Skip to content

feat(ske): support stateless WIF kubeconfig login - #1477

Open
Galin-Karabadzhakov wants to merge 23 commits into
stackitcloud:mainfrom
Galin-Karabadzhakov:feat/support-wif-ske-exec
Open

feat(ske): support stateless WIF kubeconfig login#1477
Galin-Karabadzhakov wants to merge 23 commits into
stackitcloud:mainfrom
Galin-Karabadzhakov:feat/support-wif-ske-exec

Conversation

@Galin-Karabadzhakov

@Galin-Karabadzhakov Galin-Karabadzhakov commented Jul 15, 2026

Copy link
Copy Markdown

Description

Enable stackit ske kubeconfig login --idp to operate as a stateless Kubernetes exec credential provider using STACKIT Workload Identity Federation.

Kubernetes clients do not always include cluster information in KUBERNETES_EXEC_INFO, and in-cluster workloads should not require persisted CLI credentials or cache state.

This change:

  • Adds explicit cluster and organization flags as fallbacks when exec cluster information is omitted.
  • Uses the existing global project and region configuration.
  • Automatically detects the projected SKE workload identity token or STACKIT_FEDERATED_TOKEN_FILE.
  • Obtains a STACKIT access token through the SDK WIF flow.
  • Exchanges the access token for an SKE cluster IdP token without requiring authentication storage.
  • Supports stateless authentication through STACKIT_ACCESS_TOKEN.
  • Preserves existing kubeconfig and cache behavior for non-stateless authentication.
  • Adds documentation and unit coverage for the new flows.

Relates to #1327.

This is complementary to #1424, which introduces general WIF authentication support.

Validation

  • make fmt
  • make generate-docs
  • make lint
  • make build
  • go test ./internal/pkg/auth ./internal/cmd/ske/kubeconfig/login
  • Live SKE validation using a projected workload identity, read-only root filesystem, and no persisted home directory

The repository-wide make test currently reports two unrelated failures that were reproduced on an unchanged main checkout.

Checklist

  • Issue was linked above
  • Code format was applied: make fmt
  • Examples were added or adjusted
  • Docs are up-to-date: make generate-docs
  • Unit tests were implemented or updated
  • Affected unit tests are passing
  • No linter issues: make lint

@Galin-Karabadzhakov
Galin-Karabadzhakov marked this pull request as ready for review July 16, 2026 13:51
@Galin-Karabadzhakov
Galin-Karabadzhakov requested a review from a team as a code owner July 16, 2026 13:51
@github-actions

github-actions Bot commented Jul 30, 2026

Copy link
Copy Markdown

This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it.

@github-actions github-actions Bot added the Stale label Jul 30, 2026
@Galin-Karabadzhakov
Galin-Karabadzhakov marked this pull request as draft July 30, 2026 07:47
@Galin-Karabadzhakov
Galin-Karabadzhakov marked this pull request as ready for review July 30, 2026 07:47
@Galin-Karabadzhakov

Galin-Karabadzhakov commented Jul 30, 2026

Copy link
Copy Markdown
Author

Hi team, could you please confirm whether this approach aligns with the intended direction for non-interactive SKE authentication?
I have validated the implementation with workload identity federation and credential renewal in a Kubernetes exec credential flow. It allows stateless, short-lived authentication without storing bearer tokens or service-account keys.
If a different command structure or authentication integration is preferred, I would be happy to adjust the implementation. A brief direction from the maintainers would help us move this forward and avoid duplicating functionality outside the CLI.

@github-actions github-actions Bot removed the Stale label Jul 31, 2026
@github-actions

github-actions Bot commented Aug 12, 2026

Copy link
Copy Markdown

This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it.

@github-actions github-actions Bot added the Stale label Aug 12, 2026
@GokceGK GokceGK removed the Stale label Aug 18, 2026
@Fyusel Fyusel mentioned this pull request Aug 19, 2026
Open
SerseusWasTaken
SerseusWasTaken reviewed Aug 21, 2026
View reviewed changes
Comment thread internal/cmd/ske/kubeconfig/login/login.go
Comment thread internal/pkg/auth/utils.go
marceljk
marceljk reviewed Sep 2, 2026
View reviewed changes
Comment thread internal/cmd/ske/kubeconfig/login/login.go
marceljk
marceljk reviewed Sep 2, 2026
View reviewed changes
Comment thread internal/cmd/ske/kubeconfig/login/login.go Outdated
marceljk
marceljk reviewed Sep 2, 2026
View reviewed changes
Comment thread internal/cmd/ske/kubeconfig/login/login.go Outdated
Galin-Karabadzhakov
Galin-Karabadzhakov commented Sep 3, 2026
View reviewed changes

@Galin-Karabadzhakov Galin-Karabadzhakov left a comment

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the review. All requested changes have now been addressed:

  • Explicit flags/global configuration take precedence over KUBERNETES_EXEC_INFO, which remains the fallback.
  • auth.OIDCTokenFunc() is used for workload-identity detection and SDK WIF configuration.
  • Static tokens, configured token files, GitHub Actions, Azure DevOps, and Kubernetes projected-token fallback are covered.
  • Stateless IdP endpoint discovery avoids authentication storage.
    Validation completed successfully with focused unit tests, go vet, and make lint. Please re-review when convenient.

marceljk
marceljk reviewed Sep 4, 2026
View reviewed changes
Comment thread internal/cmd/ske/kubeconfig/login/login.go
Galin-Karabadzhakov
Galin-Karabadzhakov commented Sep 4, 2026
View reviewed changes

@Galin-Karabadzhakov Galin-Karabadzhakov left a comment

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Implemented and pushed commit 3de94aa to PR #1477.

Changes:

  • Explicit flags override all sources.
  • KUBERNETES_EXEC_INFO overrides global CLI configuration.
  • Global configuration fills missing exec values.
  • Added tests for all four precedence combinations.
  • Added the precedence table to CLI help and generated docs.

SKE tests, vet, docs check, and lint pass. Full tests only encountered an unrelated ANSI-color snapshot failure in the CDN package.

marceljk
marceljk reviewed Sep 4, 2026
View reviewed changes

@marceljk marceljk left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your contribution!
Left only one nitpick comment, and besides that, it looks good from my side.

Comment thread internal/cmd/ske/kubeconfig/login/login.go
Galin-Karabadzhakov
Galin-Karabadzhakov commented Sep 7, 2026
View reviewed changes

@Galin-Karabadzhakov Galin-Karabadzhakov left a comment

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the review. Agreed on the final formatting nitpick. I’ll align the table for terminal output and regenerate the documentation. No functional changes are required.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marceljk marceljk marceljk left review comments
@SerseusWasTaken SerseusWasTaken SerseusWasTaken left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

has internal tracking issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Galin-Karabadzhakov @marceljk @SerseusWasTaken @Fyusel @GokceGK