OC Login with A token.

[remchuk]

Hey!
I have looked thought the Docs and I saw that to use this module you first need to preform the oc login outside the script.

Is there a oc login build in this module?

I have found a different module called openshift-restclient-python, which has an option to login with OCPLoginConfiguration but it seems to only work with username and password.

I want to preform a simple:
oc login --token=TOKEN --server=APISERVER

Help would be appreciated, I'm really lost.

[bradmwilliams]

Hi @remchuk,
We don't have a specific method for token based login but, technically, it is possible with a custom Context() object. The real trick is making sure that this Context is always used as the "current context" (i.e. the last context)...

Something like this would work:

#!/usr/bin/pythonimportargparseimporttracebackimportopenshift_clientasocfromopenshift_clientimportOpenShiftPythonException, Contextif__name__=='__main__':
parser=argparse.ArgumentParser(description='OpenShift Client Example')
parser.add_argument('-k', '--kubeconfig', help='The kubeconfig to create', required=True)
parser.add_argument('-s', '--server', help='The API Server to communicate with', required=True)
parser.add_argument('-t', '--token', help='The login token', required=True)
args=vars(parser.parse_args())
my_context=Context()
my_context.token=args["token"]
my_context.api_server=args["server"]
my_context.kubeconfig_path=args["kubeconfig"]
withoc.timeout(60*30), oc.tracking() ast, my_context:
ifoc.get_config_context() isNone:
print(f'Current context not set! Logging into API server: {args["server"]}\n')
try:
oc.invoke('login')
exceptOpenShiftPythonException:
print('error occurred logging into API Server')
traceback.print_exc()
print(f'Tracking:\n{t.get_result().as_json(redact_streams=False)}\n\n')
exit(1)
print(f'Current context: {oc.get_config_context()}')
try:
pods=oc.selector('pods').objects()
print(f'Found: {len(pods)} pods')
exceptOpenShiftPythonException:
print('Error occurred getting pods')
traceback.print_exc()
print(f'Tracking:\n{t.get_result().as_json(redact_streams=False)}\n\n')

As an alternative, you could bypass the API Server and Kubeconfig parameters by relying on the Environment variables that are checked during initialization:

self.default_kubeconfig_path=os.getenv("OPENSHIFT_CLIENT_PYTHON_DEFAULT_CONFIG_PATH", None)
self.default_api_server=os.getenv("OPENSHIFT_CLIENT_PYTHON_DEFAULT_API_SERVER", None)
self.default_token=None# Does not support environment variable injection to discourage this insecure practice

However, as the comment above states Token injection is discouraged. So, the original approach would still be required as well.

Hope this helps!

[remchuk]

I will give it a try and let you know!

Is OpenID authentication is something planned in the future?

[bradmwilliams]

We currently do not have any plans on adding OpenID authentication support to this library. It's a complicated interaction that ultimately relies largely on cluster configuration that we, as a "client", simply will not be able to complete without the user feeding us the necessary information anyway. So, instead, we have chosen to require that all be setup before attempting to use this library.