Skip to content

Commit bd07cfe

Browse files
vineeth-thummavithumma
andauthored
Add encrypted caching support for PoP token flow (#676)
* draft of pop caching * draft of pop caching * update * rebase * pop token + ropc * update remaiing interfaces * fix UTs * pop token + ropc * pop token + ropc * address comments * address comments * add missing UTs * fix UTs * fix build & nit comments * fix build * fix styling * use a separate file to cache msal token * update caching structure * adapt azidentity implementation for kubelogin pop token caching * fix build * resole comments * resolve comments * resolve comments * changes to use same rsa key across runs, refactor & UT updates * make popkey a parameter for token acquisition methods * update UTs * use secure accessor for storing pop keys --------- Co-authored-by: vithumma <vithumma@microsoft.com>
1 parent 58e6acb commit bd07cfe

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+1696
-264
lines changed

.github/workflows/build.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,14 +76,14 @@ jobs:
7676
GOARCH: arm
7777
GOARM: "7"
7878
CGO_ENABLED: 0
79-
79+
8080
- name: Build Windows AMD64
8181
run: make
8282
env:
8383
GOOS: windows
8484
GOARCH: amd64
8585
CGO_ENABLED: 0
86-
86+
8787
- name: Build Windows ARM64
8888
run: make
8989
env:

CHANGELOG.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -438,4 +438,4 @@
438438
- ignore docs and readme on some workflows by @weinong in https://github.com/Azure/kubelogin/pull/248
439439
- Add reference to a context. by @Tatsinnit in https://github.com/Azure/kubelogin/pull/253
440440
- How to install kubelogin with asdf tool manager by @daveneeley in https://github.com/Azure/kubelogin/pull/256
441-
- Update devicecode.md by @madhurgupta03 in https://github.com/Azu
441+
- Update devicecode.md by @madhurgupta03 in https://github.com/Azure/kubelogin/pull/266

CODE_OF_CONDUCT.md

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
# Microsoft Open Source Code of Conduct
2-
3-
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
4-
5-
Resources:
6-
7-
- [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/)
8-
- [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/)
9-
- Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns
1+
# Microsoft Open Source Code of Conduct
2+
3+
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
4+
5+
Resources:
6+
7+
- [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/)
8+
- [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/)
9+
- Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns

README.md

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,33 @@
1-
# kubelogin
2-
3-
[![Go Report Card](https://goreportcard.com/badge/github.com/Azure/kubelogin)](https://goreportcard.com/report/github.com/Azure/kubelogin)
4-
[![golangci-lint](https://github.com/Azure/kubelogin/actions/workflows/golangci-lint.yml/badge.svg)](https://github.com/Azure/kubelogin/actions/workflows/golangci-lint.yml)
5-
[![Build on Push](https://github.com/Azure/kubelogin/actions/workflows/build.yml/badge.svg)](https://github.com/Azure/kubelogin/actions/workflows/build.yml)
6-
[![Go Reference](https://pkg.go.dev/badge/github.com/Azure/kubelogin.svg)](https://pkg.go.dev/github.com/Azure/kubelogin)
7-
[![codecov](https://codecov.io/gh/Azure/kubelogin/branch/main/graph/badge.svg?token=02PZRX59VM)](https://codecov.io/gh/Azure/kubelogin)
8-
9-
This is a [client-go credential (exec) plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) implementing azure authentication. This plugin provides features that are not available in kubectl. It is supported on kubectl v1.11+
10-
11-
Check out [the official doc page](https://azure.github.io/kubelogin/index.html) for more details
12-
13-
## Installation
14-
15-
https://azure.github.io/kubelogin/install.html
16-
17-
## Quick Start
18-
19-
https://azure.github.io/kubelogin/quick-start.html
20-
21-
## Contributing
22-
23-
This project welcomes contributions and suggestions. Most contributions require you to agree to a
24-
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
25-
the rights to use your contribution. For details, visit <https://cla.opensource.microsoft.com>.
26-
27-
When you submit a pull request, a CLA bot will automatically determine whether you need to provide
28-
a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions
29-
provided by the bot. You will only need to do this once across all repos using our CLA.
30-
31-
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
32-
For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
33-
contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
1+
# kubelogin
2+
3+
[![Go Report Card](https://goreportcard.com/badge/github.com/Azure/kubelogin)](https://goreportcard.com/report/github.com/Azure/kubelogin)
4+
[![golangci-lint](https://github.com/Azure/kubelogin/actions/workflows/golangci-lint.yml/badge.svg)](https://github.com/Azure/kubelogin/actions/workflows/golangci-lint.yml)
5+
[![Build on Push](https://github.com/Azure/kubelogin/actions/workflows/build.yml/badge.svg)](https://github.com/Azure/kubelogin/actions/workflows/build.yml)
6+
[![Go Reference](https://pkg.go.dev/badge/github.com/Azure/kubelogin.svg)](https://pkg.go.dev/github.com/Azure/kubelogin)
7+
[![codecov](https://codecov.io/gh/Azure/kubelogin/branch/main/graph/badge.svg?token=02PZRX59VM)](https://codecov.io/gh/Azure/kubelogin)
8+
9+
This is a [client-go credential (exec) plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) implementing azure authentication. This plugin provides features that are not available in kubectl. It is supported on kubectl v1.11+
10+
11+
Check out [the official doc page](https://azure.github.io/kubelogin/index.html) for more details
12+
13+
## Installation
14+
15+
https://azure.github.io/kubelogin/install.html
16+
17+
## Quick Start
18+
19+
https://azure.github.io/kubelogin/quick-start.html
20+
21+
## Contributing
22+
23+
This project welcomes contributions and suggestions. Most contributions require you to agree to a
24+
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
25+
the rights to use your contribution. For details, visit <https://cla.opensource.microsoft.com>.
26+
27+
When you submit a pull request, a CLA bot will automatically determine whether you need to provide
28+
a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions
29+
provided by the bot. You will only need to do this once across all repos using our CLA.
30+
31+
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
32+
For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
33+
contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.

