Open waterfoul opened 8 months ago
Simple implementation could accept a set of keys to lookup in the OIDC ID Token and store these on the UserPrincipal as a map.
It's a bit tricky because the values for the the Extra
data are slices of strings, so, similar to the existing code, you'd need to parse these as strings or slices of strings, and convert the string to a slice when necessary.
Then inject these here https://github.com/weaveworks/weave-gitops/blob/2af6d1133a5717fc3b0f367734443557074b1548/pkg/kube/config_getter.go#L61 into the ImpersonationConfig.
Problem When an aks cluster is setup with EntraId Auth and Azure RBAC you need to pass "extra:oid" in order for impersonation to work. This means weave gitops' impersonation will not work. Example:
Results in
If you create a user in your kubeconfig with
along with the normal user config and use it the (via a new context) it works
Solution I'd like a feature to be able to map oidc claims to impersonation extras
Workaround I added
oidcGroupsPrefix: "weave:"
to my issuer secret then manually configured RBAC for specific groups using things like the following yaml. Not ideal since the whole point of using Azure RBAC is to centralize this sort of thingAdditional context