Fix azure refresh token apiserver id #170
Conversation
|
Welcome @fooka03! |
k8s-ci-robot
added
cncf-cla: yes
|
/assign @yliaog |
config/kube_config.py
Outdated
| ) | ||
| refresh_token = config['refresh-token'] | ||
| client_id = config['client-id'] | ||
| apiserver_id = config['apiserver-id'] |
There was a problem hiding this comment.
this would break the kubeconfig that does not have the field 'apiserver-id'
There was a problem hiding this comment.
The azure provider requires apiserver-id unless I'm missing something in the workflow. First thing I tried was removing apiserver-id from my kubeconfig to try and rely on the hardcoded ID. I got an error about apiserver-id being a required field when trying to run commands.
fooka03
force-pushed
the
bugfix/135_azure_refresh_token
branch
from
9da0652 to
78a0030
Compare
k8s-ci-robot
added
size/M
fooka03
force-pushed
the
bugfix/135_azure_refresh_token
branch
from
78a0030 to
0b20833
Compare
Codecov Report
@@ Coverage Diff @@
## master #170 +/- ##
==========================================
- Coverage 93.44% 93.41% -0.03%
==========================================
Files 13 13
Lines 1389 1398 +9
==========================================
+ Hits 1298 1306 +8
- Misses 91 92 +1
Continue to review full report at Codecov.
|
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fooka03, yliaog The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
Fixes #135
Currently, the refresh token logic is hardcoded to use the general Microsoft Graph application id as the apiserver. This fails if there's a mismatch in the kubeconfig, specifically in the audience in the access token being refreshed. Instead, the new code will dynamically load this from the local kubeconfig as with the other request values and use that to submit the refresh call.
Additionally, this sets the ADAL API version to 1.0 to keep the behavior consistent with the kubernetes go client azure authentication flow. (Namely, the string
spi:being included for the audience)I also updated the tests to use the Microsoft Graph app id as that was the prior behavior the tests were relying on.