OpenUnison / openunison-k8s-login-oidc

Kubernetes login portal for both kubectl and the dashboard using OpenID Connect. Use groups from your assertion in RBAC policies to control access to your cluster. Supports impersonation and OpenID Connect integration with your API server.
https://www.tremolosecurity.com/kubernetes/
Apache License 2.0
12 stars 5 forks source link

multiple token for multiple cluster of the same user in config #23

Closed shi-ron closed 3 years ago

shi-ron commented 3 years ago

I suggest the user identifier string contains username and cluster in config. Thus, it would be convenient to switch context without updating token of the same user.

mlbiam commented 3 years ago

In your values.yaml, k8s_cluster_name can be set to set your cluster name in your .kube/config Assign a different value to this value for each cluster so you can switch clusters without re-authenticating. This helm configuration maps to K8S_CLUSTER_NAME in the orchestra OpenUnison object.

shi-ron commented 3 years ago

If I login in e. g. k8s1 and k8s2 with the same username me as config:

clusters:
- cluster:
  name: k8s1
  ...
- cluster:
  name: k8s2
  ...
contexts:
- context:
  name: k8s1
    cluster: k8s1
    user: me
- context:
  name: k8s2
    cluster: k8s2
    user: me
...
users:
- name: me
  user:
     client-certificate-data: ...
     client-key-data: ...

then I need to update token, because user me can save only one token.

I hope the config looks like:

clusters:
- cluster:
  name: k8s1
  ...
- cluster:
  name: k8s2
  ...
contexts:
- context:
  name: k8s1
    cluster: k8s1
    user: me@k8s1
- context:
  name: k8s2
    cluster: k8s2
    user: me@k8s2
...
users:
- name: me@k8s1
  user:
     client-certificate-data: ...
     client-key-data: ...
- name: me@k8s2
  user:
     client-certificate-data: ...
     client-key-data: ...

where the user are me@k8s1 and me@k8s2 respectively. And this should be configured by pasting the command line, not manually, of course.

mlbiam commented 3 years ago

i see your point. we're working on a new release, which should be out by end of month, that will address this.

mlbiam commented 3 years ago

The latest release includes this update. Roll out a new version of the Deployment and new containers will get pulled with this feature enabled