kubeconfig-service

OIDC Kubeconfig Service

Overview

The OIDC Kubeconfig Service is a single purpose REST-based API. It is designed to retrieve a kubeconfig file from an SKR cluster and change the default authentication mechanism (token) to kubelogin.

Prerequisites

To run locally, the OIDC Kubeconfig Service requires the following tools:

• Go (version specified in the go.mod file)
• Make
• Docker

Configuration

The application uses the following environment variables for configuration:

Usage

You can run the OIDC Kubeconfig Service locally using either a Docker image or the binary.

Run locally using a Docker image

Use the provided makefile to build a local image:

make build-image

Set the required parameters and run the Docker image:

docker run --rm -e OIDC_KUBECONFIG_ISSUER_URL=https://foo -e OIDC_KUBECONFIG_CLIENT_ID=foobar -e OIDC_KUBECONFIG_CLIENT_SECRET=1234 -e OIDC_ISSUER_URL=https://dex.kyma.local -e OIDC_CLIENT_ID=compass-ui -e OIDC_CA=~/.minikube/ca.crt kubeconfig-service

Run locally using the binary

Set the required parameters and run the binary:

OIDC_KUBECONFIG_ISSUER_URL=https://foo OIDC_KUBECONFIG_CLIENT_ID=foobar OIDC_KUBECONFIG_CLIENT_SECRET=1234 OIDC_ISSUER_URL=https://dex.kyma.local OIDC_CLIENT_ID=compass-ui OIDC_CA=~/.minikube/ca.crt go run cmd/generator/main.go

Call the API

# Get a valid Token from your issuer
export TOKEN="Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
# Get valid IDs from Provisioner
export TENANT="3e64ebae-38b5-46a0-b1ed-9ccee153a0ae"
export RUNTIME="ec8b348f-d8c8-49cd-956d-a0c783bfe329"

# Call the service
curl -H "Authorization: ${TOKEN}" "http://127.0.0.1:8000/kubeconfig/${TENANT}/${RUNTIME}" > kubeconfig.yaml

# Use the new config file
KUBECONFIG=kubeconfig.yaml kubectl cluster-inf