Enable to switch context in kubeconfig #4534

shu-mutou · 2019-11-13T08:33:32Z

When user is logging in with kubeconfig that have multiple contexts, add buttons for the contexts into user menu and enable to switch contexts.

This solution assumes that dashboard-metrics-scraper is deployed on each cluster.
To get metrics from dashboard-metrics-scraper in each cluster, add sidecarHost: [endpoint URL for scraper] into cluster in kubeconfig like follow:

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: xxxxxxxxxxxxx
    server: http://192.168.100.13:8001
    sidecar-host: http://192.168.100.13:30080
  name: minikube
- cluster:
    certificate-authority-data: xxxxxxxxxxxxx
    server: http://192.168.100.14:8001
    sidecar-host: http://192.168.100.14:30080
  name: minikube2
contexts:
- context:
    cluster: minikube2
    user: minikube2-admin
  name: minikube2-admin@minikube2
- context:
    cluster: minikube
    user: minikube-admin
  name: minikube-admin@minikube
current-context: minikube-admin@minikube
kind: Config
preferences: {}
users:
- name: minikube-admin
  user:
    client-certificate-data: xxxxxxxxxxxxx
    client-key-data: xxxxxxxxxxxxx
    token: xxxxxxxxxxxxx
- name: minikube2-admin
  user:
    client-certificate-data: xxxxxxxxxxxxx
    client-key-data: xxxxxxxxxxxxx
    token: xxxxxxxxxxxxx

Endpoints for server and sidecarHost would be passed as cookies and clients for them would be created dynamically in server side.

As first step, this implements basic architecture. Config editor and etc. would be implemented in future PR.

Note: To test this with npm run start*, enlarge maximum http header size with export NODE_OPTIONS=--max-http-header-size=102400.

Partial implements #4522

codecov · 2019-11-28T10:03:09Z

Codecov Report

Merging #4534 into master will decrease coverage by 0.49%.
The diff coverage is 28.18%.

@@            Coverage Diff             @@
##           master    #4534      +/-   ##
==========================================
- Coverage   45.45%   44.96%   -0.50%     
==========================================
  Files         214      216       +2     
  Lines       10208    10449     +241     
  Branches      108      131      +23     
==========================================
+ Hits         4640     4698      +58     
- Misses       5293     5471     +178     
- Partials      275      280       +5

Impacted Files	Coverage Δ
src/app/backend/auth/api/types.go	`33.33% <ø> (ø)`
src/app/backend/auth/basic.go	`0.00% <0.00%> (ø)`
src/app/backend/auth/handler.go	`35.21% <0.00%> (-7.90%)`	⬇️
src/app/backend/handler/apihandler.go	`27.74% <0.00%> (ø)`
src/app/frontend/index.config.ts	`100.00% <ø> (ø)`
.../frontend/common/services/global/authentication.ts	`32.94% <8.00%> (-5.95%)`	⬇️
.../app/frontend/common/services/global/kubeconfig.ts	`19.52% <19.52%> (ø)`
src/app/backend/integration/metric/manager.go	`44.44% <20.00%> (-5.56%)`	⬇️
src/app/backend/client/manager.go	`54.68% <40.00%> (-1.33%)`	⬇️
src/app/frontend/login/component.ts	`82.14% <66.66%> (+0.89%)`	⬆️
... and 6 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a83047e...5987cd4. Read the comment docs.

maciaszczykm · 2020-01-09T08:01:24Z

We will go back to this after the release, please ping if I will forget.

maciaszczykm · 2020-06-18T13:02:30Z

src/app/frontend/common/services/global/kubeconfig.ts

+    const clusters = conf.clusters.filter(cluster => {
+      return cluster.name === name;
+    });
+    if (!clusters.length) {


Please use !_.isEmpty() to check for clusters list emptiness. This is lodash utility function that can be imported with following line import * as _ from 'lodash';.

maciaszczykm · 2020-06-18T13:03:04Z

src/app/frontend/common/services/global/kubeconfig.ts

+        return ctx.name === context;
+      })
+    ) {
+      conf['current-context'] = context;


As before, on known types please use dot to access object params.

maciaszczykm · 2020-06-18T13:04:27Z

src/app/frontend/common/services/global/kubeconfig.ts

+  apiVersion: string;
+  clusters: Cluster[];
+  contexts: Context[];
+  'current-context': string;


There is no need to escape it. Can we change it to camelCase?

