Skip to content

[v14] Fix Azure Identity federated Application ID #33960

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tigrato merged 1 commit into from
Oct 30, 2023
Merged

[v14] Fix Azure Identity federated Application ID #33960

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 23 additions & 9 deletions lib/cloud/azure/kubernetes.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -261,7 +261,6 @@ func (c *aksClient) ClusterCredentials(ctx context.Context, cfg ClusterCredentia
default:
return nil, time.Time{}, trace.BadParameter("unsupported AKS authentication mode %v", clusterDetails.Properties.AccessConfig)
}

}

// getAzureRBACCredentials generates a config to access the cluster.
Expand All @@ -279,7 +278,7 @@ func (c *aksClient) getAzureRBACCredentials(ctx context.Context, cluster Cluster
}

if err := c.checkAccessPermissions(ctx, cfg, cluster); err != nil {
return nil, time.Time{}, trace.WrapWithMessage(err, `Azure RBAC rules have not been configured for the agent.
return nil, time.Time{}, trace.WrapWithMessage(err, `Azure RBAC rules have not been configured for the agent.
Please check that you have configured them correctly.`)
}

Expand All @@ -300,7 +299,6 @@ func (c *aksClient) getUserCredentials(ctx context.Context, cfg ClusterCredentia

result, err := c.getRestConfigFromKubeconfigs(res.Kubeconfigs)
return result, trace.Wrap(err)

}

// getAzureADCredentials gets the client configuration and checks if Kubernetes RBAC is configured.
Expand Down Expand Up @@ -378,7 +376,6 @@ func (c *aksClient) getAdminCredentials(ctx context.Context, group, name string)
}
result, err = checkIfAuthMethodIsUnSupported(result)
return result, trace.Wrap(err)

}

// getRestConfigFromKubeconfigs parses the first kubeConfig returned by ListClusterAdminCredentials and
Expand Down Expand Up @@ -433,17 +430,35 @@ func (c *aksClient) genAzureToken(ctx context.Context, tentantID string) (string
return "", time.Time{}, trace.Wrap(ConvertResponseError(err))
}

cliAccessToken, err := cred.GetToken(ctx, policy.TokenRequestOptions{
cliAccessToken, origErr := cred.GetToken(ctx, policy.TokenRequestOptions{
// azureManagedClusterScope is a fixed scope that identifies azure AKS managed clusters.
Scopes: []string{azureManagedClusterScope},
},
)
if origErr == nil {
return cliAccessToken.Token, cliAccessToken.ExpiresOn, nil
}

// Some azure credentials like Workload Identity - but not all - require the
// scope to be suffixed with /.default.
// Since the AZ identity returns a chained credentials provider
// that tries to get the token from any of the configured providers but doesn't
// expose which provider was used, we retry the token generation with the
// the expected scope.
// In the case of this attempt doesn't return any valid credential, we return
// the original error.
cliAccessToken, err = cred.GetToken(
ctx,
policy.TokenRequestOptions{
// azureManagedClusterScope is a fixed scope that identifies azure AKS managed clusters.
Scopes: []string{azureManagedClusterScope + "/.default"},
},
)
if err != nil {
return "", time.Time{}, trace.Wrap(ConvertResponseError(err))
// use the original error since it's clear.
return "", time.Time{}, trace.Wrap(ConvertResponseError(origErr))
}

return cliAccessToken.Token, cliAccessToken.ExpiresOn, nil

}

// grantAccessWithAdminCredentials tries to create the ClusterRole and ClusterRoleBinding into the AKS cluster
Expand All @@ -460,7 +475,6 @@ func (c *aksClient) grantAccessWithAdminCredentials(ctx context.Context, adminCf

err = c.upsertClusterRoleBindingWithAdminCredentials(ctx, client, groupID)
return trace.Wrap(err)

}

// upsertClusterRoleWithAdminCredentials tries to upsert the ClusterRole using admin credentials.
Expand Down