Add oidc auth

[ltamaster]

No description provided.

[dmyerscough]

Hi @ltamaster you will want to run the following against the files you modified:-

$ pip install pycodestyle
$ pycodestyle ...

The Travis CI is failing due to coding style errors.

[ltamaster]

@dmyerscough thanks, I will try

[mcalmer]

JFYI: I tried this patch and it works fine against our kubernetes cluster. Seems that only one unit test is failing. Maybe the last thing what prevents this PR from being merged.

[codecov-io]

Codecov Report

Merging #48 into master will decrease coverage by 0.35%.
The diff coverage is 86.3%.

@@            Coverage Diff             @@
##           master      #48      +/-   ##
==========================================
- Coverage   93.64%   93.29%   -0.36%     
==========================================
  Files          11       11              
  Lines         866      939      +73     
==========================================
+ Hits          811      876      +65     
- Misses         55       63       +8

Impacted Files	Coverage Δ
config/kube_config_test.py	93.1% <100%> (+0.58%)	⬆️
config/kube_config.py	89.69% <79.16%> (-2.37%)	⬇️
config/dateutil.py	93.33% <0%> (+4.44%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 11da619...5731554. Read the comment docs.

[dmyerscough]

Nice work @ltamaster, I just saw you message now and see you applied a fix to the unit test.

[ltamaster]

thanks @dmyerscough, finally I found the issue !!!

[mvle]

Re-posting comment here from closed PR #31. Seems to affect this new PR as well.

I apologize in advance if this is already supported, but from looking at the PR, I think there needs to be a way to refresh the token not only at configuration initialization time but also during invocation of the K8 API calls. The token might expire right before a call thus causing the call to fail with an authentication failure. This will be needed for services that run a long time and rely on being able to reach the K8 Api Server (also short services that happen to be unlucky).

I think this can be done with a check to 'exp' field in the id-token right before a call_api or catch a 401 return status and perform a refresh token operation and update the configuration object with the new id_token and refresh_token values from the OAuth server.

[mcalmer]

@roycaihw - what prevents this pr to get merged and added to 6.0.0?

[roycaihw]

I think this can be done with a check to 'exp' field in the id-token right before a call_api or catch a 401 return status and perform a refresh token operation and update the configuration object with the new id_token and refresh_token values from the OAuth server.

@mvle I agree that we need to ensure id_token (and also access_token for gcp) is valid and refresh as needed. However, currently swagger-codegen doesn't support refreshing token of OAuth2. Without upstream change, the generated client's support for refreshing token would be hacky. cc @yliaog for more insight here

what prevents this pr to get merged and added to 6.0.0?

@mcalmer Sorry I didn't get a chance to look at this yet. client-python is currently 6.0.0b1. This pr can still get in 6.0.0 which will get released after k8s 1.10 rolls out.

[yliaog]

i think the suggestion for refreshing token is fine, but can be done in a separate PR.

For this PR, I see many commits, @ltamaster could you please squash the commits?

[ltamaster]

Hi @yliaog I can do that, but I understand that I need a new PR for that right?

[yliaog]

i think you can use the same PR for squashing commits, so all the history can still be kept.

[yliaog]

not sure how you did it, did you try something like what's described here (https://eli.thegreenplace.net/2014/02/19/squashing-github-pull-requests-into-a-single-commit)

[ltamaster]

Hi @yliaog, finally I squashed the commits, please take a look.
Thanks
Luis

[yliaog]

thanks @ltamaster, this PR is merged. The remaining issues are tracked separately.

[yliaog]

@mvle could you please file another issue to track the feature request for refreshing token?

[ltamaster]

Hi @yliaog

I noticed this PR is merged, but it hasn't been merged on the client repo.

Are you waiting for the other issues or do I need something else?

Thanks
Luis

[roycaihw]

@ltamaster I was planning on updating the base submodule when we do the 6.0.0 release. PR is also welcome to do the update :) (e.g. kubernetes-client/python#475)