Auth fails with okta SSO auth provider

[bougyman]

When using .kube/config which describes okta auth, K8s::Client fails with

Errno::ENOENT: No such file or directory -
from /Users/<redacted>/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/gems/k8s-ruby-0.10.5/lib/k8s/transport.rb:98:in ``'

When I tracked this down, transport.rb:76 is dispatching this to the self.token_from_auth_provider(auth_provider) method, which expects a 'cmd-path' key to exist; however, in my configuration, that does not exist:

[2] pry(K8s::Transport)> auth_provider
=> {"client-id"=>"<snipped>",
 "client-secret"=>"<snipped>",
 "id-token"=> "<snip>",
 "idp-issuer-url"=>"https://<snip>.okta.com/oauth2/<snipped>",
 "refresh-token"=>"<snipped>"}

^ This is from introspecting with a binding.pry on line 79 of transport.rb. I suppose this means there's no default support for idp / saml auth yet in k8s-client. I've done some cursory research into ruby-saml and ruby-saml-idp but not yet figured out how to get the information necessary to auth with them. Will continue researching as I can, and track in this issue.

[bougyman]

Added cmd-path: kubectl and cmd-args: get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes.io/service-account.name']=='default')].data.token}" to derive a token using the standard token_from_auth_provider method, but it is getting 404 auth failed after that.

[bougyman]

However, this does work with curl:

tv574p@ALT03105 ~ % APISERVER=$(kubectl config view -o jsonpath="{.clusters[?(@.name==\"$CLUSTER_NAME\")].cluster.server}")
tv574p@ALT03105 ~ % TOKEN=$(kubectl get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='default')].data.token}"|base64 --decode)
tv574p@ALT03105 ~ % curl -X GET $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure
{
  "kind": "APIVersions",
  "versions": [
    "v1"
  ],
  "serverAddressByClientCIDRs": [
    {
      "clientCIDR": "0.0.0.0/0",
      "serverAddress": "<snip>.232.63.21:6443"
    }
  ]
}%                        

[bougyman]

I had left out the base64 decoding! This is now workitng with cmd-path: ~/bin/get_kube_token.sh, with this file being:

#!/bin/bash
kubectl get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='default')].data.token}"|base64 --decode