You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Environmental Info:
K3s Version:
All Versions, tested in v1.28.5, v1.28.15 & v1.31.2
Node(s) CPU architecture, OS, and Version:
Cluster Configuration:
Any cluster configuration, using OpenID Direct Connect as the primary SSO setup. In our case, we're working with a KeyCloak setup.
Describe the bug:
Currently K3s fails to work with the "standalone mode" of oidc-login, where the kube.config file contains an Auth-provider section for the users. Trying to use any subcommand that requires a valid login will fail with the error:
'error: no Auth Provider found for name "oidc"'
Expected behavior:
Login through the normal oidc-login works correctly:
ludo@ludo-Nitro-Laptop:~/projects/k3s$ bin/k3s kubectl oidc-login
Opening in existing browser session.
You got a valid token until 2024-11-07 14:41:30 +0100 CET
Calling any other kubectl command through k3s should now use the succeeded authentication, for example allowing:
ludo@ludo-Nitro-Laptop:~/projects/k3s$ bin/k3s kubectl auth whoami
ATTRIBUTE VALUE
Username 6b3dbab6-f44c-45af-8b55-418ff6f0115c
Groups [default-roles-development system:authenticated]
Actual behavior:
The wrapped kubectl fails to use the succeeded authentication, reporting an error:
ludo@ludo-Nitro-Laptop:~/projects/k3s$ bin/k3s kubectl auth whoami
error: no Auth Provider found for name "oidc"
However, in comparison, the upstream kubectl cli command works correctly:
ludo@ludo-Nitro-Laptop:~/projects/k3s$ kubectl auth whoami
ATTRIBUTE VALUE
Username 6b3dbab6-f44c-45af-8b55-418ff6f0115c
Groups [default-roles-development system:authenticated]
Environmental Info:
K3s Version:
All Versions, tested in v1.28.5, v1.28.15 & v1.31.2
Node(s) CPU architecture, OS, and Version:
Cluster Configuration:
Any cluster configuration, using OpenID Direct Connect as the primary SSO setup. In our case, we're working with a KeyCloak setup.
Describe the bug:
Currently K3s fails to work with the "standalone mode" of oidc-login, where the kube.config file contains an Auth-provider section for the users. Trying to use any subcommand that requires a valid login will fail with the error:
'error: no Auth Provider found for name "oidc"'
The related PR (#11266) fixes this, and allows the usage of this oidc-login mode for the embedded kubectl library in K3s.
For background info on that oidc-login mode: https://github.com/int128/kubelogin/blob/master/docs/standalone-mode.md
That PR is a simple one-liner bugfix copied from the upstream kubectl-cli implementation.
Source of the fix: https://github.com/kubernetes/kubernetes/blob/master/cmd/kubectl/kubectl.go#L25
Steps To Reproduce:
Use an example kube.config like described in the kubelogin documentation:
Expected behavior:
Login through the normal oidc-login works correctly:
Calling any other kubectl command through k3s should now use the succeeded authentication, for example allowing:
Actual behavior:
The wrapped kubectl fails to use the succeeded authentication, reporting an error:
However, in comparison, the upstream kubectl cli command works correctly:
Additional context / logs:
Related PR with a proposed fix: #11266
The text was updated successfully, but these errors were encountered: