Dashboard: Support passthrough of impersonation headers

[mlbiam]

What would you like to be added

Right now you can upload a kubeconfig with a token or embed on in the Authorization header from a reverse proxy. What would be good is to support the impersonation headers from .a reverse proxy. There would need to be some additional documentation of proper controls too.

Why is this needed

This would make it possible for the dashboard to work on cloud provider implementations (ie eks/aks/gke) without direct tie-in to their own proprietary identity apis. This would also keep pace with the API server's capabilities for advanced authentication.

Comments

I'd be happy to work on this and submit a PR if it's a feature that would be accepted.

cc @sig-ui

[maciaszczykm]

Sounds good to me. I'll cc other guys.

cc @kubernetes/dashboard-maintainers

[floreks]

You are welcome to work on that. We need some kind of proposal/PoC on how it would work in Dashboard.

[jeefy]

Sweet! +1 on a PoC. Let us know if you need anything or have any questions. :)

/pony yay

[k8s-ci-robot]

@jeefy:

In response to this:

Sweet! +1 on a PoC. Let us know if you need anything or have any questions. :)

/pony yay

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mlbiam]

Here's the basic design:

1. User authenticates to the reverse proxy
2. Reverse proxy has a token that is authorized to impersonate, injects the token plus impersonation headers into each request to the dashboard
3. Dashboard forwards the headers to the api server on all requests (same as Authorization header today)

Same rules as using the Authorization header token from the dashboard:

1. Must use TLS
2. Dashboard service account has minimal permissions

From a security standpoint, the burden is on the reverse proxy to properly secure its self

[maciaszczykm]

@mlbiam Hey, any updates?

[mlbiam]

life's my gotten in my way :-/ good news is i hope to pick this back up in the next week or two

[jeefy]

Awesome! @mlbiam let us know if there's anything you need. Thanks!