Kubectl login subcommand

[ericchiang]

Description

Add a subcommand to kubectl which can update kubeconfig auth providers configs (kubernetes/kubernetes#23066) and trigger login events. The initial implementation will add support for the OpenID Connect auth provider and a basic auth challenge.

Prior POC and discussion in kubernetes/kubernetes#25758

cc @kubernetes/sig-auth

Progress Tracker

• Before Alpha
  • Design Approval
    • Design Proposal. This goes under docs/proposals. Doing a proposal as a PR allows line-by-line commenting from community, and creates the basis for later design documentation. Paste link to merged design proposal here: docs/proposal: add proposal for kubectl login kubernetes#29350
    • Initial API review (if API). Maybe same PR as design doc. PR-NUMBER
      • Any code that changes an API (/pkg/apis/...)
      • cc @kubernetes/api
    • Identify shepherd (your SIG lead and/or kubernetes-pm@googlegroups.com will be able to help you). My Shepherd is: sig-auth
      • A shepherd is an individual who will help acquaint you with the process of getting your feature into the repo, identify reviewers and provide feedback on the feature. They are not (necessarily) the code reviewer of the feature, or tech lead for the area.
      • The shepherd is not responsible for showing up to Kubernetes-PM meetings and/or communicating if the feature is on-track to make the release goals. That is still your responsibility.
    • Identify secondary/backup contact point. My Secondary Contact Point is: replace.me@replaceme.com (and/or GH Handle)
  • Write (code + tests + docs) then get them merged. ALL-PR-NUMBERS
    • Code needs to be disabled by default. Verified by code OWNERS
    • Minimal testing
    • Minimal docs
      • cc @kubernetes/docs on docs PR
      • cc @kubernetes/feature-reviewers on this issue to get approval before checking this off
      • New apis: Glossary Section Item in the docs repo: kubernetes/kubernetes.github.io
    • Update release notes
• Before Beta
  • Testing is sufficient for beta
  • User docs with tutorials
    • Updated walkthrough / tutorial in the docs repo: kubernetes/kubernetes.github.io
    • cc @kubernetes/docs on docs PR
    • cc @kubernetes/feature-reviewers on this issue to get approval before checking this off
  • Thorough API review
    • cc @kubernetes/api
• Before Stable
  • docs/proposals/foo.md moved to docs/design/foo.md
    • cc @kubernetes/feature-reviewers on this issue to get approval before checking this off
  • Soak, load testing
  • detailed user docs and examples
    • cc @kubernetes/docs
    • cc @kubernetes/feature-reviewers on this issue to get approval before checking this off

FEATURE_STATUS is used for feature tracking and to be updated by @kubernetes/feature-reviewers.
FEATURE_STATUS: IN_DEVELOPMENT

More advice:

Design

• Once you get LGTM from a @kubernetes/feature-reviewers member, you can check this checkbox, and the reviewer will apply the "design-complete" label.

Coding

• Use as many PRs as you need. Write tests in the same or different PRs, as is convenient for you.
• As each PR is merged, add a comment to this issue referencing the PRs. Code goes in the http://github.com/kubernetes/kubernetes repository,
  and sometimes http://github.com/kubernetes/contrib, or other repos.
• When you are done with the code, apply the "code-complete" label.
• When the feature has user docs, please add a comment mentioning @kubernetes/feature-reviewers and they will
  check that the code matches the proposed feature and design, and that everything is done, and that there is adequate
  testing. They won't do detailed code review: that already happened when your PRs were reviewed.
  When that is done, you can check this box and the reviewer will apply the "code-complete" label.

Docs

• Write user docs and get them merged in.
• User docs go into http://github.com/kubernetes/kubernetes.github.io.
• When the feature has user docs, please add a comment mentioning @kubernetes/docs.
• When you get LGTM, you can check this checkbox, and the reviewer will apply the "docs-complete" label.

[bgrant0607]

cc @kubernetes/kubectl

[adohe-zz]

is this an openshift/origin migration feature?

[ericchiang]

@adohe openshift has a similar feature yes, but we're very interested in adding it because we use OAuth2 based credentials (the OpenID Connect authenticator). To work with kubectl we need some way of configuring the existing client authenticator plugins[0] for refresh tokens, and also triggering an initial auth flow.

This was discussed in the sig-auth as TODO for 1.4 (meeting notes here [1]) and I wanted to create an feature issue to track this.

[0] kubernetes/kubernetes#23066
[1] https://docs.google.com/document/d/1woLGRoONE3EBVx-wTb4pvp4CI7tmLZ6lS26VTbosLKM/edit#heading=h.cyshlrkb379

[dickhardt]

FYI: there is a draft Best Current Practice for native apps and OAuth

https://tools.ietf.org/html/draft-ietf-oauth-native-apps-03

[ericchiang]

I've not been able to get the PRs up in time so I'm bumping the release.

[idvoretskyi]

@ericchiang is there any progress on the feature development?

[ericchiang]

@idvoretskyi no there's not. Dropping the milestone for now until we have time to work on it a bit more.

[idvoretskyi]

@ericchiang thank you.

[jhorwit2]

Are there any plans to finish this feature in any upcoming releases this year?

[ericchiang]

@jhorwit2 I don't plan on working on this in the near term. Would be happy to help out for anyone who would like to see this feature and has some cycles to work on it.

[ghost]

Greetings @ericchiang, et al.,

At Nike, we have functionality similar to this proposal that currently lives in an internal fork of kubectl. We are now in a position to contribute to this feature and upstream some of the work we've done.

What would your desired next steps be for us to contribute to this feature and upstream the code we have?

[ericchiang]

@rji discussing a proposal through sig-auth would be a good place to start.

For those following this issue, there's a PR opened recently to implement some of this kubernetes/kubernetes#55514

[tamalsaha]

cc: @easeway

[idvoretskyi]

@ericchiang @kubernetes/sig-auth-feature-requests any progress on this feature is expected?

[ericchiang]

Closing in favor of #541