Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update tame-oauth to 0.6.0 #701

Merged
merged 1 commit into from
Nov 11, 2021
Merged

Update tame-oauth to 0.6.0 #701

merged 1 commit into from
Nov 11, 2021

Conversation

kazk
Copy link
Member

@kazk kazk commented Nov 11, 2021

Application Default Credentials from gcloud, and obtaining OAuth tokens from local metadata server when running inside GCP are now supported.

See #644

@clux
Copy link
Member

clux commented Nov 11, 2021

That looks great to me. Are you testing with GCP directly?

@kazk
Copy link
Member Author

kazk commented Nov 11, 2021

Are you testing with GCP directly?

I confirmed Application Default Credentials works (reading ~/.config/gcloud/application_default_credentials.json and making request).

I have some clusters on GCP (GKE), and it uses command-based authentication (gcloud config config-helper --format=json):

https://github.com/kube-rs/kube-rs/blob/afc85402c1900a2b5aa4f1f993abfc489f82dd37/kube-client/src/client/auth/mod.rs#L264-L265

So, I commented out cmd-path field in the provider config to make it use oauth instead.

I don't have anything to test the local metadata server auth with, though.


With the update, it should match what client-go is doing: https://github.com/kubernetes/kubernetes/blob/bbc3a9aace18ae40598e5279202cc67a89d7b9f3/staging/src/k8s.io/client-go/plugin/pkg/client/auth/gcp/gcp.go#L142-L170

But I just noticed gcp provider is deprecated since v1.22, and will be removed in v1.25:

https://github.com/kubernetes/kubernetes/blob/bbc3a9aace18ae40598e5279202cc67a89d7b9f3/staging/src/k8s.io/client-go/plugin/pkg/client/auth/gcp/gcp.go#L118-L124

func newGCPAuthProvider(_ string, gcpConfig map[string]string, persister restclient.AuthProviderConfigPersister) (restclient.AuthProvider, error) {
	// deprecated in v1.22, remove in v1.25
	// this should be updated to use klog.Warningf in v1.24 to more actively warn consumers
	warnOnce.Do(func() {
		klog.V(1).Infof(`WARNING: the gcp auth plugin is deprecated in v1.22+, unavailable in v1.25+; use gcloud instead.
To learn more, consult https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins`)
	})

I guess it's going to be replaced by exec: {command: gcloud}.

@kazk kazk force-pushed the update-tame-oauth branch from 8266fb6 to 9bf6e87 Compare November 11, 2021 20:47
@kazk kazk force-pushed the update-tame-oauth branch from 9bf6e87 to 92de104 Compare November 11, 2021 20:49
@kazk kazk merged commit 13df70b into kube-rs:master Nov 11, 2021
@kazk kazk deleted the update-tame-oauth branch November 11, 2021 21:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants