anonymous authentication failure

[Masber]

Dear kube-rs team,

I am testing kube-rs and I am unable to authenticate against the kubeapi.

This my code

    let connector = {
        let mut http = HttpConnector::new();
        http.enforce_http(false);
        let proxy = hyper_socks2::SocksConnector {
            proxy_addr: Uri::from_static("socks5://localhost:1080"),
            auth: None,
            connector: http,
        };
        let mut native_tls_builder = native_tls::TlsConnector::builder();
		native_tls_builder.danger_accept_invalid_certs(true);
		native_tls_builder.danger_accept_invalid_hostnames(true);
		native_tls_builder.use_sni(false);

		let native_tls_connector = native_tls_builder.build().unwrap();

        let tls = tokio_native_tls::TlsConnector::from(native_tls_connector);
        hyper_tls::HttpsConnector::from((proxy, tls))
    };

    let config = kube::Config::infer().await?;
    log::info!("{:#?}", config);

    let service = tower::ServiceBuilder::new()
        .layer(config.base_uri_layer())
        .option_layer(config.auth_layer()?)
        .service(hyper::Client::builder().build(connector));

    let client = kube::Client::new(service, config.default_namespace);

    let jobs: Api<Job> = Api::namespaced(client, "services");

    let params = kube::api::ListParams::default();
    jobs.list(&params).await?;

