Dashboard: Proposal: OAuth2 support

[SerialVelocity]

Hi Kubernetes dashboard team,

We are running Kubernetes backed by an OAuth2 provider and require audit logging for all requests going through the dashboard.

Would you be willing to accept a PR to add first-class OAuth2 support to the dashboard?

This would be running the OAuth2 workflow with the authorization_code grant type. The bearer token that gets returned would be used for connecting to the kubernetes apiserver.

To do this, I would add flags for:

• Client ID
• Client Secret (I would expect to be able to pass this in by filename/environment variable)
• OAuth URL
• Redirect URL (Since you can have a different external URL to internal URL)

I wouldn't be adding explicit support for Google OAuth, Github OAuth, etc but they may be implicitly supported if Kubernetes is set up to do the authorization.

Best,
Ben

Related tickets

964

2353

2621

2630

[jeefy]

I'd be open to review a PR like that. It's definitely something that needs to be addressed.
Fair warning: It might be some time before it gets merged into master and released as we're still working on the Angular migration.

Thanks!

[jeefy]

/kind feature
/lifecycle frozen

[SerialVelocity]

@jeefy Sorry for the delay in responding here. Unfortunately we have deprioritised this internally so I will not be implementing this soon.

[jeefy]

That's fine. The issue will remain open as it is something we need to address in the future. :) Thanks!

[floreks]

Will be tracked from #2353
/close

[k8s-ci-robot]

@floreks: Closing this issue.

In response to this:

Will be tracked from #2353
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.