SECURITY.md

Lines changed: 40 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,41 @@
1-
<!-- BEGIN MICROSOFT SECURITY.MD V0.0.4 BLOCK -->
2-
3-
## Security
4-
5-
Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin), and [our GitHub organizations](https://opensource.microsoft.com/).
6-
7-
If you believe you have found a security vulnerability in any Microsoft-owned repository that meets Microsoft's [Microsoft's definition of a security vulnerability](https://docs.microsoft.com/en-us/previous-versions/tn-archive/cc751383(v=technet.10)) of a security vulnerability, please report it to us as described below.
8-
9-
## Reporting Security Issues
10-
11-
**Please do not report security vulnerabilities through public GitHub issues.**
12-
13-
Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://msrc.microsoft.com/create-report).
14-
15-
If you prefer to submit without logging in, send email to [secure@microsoft.com](mailto:secure@microsoft.com). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://www.microsoft.com/en-us/msrc/pgp-key-msrc).
16-
17-
You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc).
18-
19-
Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
20-
21-
* Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
22-
* Full paths of source file(s) related to the manifestation of the issue
23-
* The location of the affected source code (tag/branch/commit or direct URL)
24-
* Any special configuration required to reproduce the issue
25-
* Step-by-step instructions to reproduce the issue
26-
* Proof-of-concept or exploit code (if possible)
27-
* Impact of the issue, including how an attacker might exploit the issue
28-
29-
This information will help us triage your report more quickly.
30-
31-
If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://microsoft.com/msrc/bounty) page for more details about our active programs.
32-
33-
## Preferred Languages
34-
35-
We prefer all communications to be in English.
36-
37-
## Policy
38-
39-
Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://www.microsoft.com/en-us/msrc/cvd).
40-
1+
<!-- BEGIN MICROSOFT SECURITY.MD V0.0.4 BLOCK -->
2+
3+
## Security
4+
5+
Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin), and [our GitHub organizations](https://opensource.microsoft.com/).
6+
7+
If you believe you have found a security vulnerability in any Microsoft-owned repository that meets Microsoft's [Microsoft's definition of a security vulnerability](https://docs.microsoft.com/en-us/previous-versions/tn-archive/cc751383(v=technet.10)) of a security vulnerability, please report it to us as described below.
8+
9+
## Reporting Security Issues
10+
11+
**Please do not report security vulnerabilities through public GitHub issues.**
12+
13+
Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://msrc.microsoft.com/create-report).
14+
15+
If you prefer to submit without logging in, send email to [secure@microsoft.com](mailto:secure@microsoft.com). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://www.microsoft.com/en-us/msrc/pgp-key-msrc).
16+
17+
You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc).
18+
19+
Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
20+
21+
* Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
22+
* Full paths of source file(s) related to the manifestation of the issue
23+
* The location of the affected source code (tag/branch/commit or direct URL)
24+
* Any special configuration required to reproduce the issue
25+
* Step-by-step instructions to reproduce the issue
26+
* Proof-of-concept or exploit code (if possible)
27+
* Impact of the issue, including how an attacker might exploit the issue
28+
29+
This information will help us triage your report more quickly.
30+
31+
If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://microsoft.com/msrc/bounty) page for more details about our active programs.
32+
33+
## Preferred Languages
34+
35+
We prefer all communications to be in English.
36+
37+
## Policy
38+
39+
Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://www.microsoft.com/en-us/msrc/cvd).
40+
4141
<!-- END MICROSOFT SECURITY.MD BLOCK -->

