feat: KKP OIDC login via kubelogin#131
Open
krajtar wants to merge 3 commits into
Open
Conversation
Replaces the OpenStack application-credential login flow with a KKP OIDC flow: kubelogin obtains a browser-authenticated token, the KKP API returns an OIDC kubeconfig, which is post-processed (auth-provider -> exec plugin) and saved to the profile. New backends/kkp/ package: - kubelogin.py: subprocess wrapper, parses ExecCredential JSON - kkp_client.py: KKP API client, get_oidc_kubeconfig() - kubeconfig_processor.py: auth-provider -> exec block conversion - network.py: SSH tunnel + /etc/hosts + kubelogin binary setup Login flow: kubelogin -> KKP API -> patch kubeconfig -> save -> tunnel+hosts No OIDC tokens persisted. Profile stores kubeconfig path + SSH keys only. hub/infra commands (OpenStack) are broken by this change — separate auth path to be added. Closes #42
The SSH tunnel was a user-specific workaround for reaching the user-cluster apiserver from outside the KKP network. It required a jump host, sudo for /etc/hosts, and hardcoded IP addresses — not suitable for a general CLI. Removed: - ensure_tunnel() and ensure_hosts_entry() from network.py - extract_hostname() import from login_command.py (unused now) - EWC_CLI_SSH_JUMP, EWC_CLI_TUNNEL_HOST, EWC_CLI_APISERVER_IP config vars - Tunnel/hosts patches from integration tests - SSH/sudo prerequisites and tunnel env vars from README The apiserver must now be directly reachable from the host running ewccli. 120 tests pass.
extract_hostname was only called by ensure_hosts_entry for the /etc/hosts tunnel setup. With the tunnel removed, it's dead code. Removes function + 2 tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the OpenStack application-credential login flow with a KKP OIDC flow.
Flow
No OIDC tokens are persisted. The profile stores only the kubeconfig path and SSH keys.
New modules (
ewccli/backends/kkp/)kubelogin.pykkp_client.pyget_oidc_kubeconfig()kubeconfig_processor.pyauth-provider→execblock conversionnetwork.py/etc/hosts+ kubelogin binary setupChanges to existing files
login_command.py: Rewritten — removed OpenStack credential prompts, federee/region/tenant_name selection. Single flow: kubelogin → KKP API → patch → save → tunnel+hosts.check_and_generate_ssh_keyskept.configuration.py: AddedEWC_CLI_KKP_*config block (API URL, Dex issuer, client ID/secret, project/cluster IDs, SSH jump/tunnel/APIServer IPs, kubeconfig path).ewccli.py: Simplifiedinit()signature — removedtenant_name,federee,region,application_credential_id,application_credential_secretparams. Addedno_browser.utils.py: Addedkubeconfig_pathtosave_cli_profile(), addedprofile_exists()+update_cli_profile_credentials().README.md: Updated login section + config env var table.Tests (120 pass)
test_kkp_client.py(5): mock requests, 200/401/404/exceptiontest_kubeconfig_processor.py(7): auth-provider→exec, non-oidc preserved, extract_hostnametest_kubelogin.py(4): mock subprocess, parse/invalid/missing tokenewccli_login_test.py(+3 new): existing profile refresh, new profile create, missing project ID guardBreaking changes
hubandinfracommands (which need OpenStack application credentials) are broken by this change. A separate OpenStack auth path will be added.--tenant-name,--federee,--region,--application-credential-id,--application-credential-secretflags removed fromewc login.Prerequisites
EWC_CLI_KKP_PROJECT_IDandEWC_CLI_KKP_CLUSTER_IDenv vars must be setkrajtar@10.5.214.221)/etc/hostsentryCloses #42