I found that js-yaml can not convert keys to camelcase. Instead I found a library camelcase-keys but it need to use require in import. Do you know better library or is it acceptable, i.e. using require?

You can use require.

maciaszczykm · 2020-06-18T13:10:13Z

@floreks What do you think about the usability and approach here? I have done initial code review so far but we should also consider if that will not impact our current setup.

floreks · 2020-06-18T13:44:16Z

src/app/frontend/common/services/global/kubeconfig.ts

+import {KdError} from '@api/frontendapi';
+import {Config, CONFIG_DI_TOKEN} from '../../../index.config';
+
+type Cluster = {


Those are backend api types. Move it to the backendapi.ts.

floreks · 2020-06-18T13:47:49Z

src/app/frontend/common/services/global/kubeconfig.ts

+type User = {
+  name: string;
+  user: {
+    token: string;


We can't store token here as it is already part of our login mechanism and is stored in an encrypted cookie. This would be extremely insecure. Also, we do not support client-certificate-data as a way of logging in anyway, so this is obsolete.

If we store all the tokens contained in kubeconfig in cookies, I'm worried that all HTTP requests will get too big and impact performance.
I'm considering to encrypt tokens in jwe and store them into cookie before login sequence. But do you have any other ideas?

maciaszczykm · 2020-06-18T13:49:40Z

I have tested it locally using npm run start:prod command and the context are visible after logging with kubeconfig. However, after I try to switch context I see an error in the console (POST https://localhost:8080/api/v1/login 500) and I am redirected to the login view.

shu-mutou · 2020-06-19T05:55:57Z

Thank you very much for your reviews! I will continue considering pointed things, check and modify this next week.

shu-mutou · 2020-06-19T06:49:19Z

I have tested it locally using npm run start:prod command and the context are visible after logging with kubeconfig. However, after I try to switch context I see an error in the console (POST https://localhost:8080/api/v1/login 500) and I am redirected to the login view.

I checked npm run start:prod and it works in my environment. Could you check your kubeconfig?

maciaszczykm · 2020-06-24T07:30:44Z

I will try to verify again tomorrow but it seemed okay as I was able to login with it. Is some additional info required?

shu-mutou · 2020-06-24T09:50:52Z

@maciaszczykm I improved my codes, but I'm considering about encrypting tokens with jwe and store them into cookie yet. But I'm happy if you try this UX.

shu-mutou · 2020-07-02T07:39:27Z

/hold
need more investigations.

When user is logged in with kubeconfig, add selections for contexts included in kubeconfig into user menu and enable to switch contexts included in kubeconfig. This commit implements basic functionalities for switching contexts, so to set dashboard-metrics-scraper host for each `cluster`, you need to describe it as `sidecarHost` in `cluster` directive in kubeconfig. Note: To test this with `npm run start*`, enlarge maximum http header size with `export NODE_OPTIONS=--max-http-header-size=102400`.

k8s-ci-robot · 2020-07-09T07:40:03Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: shu-mutou

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [shu-mutou]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

shu-mutou · 2020-07-09T07:47:32Z

/hold cancel
All tokens are stored in cookie as jweTokens now.
Instead, please note that set env NODE_OPTIONS=--max-http-header-size=1024000 when run npm run start*.

floreks · 2020-07-09T08:50:59Z

The solution that requires us to raise limits for HTTP header size is not really acceptable. We should try to limit data passed between browser and server as much as possible. Most proxies set their limits to 8KB and many people are using that. This change would break many configurations.

Processing all tokens at all times is also not good. Only one should be used at the time and others should naturally expire over time.

Another issue is encrypting all auth information to all servers with a single encryption key that is stored in the main cluster. We should not do that. It decreases security and makes all servers vulnerable in case of a single cluster breach.

There are a couple of more issues, but I think the general approach should be reconsidered. First, we should have some architectural concepts prepared. Possibly something like that should be handled in the user settings and we should have an option to add additional servers that we want to access. We could store some data in secrets/config maps and use multiple encryption tokens for actual auth info.

shu-mutou · 2020-07-10T06:12:13Z

As I expected, the HTTP header size exceeded the limit.
Let's redesign token handling.
If we store sensitive informations into secrets, do you have any idea how to clear expired secrets?

k8s-ci-robot · 2020-09-30T18:06:20Z

@shu-mutou: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

floreks · 2020-11-12T10:35:35Z

Closing as stale. New PR can be opened as it requires major changes.