This is how I run the app

RUST_LOG=trace KUBECONFIG=/home/user/test/kube.config cargo run

And these are the logs

[2022-09-20T21:05:39Z INFO  manta] Config {
        cluster_url: https://10.252.1.12:6442/,
        default_namespace: "default",
        root_cert: Some(
            [
                [
                    48,
                    130,
                    2,
                    231,
                    48,
                    -- REDACTED --
                ],
            ],
        ),
        timeout: Some(
            295s,
        ),
        accept_invalid_certs: false,
        auth_info: AuthInfo {
            username: None,
            password: None,
            token: None,
            token_file: None,
            client_certificate: None,
            client_certificate_data: Some(
                "LS0tLS1CRUdJTiBDR -- REDACTED --",
            ),
            client_key: None,
            client_key_data: Some(
                Secret([REDACTED alloc::string::String]),
            ),
            impersonate: None,
            impersonate_groups: None,
            auth_provider: None,
            exec: None,
        },
        proxy_url: Some(
            socks5h://localhost:1080/,
        ),
    }
[2022-09-20T21:05:39Z TRACE tower::buffer::service] sending request to buffer worker
[2022-09-20T21:05:39Z TRACE tower::buffer::worker] worker polling for next message
[2022-09-20T21:05:39Z TRACE tower::buffer::worker] processing new request
[2022-09-20T21:05:39Z TRACE tower::buffer::worker] resumed=false message=worker received request; waiting for service readiness
[2022-09-20T21:05:39Z DEBUG tower::buffer::worker] service.ready=true message=processing request
[2022-09-20T21:05:39Z TRACE tower::buffer::worker] returning response future
[2022-09-20T21:05:39Z TRACE tower::buffer::worker] worker polling for next message
[2022-09-20T21:05:39Z TRACE tower::buffer::worker] worker polling for next message
[2022-09-20T21:05:39Z TRACE hyper::client::pool] checkout waiting for idle connection: ("https", 10.252.1.12:6442)
[2022-09-20T21:05:39Z TRACE hyper::client::connect::http] Http::connect; scheme=Some("socks5"), host=Some("localhost"), port=Some(Port(1080))
[2022-09-20T21:05:39Z DEBUG hyper::client::connect::dns] resolving host="localhost"
[2022-09-20T21:05:39Z DEBUG hyper::client::connect::http] connecting to 127.0.0.1:1080
[2022-09-20T21:05:39Z TRACE mio::poll] registering event source with poller: token=Token(1), interests=READABLE | WRITABLE
[2022-09-20T21:05:39Z DEBUG hyper::client::connect::http] connected to 127.0.0.1:1080
[2022-09-20T21:05:39Z TRACE hyper::client::conn] client handshake Http1
[2022-09-20T21:05:39Z TRACE hyper::client::client] handshake complete, spawning background dispatcher task
[2022-09-20T21:05:39Z TRACE want] signal: Want
[2022-09-20T21:05:39Z TRACE want] signal found waiting giver, notifying
[2022-09-20T21:05:39Z TRACE want] poll_want: taker wants!
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] flushed({role=client}): State { reading: Init, writing: Init, keep_alive: Busy }
[2022-09-20T21:05:39Z TRACE hyper::client::pool] checkout dropped for ("https", 10.252.1.12:6442)
[2022-09-20T21:05:39Z TRACE tracing::span] encode_headers;
[2022-09-20T21:05:39Z TRACE tracing::span::active] -> encode_headers;
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::role] Client::encode method=GET, body=None
[2022-09-20T21:05:39Z TRACE tracing::span::active] <- encode_headers;
[2022-09-20T21:05:39Z TRACE tracing::span] -- encode_headers;
[2022-09-20T21:05:39Z DEBUG hyper::proto::h1::io] flushed 81 bytes
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] flushed({role=client}): State { reading: Init, writing: KeepAlive, keep_alive: Busy }
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] Conn::read_head
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] flushed({role=client}): State { reading: Init, writing: KeepAlive, keep_alive: Busy }
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] Conn::read_head
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::io] received 615 bytes
[2022-09-20T21:05:39Z TRACE tracing::span] parse_headers;
[2022-09-20T21:05:39Z TRACE tracing::span::active] -> parse_headers;
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::role] Response.parse bytes=615
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::role] Response.parse Complete(326)
[2022-09-20T21:05:39Z TRACE tracing::span::active] <- parse_headers;
[2022-09-20T21:05:39Z TRACE tracing::span] -- parse_headers;
[2022-09-20T21:05:39Z DEBUG hyper::proto::h1::io] parsed 7 headers
[2022-09-20T21:05:39Z DEBUG hyper::proto::h1::conn] incoming body is content-length (289 bytes)
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::decode] decode; state=Length(289)
[2022-09-20T21:05:39Z DEBUG hyper::proto::h1::conn] incoming body completed
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] maybe_notify; read_from_io blocked
[2022-09-20T21:05:39Z TRACE want] signal: Want
[2022-09-20T21:05:39Z TRACE want] signal found waiting giver, notifying
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] flushed({role=client}): State { reading: Init, writing: Init, keep_alive: Idle }
[2022-09-20T21:05:39Z TRACE want] signal: Want
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] flushed({role=client}): State { reading: Init, writing: Init, keep_alive: Idle }
[2022-09-20T21:05:39Z TRACE want] poll_want: taker wants!
[2022-09-20T21:05:39Z TRACE hyper::client::pool] put; add idle connection for ("https", 10.252.1.12:6442)
[2022-09-20T21:05:39Z DEBUG hyper::client::pool] pooling idle connection for ("https", 10.252.1.12:6442)
[2022-09-20T21:05:39Z TRACE want] signal: Want
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] flushed({role=client}): State { reading: Init, writing: Init, keep_alive: Idle }
[2022-09-20T21:05:39Z DEBUG kube_client::client] Unsuccessful: ErrorResponse { status: "Failure", message: "jobs.batch is forbidden: User \"system:anonymous\" cannot list resource \"jobs\" in API group \"batch\" in the namespace \"services\"", reason: "Forbidden", code: 403 }
[2022-09-20T21:05:39Z TRACE tower::buffer::worker] worker polling for next message
[2022-09-20T21:05:39Z TRACE tower::buffer::worker] buffer already closed
[2022-09-20T21:05:39Z TRACE hyper::client::pool] pool closed, canceling idle interval
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::dispatch] client tx closed
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] State::close_read()
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] State::close_write()
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] flushed({role=client}): State { reading: Closed, writing: Closed, keep_alive: Disabled }
[2022-09-20T21:05:39Z TRACE hyper::proto::h1::conn] shut down IO complete
[2022-09-20T21:05:39Z TRACE mio::poll] deregistering event source from poller
[2022-09-20T21:05:39Z TRACE want] signal: Closed
[2022-09-20T21:05:39Z TRACE mio::poll] deregistering event source from poller
Error: Api(ErrorResponse { status: "Failure", message: "jobs.batch is forbidden: User \"system:anonymous\" cannot list resource \"jobs\" in API group \"batch\" in the namespace \"services\"", reason: "Forbidden", code: 403 })

The config looks right and I tried to configure the authentication in the service using let service = ServiceBuilder::new().layer(kube::client::ConfigExt::base_uri_layer(&config)).option_layer(kube::client::ConfigExt::auth_layer(&config)?).service(hyper::Client::builder().build(connector));

What am I doing it wrong?

[kazk]

You need to create a TlsConnector based on your config to authenticate with client certificates. You can do that with config.native_tls_connector() with native-tls feature enabled.

auth_layer is for adding token or basic auth (username+password) header, so it's not doing anything for your config.

It should look something like this (not tested):

    let connector = {
        let mut http = HttpConnector::new();
        http.enforce_http(false);
        let proxy = hyper_socks2::SocksConnector {
            proxy_addr: Uri::from_static("socks5://localhost:1080"),
            auth: None,
            connector: http,
        };
        let tls = tokio_native_tls::TlsConnector::from(config.native_tls_connector()?);
        hyper_tls::HttpsConnector::from((proxy, tls))
    };