{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/77360","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/77360/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/77360/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/77360/events","html_url":"https://github.com/kubernetes/kubernetes/issues/77360","id":439749528,"node_id":"MDU6SXNzdWU0Mzk3NDk1Mjg=","number":77360,"title":"SAML auth with vSphere and zones API not working","user":{"login":"rhockenbury","id":4368090,"node_id":"MDQ6VXNlcjQzNjgwOTA=","avatar_url":"https://avatars1.githubusercontent.com/u/4368090?v=4","gravatar_id":"","url":"https://api.github.com/users/rhockenbury","html_url":"https://github.com/rhockenbury","followers_url":"https://api.github.com/users/rhockenbury/followers","following_url":"https://api.github.com/users/rhockenbury/following{/other_user}","gists_url":"https://api.github.com/users/rhockenbury/gists{/gist_id}","starred_url":"https://api.github.com/users/rhockenbury/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhockenbury/subscriptions","organizations_url":"https://api.github.com/users/rhockenbury/orgs","repos_url":"https://api.github.com/users/rhockenbury/repos","events_url":"https://api.github.com/users/rhockenbury/events{/privacy}","received_events_url":"https://api.github.com/users/rhockenbury/received_events","type":"User","site_admin":false},"labels":[{"id":105146071,"node_id":"MDU6TGFiZWwxMDUxNDYwNzE=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/bug","name":"kind/bug","color":"e11d21","default":false},{"id":617149945,"node_id":"MDU6TGFiZWw2MTcxNDk5NDU=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/needs-sig","name":"needs-sig","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2019-05-02T19:26:04Z","updated_at":"2019-05-02T19:41:36Z","closed_at":null,"author_association":"NONE","body":"<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!\r\n\r\nIf the matter is security related, please disclose it privately via https://kubernetes.io/security/\r\n-->\r\n\r\n\r\n**What happened**:\r\n\r\nThe vSphere cloud provider is unable to fetch the node failure domain labels when using VCP with SAML auth because of an authentication failure.  For context, the SAML token auth is described here - https://vmware.github.io/vsphere-storage-for-kubernetes/documentation/saml-token-authentication.html.  SAML auth support for the zones api was introduced in this PR - https://github.com/kubernetes/kubernetes/pull/75515, which was cherry-picked to 1.14.1 here - https://github.com/kubernetes/kubernetes/pull/75742\r\n\r\nI've tested the credentials I'm using with govc to ensure that they work using the commands below:\r\n```\r\n$token = govc session.login -l -u vcenterdo -cert keys\\public.crt -key keys\\private.key -issue -debug\r\ngovc session.login -l -u vcenterdo -cert .\\keys\\public.crt -key .\\keys\\private.key -token \"$token\"\r\n```\r\nThe credentials also work fine when using VCP without the node labels feature. \r\n\r\nRelevant kubelet logs: \r\n```\r\nI0502 14:31:45.856013    5908 generic.go:189] GenericPLEG: Relisting\r\nI0502 14:31:46.775592    5908 connection.go:142] SessionManager.LoginByToken with certificate\r\nI0502 14:31:46.858589    5908 generic.go:189] GenericPLEG: Relisting\r\nI0502 14:31:46.916706    5908 connection.go:209] New session ID for 'VSPHERE.LOCAL\\k8s-vcp-dolap' = 52109852-8b67-9901-c095-6f21d8210c03\r\nI0502 14:31:47.162687    5908 datacenter.go:99] VirtualMachine:vm-82 host is HostSystem:host-65\r\nI0502 14:31:47.833807    5908 config.go:100] Looking for [api], have seen map[api:{}]\r\nI0502 14:31:47.833807    5908 kubelet.go:1972] SyncLoop (housekeeping)\r\nI0502 14:31:47.859584    5908 generic.go:189] GenericPLEG: Relisting\r\nI0502 14:31:48.693024    5908 cni.go:182] Using CNI configuration file C:\\k\\cni\\config\\cni.conf\r\nI0502 14:31:48.853838    5908 kubelet.go:2167] Container runtime status: Runtime Conditions: RuntimeReady=true reason: message:, NetworkReady=true reason: message:\r\nI0502 14:31:48.860848    5908 generic.go:189] GenericPLEG: Relisting\r\nI0502 14:31:49.833687    5908 config.go:100] Looking for [api], have seen map[api:{}]\r\nI0502 14:31:49.833687    5908 kubelet.go:1972] SyncLoop (housekeeping)\r\nI0502 14:31:49.863597    5908 generic.go:189] GenericPLEG: Relisting\r\nE0502 14:31:49.992408    5908 vsphere.go:1538] Get zone for node ul-win-node-5k: POST https://vcdo.production.com:443/rest/com/vmware/cis/session: 401 Unauthorized\r\nE0502 14:31:49.992408    5908 kubelet_node_status.go:68] Unable to construct v1.Node object for kubelet: failed to get zone from cloud provider: POST https://vcdo.production.com:443/rest/com/vmware/cis/session: 401 Unauthorized\r\nI0502 14:31:50.194250    5908 kubelet_node_status.go:283] Setting node annotation to enable volume controller attach/detach\r\nI0502 14:31:50.453104    5908 datacenter.go:99] VirtualMachine:vm-82 host is HostSystem:host-65\r\n```\r\n\r\n**What you expected to happen**:\r\nVCP should add failure domain labels to the node object.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\nSetup SAML auth for VCP with zone labeling enabled. \r\n\r\n**Anything else we need to know?**:\r\nThere was a previous issue that was raised (https://github.com/kubernetes/kubernetes/issues/75511) but that was before SAML auth support for zones was implemented.  \r\n\r\n**Environment**:\r\n- Kubernetes version (use `kubectl version`):\r\n1.14.1\r\n- Cloud provider or hardware configuration:\r\nvSphere\r\n- OS (e.g: `cat /etc/os-release`):\r\nLinux & Windows\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/488805446","html_url":"https://github.com/kubernetes/kubernetes/issues/77360#issuecomment-488805446","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/77360","id":488805446,"node_id":"MDEyOklzc3VlQ29tbWVudDQ4ODgwNTQ0Ng==","user":{"login":"imkin","id":2793249,"node_id":"MDQ6VXNlcjI3OTMyNDk=","avatar_url":"https://avatars1.githubusercontent.com/u/2793249?v=4","gravatar_id":"","url":"https://api.github.com/users/imkin","html_url":"https://github.com/imkin","followers_url":"https://api.github.com/users/imkin/followers","following_url":"https://api.github.com/users/imkin/following{/other_user}","gists_url":"https://api.github.com/users/imkin/gists{/gist_id}","starred_url":"https://api.github.com/users/imkin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/imkin/subscriptions","organizations_url":"https://api.github.com/users/imkin/orgs","repos_url":"https://api.github.com/users/imkin/repos","events_url":"https://api.github.com/users/imkin/events{/privacy}","received_events_url":"https://api.github.com/users/imkin/received_events","type":"User","site_admin":false},"created_at":"2019-05-02T19:41:36Z","updated_at":"2019-05-02T19:41:36Z","author_association":"CONTRIBUTOR","body":"/sig vmware"}}
{"actor":{"display_login":"imkin"}}