Error setting user info form Default config ~/.kube/config.

[KiranRamashetty]

Trying to get list of pods using the default config file (set by kubectl). Getting an error setting user info

"pods is forbidden: User "system:anonymous" cannot list resource "pods" in API group "" in the namespace "infra"

Node JS code snippet

  const k8s = require('@kubernetes/client-node');
  const kc = new k8s.KubeConfig();
  kc.loadFromDefault();
        
  const k8sApi = kc.makeApiClient(k8s.CoreV1Api);
  k8sApi.listNamespacedPod('infra')
       .then((res) => {
            console.log(res);
        });

tried with python and it works as expected

from kubernetes import client, config

# Configs can be set in Configuration class directly or using helper utility
config.load_kube_config()

v1 = client.CoreV1Api()
print("Listing pods with their IPs:")
ret = v1.list_namespaced_pod("infra")
for i in ret.items:
    print("%s\t%s\t%s" % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))

[KiranRamashetty]

Found an closed issue related to same topic

216

[KiranRamashetty]

its also working with godaddy version of k8 - https://github.com/godaddy/kubernetes-client

I would be like to use this npm module so it would be great if you can help me fix the issue

~/.kube/config content

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: ------
    server: https://-------.io:443
  name: ----
- cluster:
    certificate-authority-data: --------
    server: https://api.-------.io:443
  name: ----
contexts:
- context:
    cluster: ----
    namespace: "---"
    user: ----
  name: ----
- context:
    cluster: ----
    namespace: "----"
    user: ur03
  name: usr03
current-context: usr03
kind: Config
preferences: {}
users:
- name: ur03
  user:
    auth-provider:
      config:
        client-id: kubernetes
        client-secret: --------
        id-token: -------
        idp-certificate-authority-data: --------
        idp-issuer-url: https://iam.-----.com
        refresh-token: -----------
      name: oidc

[brendandburns]

I don't think the library currently supports oidc auth providers.

PRs definitely welcome or we'll get to it eventually...

cc @silasbw in case it's easy to port the godaddy auth code.

[brendandburns]

If you want to help add an oidc provider, there's a cloud example here:

https://github.com/kubernetes-client/javascript/blob/master/src/cloud_auth.ts

That would be easy (I think) to adapt.

[silasbw]

I can take a pass at porting it over.

How do you want to handle async? E.g., refreshing the token. We get around this in the other providers by shelling out to sync commands. Continuing that approach for oidc seems cumbersome, but there might be an obvious approach I'm missing.

An alternative is to update https://github.com/kubernetes-client/javascript/blob/master/src/auth.ts#L5 to async + Promise.

[silasbw]

I looked into converting getToken to a promised based interface: that approach leads to altering applyToRequest to be asynchronous. That's challenging because it's part of the openapi-generator API contract: https://github.com/OpenAPITools/openapi-generator/blob/master/modules/openapi-generator/src/main/resources/typescript-node/api-single.mustache#L200

It seems like the right approach is to update openapi-generator+swagger-codegen to handle Promises, and then circle back around to this Issue.

Thoughts/feedback @brendandburns @drubin ?

[brendandburns]

@silasbw yep, that's probably right. I struggled with this in the past when we tried to remove sync file calls...

[silasbw]

OK, I'll give it a go.

[brendandburns]

I realized someone (maybe even me) did implement a really primitive oidc connector, but it's not activated in the library:

https://github.com/kubernetes-client/javascript/blob/master/src/oidc_auth.ts

I'll send a PR to activate it at least, but it doesn't handle refresh...

[silasbw]

FYI, I submitted a PR to openapi-generator folks to add Promise support to the Authentication interface: OpenAPITools/openapi-generator#3408

[silasbw]

I'm just getting back from vacation and will pick this up again.

[louis-murray]

is this still moving? I'd love to see this get in to master + a release soon if possible. I'm happy to help with any bit of it too.

[silasbw]

Yup -- I was waiting for the openapi folks to release a new minor version that included our changes. They did that this week. I should probably take a stab at rebuilding the the .ts code using the new openapi version and then there's some updates to the client code to convert the auth handling code to use the new Promise-based interface we added to openapi. It would be helpful if you wanted to contribute to the later chunk of work. I'll update this PR after I rebuild the .ts code.