-
Notifications
You must be signed in to change notification settings - Fork 92
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Adds Azure Developer CLI (azd) as a new login method (#398)
* WIP: Adding azd credential * Updates scopes for AAD v2.0 that azd supports * Adds docs for azd login mode. * Updated internal comments * Stores underlying azd credential in token wrapper * Adds unit tests to validate converter for azd
- Loading branch information
Showing
14 changed files
with
210 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| # Azure Developer CLI (azd) | ||
|
|
||
| This login mode uses the already logged-in context performed by Azure Developer CLI to get the access token. | ||
| The token will be issued in the same Azure AD tenant as in `azd auth login`. | ||
|
|
||
| `kubelogin` will not cache any token since it's already managed by Azure Developer CLI. | ||
|
|
||
| > ### NOTE | ||
| > | ||
| > This login mode only works with managed AAD in AKS. | ||
| ## Usage Examples | ||
|
|
||
| ```sh | ||
| azd auth login | ||
|
|
||
| export KUBECONFIG=/path/to/kubeconfig | ||
|
|
||
| kubelogin convert-kubeconfig -l azd | ||
|
|
||
| kubectl get nodes | ||
| ``` | ||
|
|
||
| ## References | ||
|
|
||
| - https://learn.microsoft.com/azure/developer/azure-developer-cli/overview | ||
| - https://github.com/azure/azure-dev |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| package token | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
| "errors" | ||
| "fmt" | ||
| "strconv" | ||
| "time" | ||
|
|
||
| "github.com/Azure/azure-sdk-for-go/sdk/azcore/policy" | ||
| "github.com/Azure/azure-sdk-for-go/sdk/azidentity" | ||
| "github.com/Azure/go-autorest/autorest/adal" | ||
| ) | ||
|
|
||
| type AzureDeveloperCLIToken struct { | ||
| resourceID string | ||
| tenantID string | ||
| cred *azidentity.AzureDeveloperCLICredential | ||
| timeout time.Duration | ||
| } | ||
|
|
||
| // newAzureDeveloperCLIToken returns a TokenProvider that will fetch a token for the user currently logged into the Azure Developer CLI. | ||
| // Required arguments the resourceID (which is used as the scope) and an optional tenantID. | ||
| func newAzureDeveloperCLIToken(resourceID string, tenantID string, timeout time.Duration) (TokenProvider, error) { | ||
| if resourceID == "" { | ||
| return nil, errors.New("resourceID cannot be empty") | ||
| } | ||
|
|
||
| if timeout <= 0 { | ||
| timeout = defaultTimeout | ||
| } | ||
|
|
||
| // Request a new Azure Developer CLI token provider | ||
| cred, err := azidentity.NewAzureDeveloperCLICredential(&azidentity.AzureDeveloperCLICredentialOptions{ | ||
| TenantID: tenantID, | ||
| }) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("unable to create credential. Received: %v", err) | ||
| } | ||
|
|
||
| return &AzureDeveloperCLIToken{ | ||
| resourceID: resourceID, | ||
| tenantID: tenantID, | ||
| cred: cred, | ||
| timeout: timeout, | ||
| }, nil | ||
| } | ||
|
|
||
| // Token fetches an azcore.AccessToken from the Azure Developer CLI SDK and converts it to an adal.Token for use with kubelogin. | ||
| func (p *AzureDeveloperCLIToken) Token(ctx context.Context) (adal.Token, error) { | ||
| emptyToken := adal.Token{} | ||
|
|
||
| if p.cred == nil { | ||
| return emptyToken, errors.New("credential is nil. Create new instance with newAzureDeveloperCLIToken function") | ||
| } | ||
|
|
||
| ctx, cancel := context.WithTimeout(ctx, p.timeout) | ||
| defer cancel() | ||
|
|
||
| policyOptions := policy.TokenRequestOptions{ | ||
| TenantID: p.tenantID, | ||
| Scopes: []string{fmt.Sprintf("%s/.default", p.resourceID)}, | ||
| } | ||
|
|
||
| // Use the token provider to get a new token with the new context | ||
| azdAccessToken, err := p.cred.GetToken(ctx, policyOptions) | ||
| if err != nil { | ||
| return emptyToken, fmt.Errorf("expected an empty error but received: %v", err) | ||
| } | ||
|
|
||
| if azdAccessToken.Token == "" { | ||
| return emptyToken, errors.New("did not receive a token") | ||
| } | ||
|
|
||
| // azurecore.AccessTokens have ExpiresOn as Time.Time. We need to convert it to JSON.Number | ||
| // by fetching the time in seconds since the Unix epoch via Unix() and then converting to a | ||
| // JSON.Number via formatting as a string using a base-10 int64 conversion. | ||
| expiresOn := json.Number(strconv.FormatInt(azdAccessToken.ExpiresOn.Unix(), 10)) | ||
|
|
||
| // Re-wrap the azurecore.AccessToken into an adal.Token | ||
| return adal.Token{ | ||
| AccessToken: azdAccessToken.Token, | ||
| ExpiresOn: expiresOn, | ||
| Resource: p.resourceID, | ||
| }, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| package token | ||
|
|
||
| import ( | ||
| "context" | ||
| "testing" | ||
|
|
||
| "github.com/Azure/kubelogin/pkg/internal/testutils" | ||
| ) | ||
|
|
||
| func TestNewAzureDeveloperCLITokenEmpty(t *testing.T) { | ||
| // Using default timeout for testing | ||
| _, err := newAzureDeveloperCLIToken("", "", defaultTimeout) | ||
|
|
||
| if !testutils.ErrorContains(err, "resourceID cannot be empty") { | ||
| t.Errorf("unexpected error: %v", err) | ||
| } | ||
| } | ||
|
|
||
| func TestNewAzureDeveloperCLIToken(t *testing.T) { | ||
| azd := AzureDeveloperCLIToken{} | ||
| _, err := azd.Token(context.TODO()) | ||
|
|
||
| if !testutils.ErrorContains(err, "credential is nil") { | ||
| t.Errorf("unexpected error: %v", err) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters