argoproj / argoproj/argo-workflows

argo cli doesn't support auth-provider type user in kubeconfig when specifying the argo server cli option

Open
#9,865 1 comment 0 reactions 0 assignees View on GitHub
P3
Dominant language
Go
Stars
17k
Forks
3.7k
Avg merge
1d 20h
Merged PRs (30d)
138

Description

### Pre-requisites

- [X] I have double-checked my configuration
- [X] I can confirm the issues exists when I tested with `:latest`
- [ ] I'd like to contribute the fix myself (see [contributing guide](https://github.com/argoproj/argo-workflows/blob/master/docs/CONTRIBUTING.md))

### What happened/what you expected to happen?

### What happened
```
# token type user kubeconfig
$ cat kubeconfig.token-user
...
users:
- name: xxx
token: xxxx
...

# works without --argo-server
$ argo --kubeconfig=kubeconfig.token-user list
No workflows found

# works with --argo-server
$ argo --kubeconfig=kubeconfig.token-user --argo-server=xxx:443 --argo-http1 list
No workflows found

# auth-provider user kubeconfig
$ cat kubeconfig.auth-provider-user
...
users:
- name: xxx
user:
auth-provider:
name: xxx
config:
client-id: xxx
client-secret: xxx
idp-issuer-url: xxx
id-token: xxx
refresh-token: xxx
...

# works without --argo-server
$ argo --kubeconfig=kubeconfig.auth-provider-user list
No workflows found

# does not work with --argo-server
$ argo --kubeconfig=kubeconfig.auth-provider-user --argo-server=xxx:443 --argo-http1 list
FATA[2022-10-20T12:04:49.492Z] could not find a token
```

### What expected to happen
`argo --argo-server=xxx:443 --argo-http1 list` works with auth-provider type user in kubeconfig.

### Version

v3.3.9 and v3.4.1

### Paste a small workflow that reproduces the issue. We must be able to run the workflow; don't enter a workflows that uses private images.

```YAML
1. Prepare an auth-provider type user kubeconfig file, it doesn't have to contain working auth-provider data, fake data works.
2. Run `argo --kubeconfig=kubeconfig.auth-provider-user --argo-server=argo-server:443 --argo-http1`, it returns error `FATA[2022-10-20T12:29:01.903Z] could not find a token`.
```

### Logs from the workflow controller

N/A for this issue.

### Logs from in your workflow's wait container

N/A for this issue.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported command with the auth-provider kubeconfig: run `argo --kubeconfig=kubeconfig.auth-provider-user --argo-server=argo-server:443 --argo-http1 list` and compare it with the token-based and no-`--argo-server` cases. Trace the CLI path handling `--argo-server` and kubeconfig authentication, then verify that the command no longer returns `could not find a token` for an auth-provider user configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
authentication, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.