{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/54421","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/54421/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/54421/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/54421/events","html_url":"https://github.com/kubernetes/kubernetes/pull/54421","id":267738919,"number":54421,"title":"Support for the use of OIDC authorization codes in kubeconfig.","user":{"login":"kfox1111","id":1513154,"avatar_url":"https://avatars0.githubusercontent.com/u/1513154?v=4","gravatar_id":"","url":"https://api.github.com/users/kfox1111","html_url":"https://github.com/kfox1111","followers_url":"https://api.github.com/users/kfox1111/followers","following_url":"https://api.github.com/users/kfox1111/following{/other_user}","gists_url":"https://api.github.com/users/kfox1111/gists{/gist_id}","starred_url":"https://api.github.com/users/kfox1111/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kfox1111/subscriptions","organizations_url":"https://api.github.com/users/kfox1111/orgs","repos_url":"https://api.github.com/users/kfox1111/repos","events_url":"https://api.github.com/users/kfox1111/events{/privacy}","received_events_url":"https://api.github.com/users/kfox1111/received_events","type":"User","site_admin":false},"labels":[{"id":477397086,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":200149833,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note","name":"release-note","color":"c2e0c6","default":false},{"id":357119284,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/auth","name":"sig/auth","color":"d2b48c","default":false},{"id":618574759,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/ui","name":"sig/ui","color":"d2b48c","default":false},{"id":253450934,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/M","name":"size/M","color":"eebb00","default":false}],"state":"open","locked":false,"assignee":{"login":"ericchiang","id":2342749,"avatar_url":"https://avatars1.githubusercontent.com/u/2342749?v=4","gravatar_id":"","url":"https://api.github.com/users/ericchiang","html_url":"https://github.com/ericchiang","followers_url":"https://api.github.com/users/ericchiang/followers","following_url":"https://api.github.com/users/ericchiang/following{/other_user}","gists_url":"https://api.github.com/users/ericchiang/gists{/gist_id}","starred_url":"https://api.github.com/users/ericchiang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericchiang/subscriptions","organizations_url":"https://api.github.com/users/ericchiang/orgs","repos_url":"https://api.github.com/users/ericchiang/repos","events_url":"https://api.github.com/users/ericchiang/events{/privacy}","received_events_url":"https://api.github.com/users/ericchiang/received_events","type":"User","site_admin":false},"assignees":[{"login":"ericchiang","id":2342749,"avatar_url":"https://avatars1.githubusercontent.com/u/2342749?v=4","gravatar_id":"","url":"https://api.github.com/users/ericchiang","html_url":"https://github.com/ericchiang","followers_url":"https://api.github.com/users/ericchiang/followers","following_url":"https://api.github.com/users/ericchiang/following{/other_user}","gists_url":"https://api.github.com/users/ericchiang/gists{/gist_id}","starred_url":"https://api.github.com/users/ericchiang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericchiang/subscriptions","organizations_url":"https://api.github.com/users/ericchiang/orgs","repos_url":"https://api.github.com/users/ericchiang/repos","events_url":"https://api.github.com/users/ericchiang/events{/privacy}","received_events_url":"https://api.github.com/users/ericchiang/received_events","type":"User","site_admin":false}],"milestone":null,"comments":9,"created_at":"2017-10-23T16:44:34Z","updated_at":"2018-02-24T09:03:50Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/54421","html_url":"https://github.com/kubernetes/kubernetes/pull/54421","diff_url":"https://github.com/kubernetes/kubernetes/pull/54421.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/54421.patch"},"body":"This PR adds support for not having to manually fetch the id and\r\nrefresh tokens but instead use an authorization code to fetch the\r\ntokens.\r\n\r\nIt can be used like the following:\r\n\r\nkubectl config set-credentials \"minikube\" \\\r\n  --auth-provider=oidc \\\r\n  --auth-provider-arg=client-id=kubernetes \\\r\n  --auth-provider-arg=client-secret=xxxxx  \\\r\n  --auth-provider-arg=idp-issuer-url=https://<yourprovider> \\\r\n  --auth-provider-arg=authorization-code=<authcodefromprovider>\r\n\r\nOn first kubectl request to the apiserver, it will replace the\r\nauthorization-code in the config file with a valid id token, and\r\nif authorized, a refresh token.\r\n\r\nThis significantly cuts down on the effort an end user needs to\r\ndo in order to setup OIDC. It also enhances security by letting\r\nthe user not have to handle the tokens themselves.\r\n\r\n<!--  Thanks for sending a pull request!  Here are some tips for you:\r\n1. If this is your first time, read our contributor guidelines https://git.k8s.io/community/contributors/devel/pull-requests.md#the-pr-submit-process and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide\r\n2. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/devel/pull-requests.md#best-practices-for-faster-reviews\r\n3. Follow the instructions for writing a release note: https://git.k8s.io/community/contributors/devel/pull-requests.md#write-release-notes-if-needed\r\n-->\r\n\r\n**What this PR does / why we need it**:\r\n\r\n**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #\r\n\r\n**Special notes for your reviewer**:\r\n\r\n**Release note**:\r\n<!--  Steps to write your release note:\r\n1. Use the release-note-* labels to set the release note state (if you have access)\r\n2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`.\r\n-->\r\n```release-note\r\noidc authorization-code support was added to allow kubectl to directly consume an oidc authorization code. This greatly simplifies the setup of oidc.\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/368213347","html_url":"https://github.com/kubernetes/kubernetes/pull/54421#issuecomment-368213347","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/54421","id":368213347,"user":{"login":"fejta-bot","id":30488982,"avatar_url":"https://avatars1.githubusercontent.com/u/30488982?v=4","gravatar_id":"","url":"https://api.github.com/users/fejta-bot","html_url":"https://github.com/fejta-bot","followers_url":"https://api.github.com/users/fejta-bot/followers","following_url":"https://api.github.com/users/fejta-bot/following{/other_user}","gists_url":"https://api.github.com/users/fejta-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/fejta-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fejta-bot/subscriptions","organizations_url":"https://api.github.com/users/fejta-bot/orgs","repos_url":"https://api.github.com/users/fejta-bot/repos","events_url":"https://api.github.com/users/fejta-bot/events{/privacy}","received_events_url":"https://api.github.com/users/fejta-bot/received_events","type":"User","site_admin":false},"created_at":"2018-02-24T09:03:50Z","updated_at":"2018-02-24T09:03:50Z","author_association":"NONE","body":"Issues go stale after 90d of inactivity.\nMark the issue as fresh with `/remove-lifecycle stale`.\nStale issues rot after an additional 30d of inactivity and eventually close.\n\nIf this issue is safe to close now please do so with `/close`.\n\nSend feedback to sig-testing, kubernetes/test-infra and/or [fejta](https://github.com/fejta).\n/lifecycle stale"}}
{"actor":{"display_login":"fejta-bot"}}