cs

+        /// Arguments to pass when executing the plugin. Optional.
+        /// </summary>
+        [YamlMember(Alias = "args")]
+        public List<string> Arguments { get; set; }


tg123 · 2020-02-26T07:29:18Z

src/KubernetesClient/KubernetesClientConfiguration.ConfigFile.cs

@@ -365,6 +390,83 @@ public static string RenewAzureToken(string tenantId, string clientId, string ap
            throw new KubeConfigException("Refresh not supported.");
        }

+#if NETCOREAPP


why this is specific to netcore, can it be netstandard?

tg123 · 2020-02-26T07:30:46Z

src/KubernetesClient/KubernetesClientConfiguration.ConfigFile.cs

+            if (string.IsNullOrWhiteSpace(stderr) == false)
+                throw new KubeConfigException($"external exec failed due to: {stderr}");
+
+            process.WaitForExit();


Changed OSX testing command to printf to try and solve the JSON parsing errors

….0 according to Microsoft documentation

tg123 · 2020-02-26T08:47:25Z

I am working on migrating the codebase to .netstandard2.0

ghost · 2020-02-29T14:16:22Z

@tg123 @brendandburns still waiting for your approval.

tg123 · 2020-03-01T06:27:55Z

@talboren any chance to take a look at my comments?

ghost · 2020-03-01T06:59:39Z

@tg123 please note my latest commits. I’ve made changes according to your changes. What are you talking about?

src/KubernetesClient/KubernetesClientConfiguration.ConfigFile.cs

tg123 · 2020-03-01T07:35:09Z

@talboren sorry forget to click publish :( I forget to do so many times

brendandburns · 2020-03-03T19:41:17Z

@tg123 are you ok with merging this? Any other comments need addressing?

Thanks!

tg123 · 2020-03-03T22:29:05Z

/LGTM

lets make timeout configurable later if necessary

brendandburns · 2020-03-05T17:12:15Z

/approve

thanks for the PR (and the patience)

k8s-ci-robot · 2020-03-05T17:12:23Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: brendandburns, talboren

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [brendandburns]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Feb 20, 2020

k8s-ci-robot requested review from brendandburns and krabhishek8260 February 20, 2020 12:45

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Feb 20, 2020

k8s-ci-robot assigned krabhishek8260 Feb 20, 2020

ghost mentioned this pull request Feb 20, 2020

Configuration deserialization fail when using EKS configuration file #340

Closed

talboren added 4 commits February 20, 2020 17:15

Fixed a few issues with the process spawning and some null references…

fbe92c1

… issues

Removed unused import that caused the build to fail (Mail)

887fa41

Added preprocessor directive that will disable out-of-tree client aut…

8eb021b

…hentication in case it is not a asp.net core app

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Feb 20, 2020

ghost changed the title ~~Out-of-tree client authentication providers (UserCredentials exec option)~~ Out-of-tree client authentication providers (UserCredentials exec option) for asp.net core applications Feb 20, 2020

brendandburns requested review from tg123 and removed request for krabhishek8260 February 21, 2020 03:24

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. and removed cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Feb 24, 2020

Added tests to the new external execution (out-of-tree client authent…

8ac68da

…ication) extension

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Feb 24, 2020

talboren added 2 commits February 25, 2020 10:31

Trying to fix failing tests that fail apparently due to the preproces…

5b69353

…sor symbol

Trying to fix failing macos tests

93cd4d8

talboren added 2 commits February 25, 2020 13:26

Added the -n (do not output trailing newline) and the -E options to t…

c7bacf6

…he echo command in OSX

initializing arguments variable

77e18f2

tg123 reviewed Feb 26, 2020

View reviewed changes

tg123 requested changes Feb 26, 2020

View reviewed changes

k8s-ci-robot added the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Feb 26, 2020

Changes according to tg123 comments

5b40f28

Changed OSX testing command to printf to try and solve the JSON parsing errors

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Feb 26, 2020

talboren added 2 commits February 26, 2020 10:33

Added missing references

70026f2

Environment.UserInteractive and Process applies to .NET Standard >= 2…

b240d87

….0 according to Microsoft documentation

ghost requested a review from tg123 February 26, 2020 08:52

tg123 requested changes Mar 1, 2020

View reviewed changes

src/KubernetesClient/KubernetesClientConfiguration.ConfigFile.cs Show resolved Hide resolved

ghost requested a review from tg123 March 3, 2020 16:01

k8s-ci-robot assigned tg123 Mar 3, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 3, 2020

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 5, 2020

k8s-ci-robot merged commit b07e78a into kubernetes-client:master Mar 5, 2020

seanamosw mentioned this pull request Apr 1, 2020

Failure to parse AWS generated kube config #396

Closed

tg123 mentioned this pull request May 26, 2020

Removed NETSTANDARD2_0 IFDefs and added Brackets #451

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Out-of-tree client authentication providers (UserCredentials exec option) for asp.net core applications #359

Out-of-tree client authentication providers (UserCredentials exec option) for asp.net core applications #359

ghost commented Feb 20, 2020 •

edited by ghost

Loading

k8s-ci-robot commented Feb 20, 2020

k8s-ci-robot commented Feb 20, 2020

ghost commented Feb 20, 2020

ghost commented Feb 20, 2020 •

edited by ghost

Loading

ghost commented Feb 20, 2020

brendandburns commented Feb 21, 2020

k8s-ci-robot commented Feb 24, 2020

ghost commented Feb 24, 2020

ghost commented Feb 25, 2020

brendandburns commented Feb 25, 2020

tg123 Feb 26, 2020

tg123 left a comment

tg123 Feb 26, 2020

tg123 Feb 26, 2020

tg123 Feb 26, 2020

tg123 commented Feb 26, 2020

ghost commented Feb 29, 2020

tg123 commented Mar 1, 2020

ghost commented Mar 1, 2020

tg123 commented Mar 1, 2020

brendandburns commented Mar 3, 2020

tg123 commented Mar 3, 2020

brendandburns commented Mar 5, 2020

k8s-ci-robot commented Mar 5, 2020

Out-of-tree client authentication providers (UserCredentials exec option) for asp.net core applications #359

Out-of-tree client authentication providers (UserCredentials exec option) for asp.net core applications #359

Conversation

ghost commented Feb 20, 2020 • edited by ghost Loading

k8s-ci-robot commented Feb 20, 2020

k8s-ci-robot commented Feb 20, 2020

ghost commented Feb 20, 2020

ghost commented Feb 20, 2020 • edited by ghost Loading

ghost commented Feb 20, 2020

brendandburns commented Feb 21, 2020

k8s-ci-robot commented Feb 24, 2020

ghost commented Feb 24, 2020

ghost commented Feb 25, 2020

brendandburns commented Feb 25, 2020

tg123 Feb 26, 2020

Choose a reason for hiding this comment

tg123 left a comment

Choose a reason for hiding this comment

tg123 Feb 26, 2020

Choose a reason for hiding this comment

tg123 Feb 26, 2020

Choose a reason for hiding this comment

tg123 Feb 26, 2020

Choose a reason for hiding this comment

tg123 commented Feb 26, 2020

ghost commented Feb 29, 2020

tg123 commented Mar 1, 2020

ghost commented Mar 1, 2020

tg123 commented Mar 1, 2020

brendandburns commented Mar 3, 2020

tg123 commented Mar 3, 2020

brendandburns commented Mar 5, 2020

k8s-ci-robot commented Mar 5, 2020

ghost commented Feb 20, 2020 •

edited by ghost

Loading

ghost commented Feb 20, 2020 •

edited by ghost

Loading