search

deggja / netfetch

Kubernetes tool for scanning clusters for network policies and identifying unprotected workloads.
MIT License
401 stars 25 forks source link

Add OIDC auth provider #132

Closed rsrchboy closed 6 months ago

rsrchboy commented 7 months ago

...really, all known ones, but IIRC OIDC is the only one thus far.

This will address errors of the form:

no Auth Provider found for name "oidc"
deggja commented 7 months ago

Hello @rsrchboy! Thanks for the PR. Could you explain a bit more in depth what issue this tackles? So that I understand a bit better.

rsrchboy commented 7 months ago

Importing this package causes common k8s client auth providers to be loaded and available to the built binary: OIDC, as well as GCP and Azure. Without it, those of us depending on those modes of authentication see this failure when invoking netfetch:

$ netfetch scan default
Running native network policies scan...
Mode: CLI
Using default kubeconfig path: /home/cweyl/.kube/config

Error creating Kubernetes client: failed to create clientset: no Auth Provider found for name "oidc"
Error during Kubernetes native network policies scan: failed to create clientset: no Auth Provider found for name "oidc"

Is that sufficient? This is kinda a "gotcha!", as I suspect most of us assume that these common plugins would be loaded by the client libraries by default.

deggja commented 7 months ago

Importing this package causes common k8s client auth providers to be loaded and available to the built binary: OIDC, as well as GCP and Azure. Without it, those of us depending on those modes of authentication see this failure when invoking netfetch:

$ netfetch scan default
Running native network policies scan...
Mode: CLI
Using default kubeconfig path: /home/cweyl/.kube/config

Error creating Kubernetes client: failed to create clientset: no Auth Provider found for name "oidc"
Error during Kubernetes native network policies scan: failed to create clientset: no Auth Provider found for name "oidc"

Is that sufficient? This is kinda a "gotcha!", as I suspect most of us assume that these common plugins would be loaded by the client libraries by default.

Perfect. Thank you for the explanation, that is more than sufficient @rsrchboy. This will be included in the next release.

deggja commented 6 months ago

Merged into #134 to prepare for release.