{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/25270","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/25270/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/25270/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/25270/events","html_url":"https://github.com/kubernetes/kubernetes/pull/25270","id":153503603,"number":25270,"title":"Implement OIDC client AuthProvider","user":{"login":"bobbyrullo","id":9629,"avatar_url":"https://avatars.githubusercontent.com/u/9629?v=3","gravatar_id":"","url":"https://api.github.com/users/bobbyrullo","html_url":"https://github.com/bobbyrullo","followers_url":"https://api.github.com/users/bobbyrullo/followers","following_url":"https://api.github.com/users/bobbyrullo/following{/other_user}","gists_url":"https://api.github.com/users/bobbyrullo/gists{/gist_id}","starred_url":"https://api.github.com/users/bobbyrullo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bobbyrullo/subscriptions","organizations_url":"https://api.github.com/users/bobbyrullo/orgs","repos_url":"https://api.github.com/users/bobbyrullo/repos","events_url":"https://api.github.com/users/bobbyrullo/events{/privacy}","received_events_url":"https://api.github.com/users/bobbyrullo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/lgtm","name":"lgtm","color":"15dd18"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/ok-to-merge","name":"ok-to-merge","color":"fbca04"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note","name":"release-note","color":"c2e0c6"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/XXL","name":"size/XXL","color":"ee0000"}],"state":"open","locked":false,"assignee":{"login":"yifan-gu","id":3278588,"avatar_url":"https://avatars.githubusercontent.com/u/3278588?v=3","gravatar_id":"","url":"https://api.github.com/users/yifan-gu","html_url":"https://github.com/yifan-gu","followers_url":"https://api.github.com/users/yifan-gu/followers","following_url":"https://api.github.com/users/yifan-gu/following{/other_user}","gists_url":"https://api.github.com/users/yifan-gu/gists{/gist_id}","starred_url":"https://api.github.com/users/yifan-gu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yifan-gu/subscriptions","organizations_url":"https://api.github.com/users/yifan-gu/orgs","repos_url":"https://api.github.com/users/yifan-gu/repos","events_url":"https://api.github.com/users/yifan-gu/events{/privacy}","received_events_url":"https://api.github.com/users/yifan-gu/received_events","type":"User","site_admin":false},"milestone":null,"comments":26,"created_at":"2016-05-06T17:47:44Z","updated_at":"2016-05-18T23:44:32Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/25270","html_url":"https://github.com/kubernetes/kubernetes/pull/25270","diff_url":"https://github.com/kubernetes/kubernetes/pull/25270.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/25270.patch"},"body":"@erictune @cjcullen @liggitt @sym3tri @philips @ericchiang \r\n\r\nfixes #18549 \r\n\r\n```release-note\r\nWith this PR, kubectl and other RestClient's using the AuthProvider framework can make OIDC authenticated requests, and, if there is a refresh token present, the tokens will be refreshed as needed.\r\n```\r\n\r\n[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/220190330","html_url":"https://github.com/kubernetes/kubernetes/pull/25270#issuecomment-220190330","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/25270","id":220190330,"user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"created_at":"2016-05-18T23:44:32Z","updated_at":"2016-05-18T23:44:32Z","body":"I did an offline design discussion with @philips @bobbyrullo @sym3tri and I understand better how this PR will work.\r\n\r\nThey explained how my previous concerns were satisfied by this PR.\r\n - not using wierd apiserver refresh flow that seemed not OIDC compliant to me (at least to the spirit of the law)\r\n- not assuming a single client_secret for all instances of `kubectl`.\r\n- it will work with many IdPs, depending on how you configure it.  different IdPs will support different modes.\r\n - they are going to document several ways to use this with different IdP implementations.  \r\n\r\nI am now fine with keeping the name the same.\r\n\r\nI don't have time to review before deadine. I asked @sym3tri to review @bobbyrullo code, and @yifan-gu to manage the LGTM labels.\r\n\r\nWays to use this, as I now understand it:\r\n\r\n1. a single client_id/client_secret\r\n    - should work with any IdP\r\n    - typically for use in a single organization where there is not a need to separately track clients (apps),\r\n      and where redirect URL attacks are protected by localhost redirect and the corporation restricting\r\n      what software can run on the nodes to avoid redirect-url-MITMs.\r\n    - client_id/secret is distributed as part of introducing users to the cluster (e.g. email telling you what to put in your .kube/config \r\n    - using same client_id for kubectl and apiserver\r\n    - with a single client_id allocated for the company/team and distributed offline ; for  I am okay with the design and \r\n2. cross-client on Google\r\n  - client_id for kubectl and different client_id for apiserver.\r\n  - since Google only supports same-project client-ids, this is probably for a single organization, but they can at least get some benefit from the apiserver client_secret being confidential\r\n  - other IdP may not support cross-client today, but maybe someday.\r\n3. cross-client on Dex\r\n - CoreOS working on something for Dex similar to Google cross-client  \r\n - they plan to have good setup instructions in open source for Dex + Kubernetes, and for it to be a top choice as an on-prem IdP.\r\n  - they may have a consent flow that is more customized to the kubernetes use case.\r\n\r\nSo, users have multiple IdP choices and the flow is OIDC-compliant.\r\n"}}