docs/book/src/README.md

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
1-
# Introduction
2-
3-
`kubelogin` is a [client-go credential (exec) plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) implementing azure authentication. This plugin provides features that are not available in kubectl. It is supported on kubectl v1.11+
4-
5-
## Features
6-
7-
- [interactive device code login](./concepts/login-modes/devicecode.md)
8-
- [interactive web browser login](./concepts/login-modes/interactive.md)
9-
- [non-interactive service principal login](./concepts/login-modes/sp.md)
10-
- [non-interactive user principal login](./concepts/login-modes/ropc.md) using [Resource owner login flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc)
11-
- [non-interactive managed service identity login](./concepts/login-modes/msi.md)
12-
- [non-interactive Azure CLI token login (AKS only)](./concepts/login-modes/azurecli.md)
13-
- [non-interactive Azure Developer CLI token login (AKS only)](./concepts/login-modes/azd.md)
14-
- [non-interactive workload identity login](./concepts/login-modes/workloadidentity.md)
1+
# Introduction
2+
3+
`kubelogin` is a [client-go credential (exec) plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) implementing azure authentication. This plugin provides features that are not available in kubectl. It is supported on kubectl v1.11+
4+
5+
## Features
6+
7+
- [interactive device code login](./concepts/login-modes/devicecode.md)
8+
- [interactive web browser login](./concepts/login-modes/interactive.md)
9+
- [non-interactive service principal login](./concepts/login-modes/sp.md)
10+
- [non-interactive user principal login](./concepts/login-modes/ropc.md) using [Resource owner login flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc)
11+
- [non-interactive managed service identity login](./concepts/login-modes/msi.md)
12+
- [non-interactive Azure CLI token login (AKS only)](./concepts/login-modes/azurecli.md)
13+
- [non-interactive Azure Developer CLI token login (AKS only)](./concepts/login-modes/azd.md)
14+
- [non-interactive workload identity login](./concepts/login-modes/workloadidentity.md)

docs/book/src/code-of-conduct.md

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
# Microsoft Open Source Code of Conduct
2-
3-
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
4-
5-
Resources:
6-
7-
- [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/)
8-
- [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/)
9-
- Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns
1+
# Microsoft Open Source Code of Conduct
2+
3+
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
4+
5+
Resources:
6+
7+
- [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/)
8+
- [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/)
9+
- Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns

docs/book/src/concepts/login-modes/interactive.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Web Browser Interactive
22

3-
This login mode will automatically open a browser to login the user.
3+
This login mode will automatically open a browser to login the user.
44
Once authenticated, the browser will redirect back to a local web server with access token.
55
The redirect URL can be set via `--redirect-url`.
66
This login mode complies with Conditional Access policy.
@@ -56,4 +56,4 @@ kubelogin remove-cache-dir
5656

5757
## References
5858

59-
- https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.interactivebrowsercredential?view=azure-python
59+
- https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.interactivebrowsercredential?view=azure-python

docs/book/src/development.md

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,46 @@
11
# Development
2+
3+
## Prerequisites
4+
5+
### System Dependencies
6+
7+
kubelogin uses secure token storage that requires platform-specific libraries:
8+
9+
#### Linux (Ubuntu/Debian)
10+
```bash
11+
sudo apt update
12+
sudo apt install libsecret-1-0 libsecret-1-dev
13+
```
14+
15+
#### Linux (CentOS/RHEL/Fedora)
16+
```bash
17+
# CentOS/RHEL
18+
sudo yum install libsecret-devel
19+
20+
# Fedora
21+
sudo dnf install libsecret-devel
22+
```
23+
24+
#### macOS
25+
No additional dependencies required (uses Keychain)
26+
27+
#### Windows
28+
No additional dependencies required (uses Windows Credential Manager)
29+
30+
### Go Dependencies
31+
- Go 1.23 or later
32+
- Make
33+
34+
## Building
35+
36+
```bash
37+
make build
38+
```
39+
40+
## Testing
41+
42+
```bash
43+
make test
44+
```
45+
46+
**Note**: Tests require the system dependencies listed above. If you encounter errors related to `libsecret-1.so` or "encrypted storage isn't possible", ensure the libsecret library is installed.

docs/book/src/install.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,4 +101,4 @@ if(-Not($oldPathArray -Contains "$targetDir")) {
101101
[System.Environment]::SetEnvironmentVariable("Path",$newPath,"User")
102102
$env:Path = [System.Environment]::GetEnvironmentVariable("Path","User"),[System.Environment]::GetEnvironmentVariable("Path","Machine") -join ";"
103103
}
104-
```
104+
```

0 commit comments

Comments
 (0)