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Nov 13, 2019

k8s-ci-robot requested review from atoato88 and feloy November 13, 2019 08:36

k8s-ci-robot added language/fr Updates or issues for French translations. language/ja Updates or issues for Japanese translations. language/ko Updates or issues for Korean translations. language/zh Updates or issues for Chinese translations. labels Nov 13, 2019

shu-mutou force-pushed the switch-context branch from 5b2f979 to 4741a80 Compare November 28, 2019 09:09

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 28, 2019

shu-mutou force-pushed the switch-context branch from 4741a80 to b07b973 Compare November 29, 2019 07:20

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Nov 29, 2019

shu-mutou force-pushed the switch-context branch from b07b973 to 29815b0 Compare November 29, 2019 09:09

shu-mutou changed the title ~~[WIP] Enable to switch context on kubeconfig~~ [WIP] Enable to switch context in kubeconfig Nov 29, 2019

shu-mutou force-pushed the switch-context branch from 29815b0 to 7f9b7c6 Compare January 8, 2020 06:20

shu-mutou requested review from floreks, maciaszczykm and jeefy and removed request for atoato88 and feloy January 8, 2020 06:32

shu-mutou changed the title ~~[WIP] Enable to switch context in kubeconfig~~ Enable to switch context in kubeconfig Jan 8, 2020

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 8, 2020

shu-mutou mentioned this pull request Jan 22, 2020

Enable to switch context when kubeconfig used for login #4522

Open

10 tasks

shu-mutou force-pushed the switch-context branch from 7f9b7c6 to 014b742 Compare February 4, 2020 06:39

shu-mutou mentioned this pull request Feb 15, 2020

String fix (until 2020-2-28) #4911

Closed

shu-mutou added this to the v2.1.0 milestone Feb 15, 2020

maciaszczykm reviewed Jun 18, 2020

View reviewed changes

floreks reviewed Jun 18, 2020

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 19, 2020

shu-mutou force-pushed the switch-context branch from 1dedb12 to b424ad3 Compare June 24, 2020 09:42

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 24, 2020

shu-mutou force-pushed the switch-context branch from b424ad3 to 5739487 Compare June 24, 2020 09:50

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 2, 2020

shu-mutou force-pushed the switch-context branch from 5739487 to 5987cd4 Compare July 9, 2020 07:39

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 9, 2020

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 30, 2020

floreks closed this Nov 12, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable to switch context in kubeconfig #4534

Enable to switch context in kubeconfig #4534

shu-mutou commented Nov 13, 2019 •

edited

Loading

codecov bot commented Nov 28, 2019 •

edited

Loading

maciaszczykm commented Jan 9, 2020

maciaszczykm Jun 18, 2020

maciaszczykm Jun 18, 2020

maciaszczykm Jun 18, 2020

shu-mutou Jun 24, 2020

maciaszczykm Jun 24, 2020

maciaszczykm commented Jun 18, 2020

floreks Jun 18, 2020

floreks Jun 18, 2020

shu-mutou Jun 24, 2020

maciaszczykm commented Jun 18, 2020

shu-mutou commented Jun 19, 2020

shu-mutou commented Jun 19, 2020

maciaszczykm commented Jun 24, 2020

shu-mutou commented Jun 24, 2020

shu-mutou commented Jul 2, 2020

k8s-ci-robot commented Jul 9, 2020

shu-mutou commented Jul 9, 2020

floreks commented Jul 9, 2020

shu-mutou commented Jul 10, 2020

k8s-ci-robot commented Sep 30, 2020

floreks commented Nov 12, 2020

Enable to switch context in kubeconfig #4534

Enable to switch context in kubeconfig #4534

Conversation

shu-mutou commented Nov 13, 2019 • edited Loading

codecov bot commented Nov 28, 2019 • edited Loading

Codecov Report

maciaszczykm commented Jan 9, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maciaszczykm commented Jun 18, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maciaszczykm commented Jun 18, 2020

shu-mutou commented Jun 19, 2020

shu-mutou commented Jun 19, 2020

maciaszczykm commented Jun 24, 2020

shu-mutou commented Jun 24, 2020

shu-mutou commented Jul 2, 2020

k8s-ci-robot commented Jul 9, 2020

shu-mutou commented Jul 9, 2020

floreks commented Jul 9, 2020

shu-mutou commented Jul 10, 2020

k8s-ci-robot commented Sep 30, 2020

floreks commented Nov 12, 2020

shu-mutou commented Nov 13, 2019 •

edited

Loading

codecov bot commented Nov 28, 2019 •

edited

Loading