OIDC auth behaivor differs from kubectl #142

mogaika · 2019-07-03T19:53:47Z

I trying to use kubeconfig that works with kubectl but causes problems in python client

auth-provider:
  name: oidc
  config:
    client-id: <CENSORED>
    id-token: <CENSORED>
    idp-certificate-authority-data: <CENSORED>
    idp-issuer-url: <CENSORED>
    refresh-token: <CENSORED>

Code: config.load_kube_config('testkube.yml')
Error:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/mogaika/.local/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 549, in load_kube_config
    loader.load_and_set(config)
  File "/home/mogaika/.local/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 430, in load_and_set
    self._load_authentication()
  File "/home/mogaika/.local/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 194, in _load_authentication
    if self._load_auth_provider_token():
  File "/home/mogaika/.local/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 213, in _load_auth_provider_token
    return self._load_oid_token(provider)
  File "/home/mogaika/.local/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 290, in _load_oid_token
    self._refresh_oidc(provider)
  File "/home/mogaika/.local/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 351, in _refresh_oidc
    verify=config.ssl_ca_cert if config.verify_ssl else None
  File "/home/mogaika/.local/lib/python3.6/site-packages/requests_oauthlib/oauth2_session.py", line 363, in refresh_token
    timeout=timeout, headers=headers, verify=verify, withhold_token=True, proxies=proxies)
  File "/home/mogaika/.local/lib/python3.6/site-packages/requests/sessions.py", line 581, in post
    return self.request('POST', url, data=data, json=json, **kwargs)
  File "/home/mogaika/.local/lib/python3.6/site-packages/requests_oauthlib/oauth2_session.py", line 425, in request
    headers=headers, data=data, **kwargs)
  File "/home/mogaika/.local/lib/python3.6/site-packages/requests/sessions.py", line 533, in request
    resp = self.send(prep, **send_kwargs)
  File "/home/mogaika/.local/lib/python3.6/site-packages/requests/sessions.py", line 646, in send
    r = adapter.send(request, **kwargs)
  File "/home/mogaika/.local/lib/python3.6/site-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='172.16.244.35', port=443): Max retries exceeded with url: /auth/realms/iam/protocol/openid-connect/token (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),))

I didn't get origin of this problem since temp cert file created and passed to urllib correctly (code)
Workaround is to remove idp-certificate-authority-data field and disable cert checks.
But then I found other 2 problems:

code expects that 'client-secret' is always provided, but this is not always the case (code). Workaround: provide any string as client-secret, but afaik this depend on oauth server side.
code passes None object as verify parameter to refresh_token method instead of boolean value (code), (method definition) (deeper method definition)

The text was updated successfully, but these errors were encountered:

mogaika · 2019-07-04T14:37:25Z

I debugged kubectl and if 'client-secret' is not provided kubectl treats its as empty string

mogaika · 2019-07-08T11:44:23Z

Turned out that we have problem with our cert. It misses other certs of chain. But in the same time kubelet works perfectly with such certs. Either kubelet ignores cert problems and fallback to ignore them, either kubelet do not require to have cert ca bundle (what is unlikely). Will prepare fix for 2 other problems from topic list.

roycaihw · 2019-07-09T18:15:20Z

could you clarify if it's a problem with the cert or if it's a gap between the python client and kubectl? The first comment seems to be not concrete enough to reproduce the issue

I debugged kubectl and if 'client-secret' is not provided kubectl treats its as empty string

sounds like the python client is missing this path. Would you like to open a PR to fix it?

mogaika · 2019-07-10T11:28:44Z

could you clarify if it's a problem with the cert or if it's a gap between the python client and kubectl?

My cert (cert-1) issued by self-signed cert-2. In kubectl case its enough to provide only cert-1 in idp-certificate-authority-data field. But in python-client/urllib3 case looks like its required to provide ca bundle (what is logically seems right, because cert-2 is not in cert store somewhere)

fejta-bot · 2019-10-08T12:16:40Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.