search

lensapp / lens

Lens - The way the world runs Kubernetes
https://k8slens.dev/
MIT License
22.45k stars 1.45k forks source link

Lens IDE: Two-Factor Authentication #4361

Open jeliasson opened 2 years ago

jeliasson commented 2 years ago

What would you like to be added: Option to enable Two-Factor Authentication as login when opening Lens IDE, or when it's been idle for X amount of minutes.

Why is this needed: To increase security by adding authentication, and two-factor authentication should be the ambition.

Environment you are Lens application on: development

Nokel81 commented 2 years ago

Is this about Lens Spaces and Cluster Connect or just the IDE; or is this about AWS two-factor?

jeliasson commented 2 years ago

@Nokel81 General OTP two-factor authentication for the IDE. Not related to AWS.

Nokel81 commented 2 years ago

So to lock down lens between logging in?

jeliasson commented 2 years ago

@Nokel81 Yes, and/or when it's been idle for X amount of minutes. Naturally opt-in for the two-factor authentication method and it's options.

Nokel81 commented 2 years ago

Are you talking about the login button in the top right of this screenshot? Or something completely new?

Screen Shot 2021-11-22 at 11 27 06 AM

jeliasson commented 2 years ago

I guess something new. Basically being prompted for a login, which could be a OTP token, as soon as I open the Lens application - or if it's been idle for some time. I do not use Lens Spaces, which I believe the top right corner is for.

Nokel81 commented 2 years ago

Okay thanks for the clarification. How would this increase security? If someone has access to your computer then they would be able to use kubectl and helm to their hearts content.

jeliasson commented 2 years ago

True. Implementing a login would at best protect the application from being used without user authentication.

In the future, one could imagine the added kubeconfig's (the actual secret part) would be encrypted using a subset of those authentication credentials, and decrypted and made available when the application is unlocked. I haven't looked under the hood of the application, yet, so apologizes for my arrogance and assumptions of the internal workings.

Anyway, having some kind opt-in of authentication for the application itself would be interesting regardless of the underlying data at rest.