sso aspnet application and kubernetes - token delegation about csharp HOT 6 CLOSED

How are you passing the token through to this client?

from csharp.

token is extracted from aspnet core httpcontext.
below snippet show how the client is initialized
var config = new KubernetesClientConfiguration { // Set your Kubernetes API server endpoint Host = "<cluster-url>", // Set other configuration options as needed SslCaCerts = new X509Certificate2Collection(new[] { new X509Certificate2(Encoding.UTF8.GetBytes( "<CA-CERT>")), }), AccessToken = "<access-token>" }; var client = new Kubernetes(config);

from csharp.

by setting accesstoken, client will send http request with http header Bearer <token>
you mean server side rejected your token?

from csharp.

Yes, the token was rejected as an invalid token appears in cluster logs(k3s) and the api call retuned 401.

I configured the kubectl oidc login plugin and the aspnet core app to use the same oidc client config on keycloak.

I'll try to setup github repo to share the poc code.

from csharp.

Easiest thing to do if you can is to try to export this as a YAML kubeconfig.

If kubectl ... with that kubeconfig file works, and this client doesn't work, then it's definitely a bug in this client.

If kubectl ... doesn't work, it's likely an issue with the token.

from csharp.

It was related to the token, it worked when the audience is correctly set, although it works with oidc login without audience.

from csharp.