Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow setting impersonation extras #4189

Open
waterfoul opened this issue Jan 12, 2024 · 1 comment
Open

Allow setting impersonation extras #4189

waterfoul opened this issue Jan 12, 2024 · 1 comment

Comments

@waterfoul
Copy link

waterfoul commented Jan 12, 2024

Problem
When an aks cluster is setup with EntraId Auth and Azure RBAC you need to pass "extra:oid" in order for impersonation to work. This means weave gitops' impersonation will not work. Example:

kubectl get GitRepository -A --as "[email protected]"

Results in

Error from server (Forbidden): gitrepositories.source.toolkit.fluxcd.io is forbidden: User "[email protected]" cannot list resource "gitrepositories" in API group "source.toolkit.fluxcd.io" at the cluster scope: Azure does not have opinion for this non AAD user. If you are an AAD user, please set Extra:oid parameter for impersonated user in the kubeconfig

If you create a user in your kubeconfig with

  user:
    as: [email protected]
    as-user-extra:
      oid:
      - 00000000-0000-0000-0000-000000000000

along with the normal user config and use it the (via a new context) it works

Solution
I'd like a feature to be able to map oidc claims to impersonation extras

Workaround
I added oidcGroupsPrefix: "weave:" to my issuer secret then manually configured RBAC for specific groups using things like the following yaml. Not ideal since the whole point of using Azure RBAC is to centralize this sort of thing

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: weave-global-admin
subjects:
- kind: Group
  name: weave:00000000-0000-0000-0000-000000000000
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin

Additional context

@bigkevmcd
Copy link
Contributor

Simple implementation could accept a set of keys to lookup in the OIDC ID Token and store these on the UserPrincipal as a map.

It's a bit tricky because the values for the the Extra data are slices of strings, so, similar to the existing code, you'd need to parse these as strings or slices of strings, and convert the string to a slice when necessary.

Then inject these here

func ConfigWithPrincipal(user *auth.UserPrincipal, config *rest.Config, userPrefixes UserPrefixes) *rest.Config {
into the ImpersonationConfig.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants