search

micahhausler / k8s-oidc-helper

Helper tool for authenticating to Kubernetes using Google's OpenID Connect
MIT License
201 stars 86 forks source link

Add flag for google oauth2 api version #16

Closed msoderberg closed 1 year ago

msoderberg commented 6 years ago

From CHANGELOG-1.10.md:

kube-apiserver: the OpenID Connect authenticator no longer accepts tokens from the Google v3 token APIs; users must switch to the "https://www.googleapis.com/oauth2/v4/token" endpoint.

If you use the token retrieved from version 3 of the api to access the k8s apiserver, kubectl will log: error: You must be logged in to the server (Unauthorized)" And the following will be logged in the apiserver: E0418 12:26:47.196237 1 authentication.go:63] Unable to authenticate the request due to an error: [invalid bearer token, [invalid bearer token, invalid bearer token]]

This PR adds an "api-version" flag that defaults to "v3" for backwards compatibility. Feel free to modify it as you like before merging.

msoderberg commented 6 years ago

This can be closed if you merge https://github.com/micahhausler/k8s-oidc-helper/pull/14 which solves the problem in a better way.

cliveza commented 5 years ago

👍 merge, merge it now, you can do it, you know you want to, make us all happy