kubernetes-sigs / kind

Kubernetes IN Docker - local clusters for testing Kubernetes
https://kind.sigs.k8s.io/
Apache License 2.0
13.5k stars 1.56k forks source link

kind local cluster OIDC setup windows VM #3531

Open tppalani opened 8 months ago

tppalani commented 8 months ago

I'm running kind cluster in windows Operating system, Just for POC purpose i have optioned Okta CLIEND-ID and Okta Domain to enable to okta login mechanism . while creating cluster i have passed below configuration in yaml as extra api server configuration. But i don't see any effect after creating kind cluster. Even i verified kueb-apiserver.yaml file too but i don't see any configuration when i'm checking inside the container path:

---
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
  - role: control-plane
    image: kindest/node:v1.27.1@sha256:c44686bf1f422942a21434e5b4070fc47f3c190305be2974f91444cd34909f1b
    extraMounts:
    - hostPath: C:/tools/cert.pem
      containerPath: /usr/local/share/ca-certificates/my.crt
    kubeadmConfigPatches:
      - |
        kind: InitConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            node-labels: "ingress-ready=true"
      - |
        apiServer:
          extraArgs:
            runtime-config: "api/all=true"
      - |
        apiServer:
          extraArgs:
            admission-control: "ServiceAccount,NodeRestriction,PodSecurityPolicy,AlwaysAdmit"

      - |
        apiServer:
          extraArgs:
            apiserver.oidc-issuer-url: "https://dev-123456.okta.com/oauth2/default"
            apiserver.oidc-client-id: "ohaja1234mkalLMN"
            apiserver.oidc-username-prefix: "oidc:"
            apiserver.oidc-username-claim: "sub"
            apiserver.oidc-groups-prefix: "oidc:"
            apiserver.oidc-groups-claim: "groups"
    extraPortMappings:
      - containerPort: 80
        hostPort: 80
      - containerPort: 443
        hostPort: 443
      - containerPort: 1111
        hostPort: 1111

cat ./kube/config

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0t...........
    server: https://127.0.0.1:52260
  name: kind-kind
contexts:
- context:
    cluster: kind-kind
    user: kind-kind
  name: kind-kind
current-context: kind-kind
kind: Config
preferences: {}
users:
- name: kind-kind
  user:
    client-certificate-data: LS0t...........
    client-key-data: LS0t...........
- name: oidc-user
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - oidc-login
      - get-token
      - --oidc-issuer-url=https://dev-123456.okta.com/oauth2/default
      - --oidc-client-id=ohaja1234mkalLMN
      - --oidc-extra-scope=groups
      command: kubectl
      env: null
      interactiveMode: IfAvailable
      provideClusterInfo: false

What you expected to happen: OIDC user will pick when i'm running below command

kubectl get pods --user oidc-user

How to reproduce it (as minimally and precisely as possible):

kubectl get pods --user oidc-user
error: unknown command "oidc-login" for "kubectl"
Unable to connect to the server: getting credentials: exec: executable kubectl failed with exit code 1

Anything else we need to know?:

Environment:

BenTheElder commented 8 months ago
    kubeadmConfigPatches:
      - |
        kind: InitConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            node-labels: "ingress-ready=true"
      - |
        apiServer:
          extraArgs:
            runtime-config: "api/all=true"
      - |
        apiServer:
          extraArgs:
            admission-control: "ServiceAccount,NodeRestriction,PodSecurityPolicy,AlwaysAdmit"

      - |
        apiServer:
          extraArgs:
            apiserver.oidc-issuer-url: "https://dev-123456.okta.com/oauth2/default"
            apiserver.oidc-client-id: "ohaja1234mkalLMN"
            apiserver.oidc-username-prefix: "oidc:"
            apiserver.oidc-username-claim: "sub"
            apiserver.oidc-groups-prefix: "oidc:"
            apiserver.oidc-groups-claim: "groups"

This isn't quite right, your patches except the first one are not targeting any particular object so they're doing nothing.

You can just combine these into one patch, remove the -| lines except the first one and merge the extraArgs into one map

/remove-kind bug /kind support