Implemented core login functionality of the Pinniped supervisor.
The supervisor is an OpenID Connect (OIDC) server that passes identities from an upstream identity provider down to your Kubernetes clusters.
In this release, we finish what we started in v0.2.0 by adding several new APIs and implementing all the core login functionality:
config.supervisor.pinniped.dev/FederationDomainconfigures the "downstream" behavior of the supervisor as an OIDC issuer.
idp.supervisor.pinniped.dev/OIDCIdentityProviderconfigures an "upstream" OIDC provider which will be the source of identities.
The supervisor is a standards-compliant OIDC provider supporting the authorization code and refresh token flows.
It also includes support for a RFC8693 token exchange grant flow.
This new flow is key to supporting smooth login flows involving multiple clusters.
Added support for JSON Web Token (JWT) validation to the Pinniped concierge. This is configured with a new API type:
authentication.concierge.pinniped.dev/JWTAuthenticatorconfigures JWT validation parameters for the cluster.
Added a new comprehensive command line interface that unifies the concierge and supervisor functionality:
pinniped get kubeconfiggenerates a Pinniped-based kubeconfig YAML.
This command can autodiscover all required parameters in most cases, and supports using only a subset of Pinniped components.
pinniped login oidcsubcommand.
This command is normally not called directly, but via a kubeconfig generated by
pinniped get kubeconfig.
It now supports login flows combining OIDC browser-based login and the concierge TokenCredentialRequest API.
It also now supports the RFC8693 token exchange functionality via a new
Added a new
pinniped login staticsubcommand which is similar to
pinniped login oidcbut using static tokens.
Tokens can be passed in the kubeconfig or via environment variable.
This has been replaced with
pinniped get kubeconfigand will be removed in a future release.
This has been replaced with
pinniped login staticand will be removed in a future release.
Adjusted the default logging level to be less verbose.
Debug log output can now be enabled via a configuration field.
Increased the overall timeout for
pinniped login oidcto 90 minutes and added shorter timeouts for non-interactive portions of the login flow.
Reduced the lifetime of concierge-issued client certificates from 1 hour to 5 minutes.
Upgraded to Go 1.15.6.
Upgraded container base image to Debian 10.7 (slim).
Upgraded Kubernetes library components to v1.19.5.
Moved some stable OIDC client functionality from
./pkgso it can be more easily imported by other projects.
A complete list of changes (450 commits, 622 changed files with 38,117 additions and 16,689 deletions!) can be found here.