starlingx/oidc-auth-armada-app
Code Issues Proposed changes

Fixed k8s token for wad users.

Browse Source 
oidc-auth script can authenticate Windows Active Directory  users as
expected but the credentials(token) aren't set correctly on
.kube/config file.

Test Plan:

PASS: Build a ISO with the changes
PASS: Deploy a SX with this new image
PASS: Apply oidc-auth-apps to use Local LDAP users
PASS: Once oidc-auth-apps in applied status, perform oidc-auth-apps
      test by creating a user, apply rolebiding and authenticate it
      using oidc-auth command, check if the new user can send k8s
      commands based on its roles.
PASS: Configure the system to use Windows Active Directory users.
PASS: Apply oidc-auth-apps to use Windows Active Directory server
as backend.
PASS: Once oidc-auth-apps in applied status, and WAD user is logged:
      Use the script oidc-auth -u <my_wad_user_name> to authenticate
      and check if the new user can send k8s commands based on its
      roles.
PASS: Since this fix changes kubernetes config file, I performed all
      this test plan to all available kubernetes versions available:
      1.29.2, 1.30.6, 1.31.5, 1.32.2(Default)

Closes-Bug: 2115601

Change-Id: I2b70d41986e67e6046f25756f197ae65c257ad86
Signed-off-by: Joaci Morais <Joaci.deMorais@windriver.com>
This commit is contained in:
Joaci Morais
2025-06-29 16:30:21 -03:00
parent 8c5834e718
commit ae21ed64f4
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
oidc-auth-tools/oidcauthtools/oidcauthtools/oidc_auth.py
View File

@@ -254,6 +254,9 @@ Please use (-u) option to specify the username without the WAD domain
print("Login succeeded.") print("Login succeeded.")
idToken = node.text idToken = node.text
if match_wad_user:
username = getpass.getuser()
print("Updating kubectl config ...") print("Updating kubectl config ...")
updateCredsCmd = ("kubectl config set-credentials " + updateCredsCmd = ("kubectl config set-credentials " +
username + " --token " + idToken) username + " --token " + idToken)