Skip to content

patch kubeconfig if token cannot be deleted via api #12962

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Feb 21, 2017
Merged

patch kubeconfig if token cannot be deleted via api #12962

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bf1f4e2
patch kubeconfig if token cannot be deleted via api
juanvallejo Feb 14, 2017
3c0eb53
Removed line breaks in glog messages
fabianofranz Feb 20, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 18 additions & 12 deletions pkg/cmd/cli/cmd/login/logout.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"fmt"
"io"

"github.com/golang/glog"
"github.com/spf13/cobra"

"k8s.io/kubernetes/pkg/client/restclient"
Expand Down Expand Up @@ -124,24 +125,29 @@ func (o LogoutOptions) RunLogout() error {
}

if err := client.OAuthAccessTokens().Delete(token); err != nil {
return err
glog.V(1).Infof("%v", err)
}

newConfig := *o.StartingKubeConfig
configErr := deleteTokenFromConfig(*o.StartingKubeConfig, o.PathOptions, token)
if configErr == nil {
glog.V(1).Infof("Removed token from your local configuration.")

// only return error instead of successful message if removing token from client
// config fails. Any error that occurs deleting token using api is logged above.
fmt.Fprintf(o.Out, "Logged %q out on %q\n", userInfo.Name, o.Config.Host)
}

return configErr
}

for key, value := range newConfig.AuthInfos {
if value.Token == token {
func deleteTokenFromConfig(config kclientcmdapi.Config, pathOptions *kclientcmd.PathOptions, bearerToken string) error {
for key, value := range config.AuthInfos {
if value.Token == bearerToken {
value.Token = ""
newConfig.AuthInfos[key] = value
config.AuthInfos[key] = value
// don't break, its possible that more than one user stanza has the same token.
}
}

if err := kclientcmd.ModifyConfig(o.PathOptions, newConfig, true); err != nil {
return err
}

fmt.Fprintf(o.Out, "Logged %q out on %q\n", userInfo.Name, o.Config.Host)

return nil
return kclientcmd.ModifyConfig(pathOptions, config, true)
}
9 changes: 9 additions & 0 deletions test/cmd/login.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,15 @@ os::cmd::expect_failure_and_text 'oc get pods' '"system:anonymous" cannot list p
# os::cmd::expect_failure_and_text "oc login '${KUBERNETES_MASTER}' -u test -p test '--config=${templocation}/file' --insecure-skip-tls-verify" 'KUBECONFIG is set to a file that cannot be created or modified'
echo "login warnings: ok"

# login and create serviceaccount and test login and logout with a service account token
os::cmd::expect_success "oc login ${KUBERNETES_MASTER} --certificate-authority='${MASTER_CONFIG_DIR}/ca.crt' -u test-user -p anything --api-version=v1"
os::cmd::expect_success_and_text "oc create sa testserviceaccount" "serviceaccount \"testserviceaccount\" created"
os::cmd::expect_success_and_text "oc login --token=$(oc sa get-token testserviceaccount)" "system:serviceaccount:project-foo:testserviceaccount"
# attempt to logout successfully
os::cmd::expect_success_and_text "oc logout" "Logged \"system:serviceaccount:project-foo:testserviceaccount\" out"
# verify that the token is no longer present in our local config
os::cmd::expect_failure_and_text "oc whoami" "User \"system:anonymous\" cannot get users"

# log in and set project to use from now on
os::cmd::expect_success "oc login --server=${KUBERNETES_MASTER} --certificate-authority='${MASTER_CONFIG_DIR}/ca.crt' -u test-user -p anything"
os::cmd::expect_success 'oc get projects'
Expand Down