OC Login with A token.

[remchuk]

Hey!
I have looked thought the Docs and I saw that to use this module you first need to preform the oc login outside the script.

Is there a oc login build in this module?

I have found a different module called openshift-restclient-python, which has an option to login with OCPLoginConfiguration but it seems to only work with username and password.

I want to preform a simple:
oc login --token=TOKEN --server=APISERVER

Help would be appreciated, I'm really lost.

[bradmwilliams]

Hi @remchuk,
We don't have a specific method for token based login but, technically, it is possible with a custom Context() object. The real trick is making sure that this Context is always used as the "current context" (i.e. the last context)...

Something like this would work:

#!/usr/bin/python

import argparse
import traceback

import openshift_client as oc
from openshift_client import OpenShiftPythonException, Context

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description='OpenShift Client Example')
    parser.add_argument('-k', '--kubeconfig', help='The kubeconfig to create', required=True)
    parser.add_argument('-s', '--server', help='The API Server to communicate with', required=True)
    parser.add_argument('-t', '--token', help='The login token', required=True)
    args = vars(parser.parse_args())

    my_context = Context()
    my_context.token = args["token"]
    my_context.api_server = args["server"]
    my_context.kubeconfig_path = args["kubeconfig"]

    with oc.timeout(60 * 30), oc.tracking() as t, my_context:
        if oc.get_config_context() is None:
            print(f'Current context not set! Logging into API server: {args["server"]}\n')
            try:
                oc.invoke('login')
            except OpenShiftPythonException:
                print('error occurred logging into API Server')
                traceback.print_exc()
                print(f'Tracking:\n{t.get_result().as_json(redact_streams=False)}\n\n')
                exit(1)

        print(f'Current context: {oc.get_config_context()}')

        try:
            pods = oc.selector('pods').objects()
            print(f'Found: {len(pods)} pods')
        except OpenShiftPythonException:
            print('Error occurred getting pods')
            traceback.print_exc()
            print(f'Tracking:\n{t.get_result().as_json(redact_streams=False)}\n\n')

As an alternative, you could bypass the API Server and Kubeconfig parameters by relying on the Environment variables that are checked during initialization:

        self.default_kubeconfig_path = os.getenv("OPENSHIFT_CLIENT_PYTHON_DEFAULT_CONFIG_PATH", None)
        self.default_api_server = os.getenv("OPENSHIFT_CLIENT_PYTHON_DEFAULT_API_SERVER", None)
        self.default_token = None  # Does not support environment variable injection to discourage this insecure practice

However, as the comment above states Token injection is discouraged. So, the original approach would still be required as well.

Hope this helps!

[remchuk]

I will give it a try and let you know!

Is OpenID authentication is something planned in the future?

[bradmwilliams]

We currently do not have any plans on adding OpenID authentication support to this library. It's a complicated interaction that ultimately relies largely on cluster configuration that we, as a "client", simply will not be able to complete without the user feeding us the necessary information anyway. So, instead, we have chosen to require that all be setup before attempting to use this library.