Lens: OIDC login is not being re-imported after tokens expire

[starkers]

Describe the bug
We log into our clusters via OIDC + dex. After adding our cluster in lens everything seems OK. However eventually that token expires.. So the next day, after that token expired we get:

Connecting ...
2020/08/06 09:02:38 http: proxy error: failed to refresh token: oauth2: cannot fetch token: 400 Bad Request
Response: {"error":"invalid_request","error_description":"Refresh token is invalid or has already been claimed by another client."}

This is after the user has refreshed their token and pulled a new one into their KUBECONFIG.

I'm using a version of this to update the KUBECONFIG: https://github.com/pusher/k8s-auth-example

Expected behavior
When we "add a server" in Lens it appears to import settings from the KUBECONFIG, ideally it should examine the token's refresh time, if it has expired then it would be great if it tried re-imported the settings from KUBECONFIG (or just prompted users to re-auth?)

Screenshot

Environment (please complete the following information):

• Lens Version: 3.5.2
• OS: Linux
• Installation method: AppImage

Logs:

error: Failed to connect to cluster main.eu-staging: {"name":"StatusCodeError","statusCode":502,"message":"502 - \"Refresh token is invalid or has already been claimed by another client.\"","error":"Refresh token is invalid or has already been claimed by another client.","options":{"json":true,"timeout":10000,"headers":{"host":"9482819f-0a1f-4fed-9d0c-6bb4baf94ae4.localhost:46251"},"uri":"http://127.0.0.1:46251/api-kube/version","simple":true,"resolveWithFullResponse":false,"transform2xxOnly":false},"response":{"statusCode":502,"body":"Refresh token is invalid or has already been claimed by another client.","headers":{"content-type":"text/plain","date":"Thu, 06 Aug 2020 07:57:38 GMT","connection":"close","transfer-encoding":"chunked"},"request":{"uri":{"protocol":"http:","slashes":true,"auth":null,"host":"127.0.0.1:46251","port":"46251","hostname":"127.0.0.1","hash":null,"search":null,"query":null,"pathname":"/api-kube/version","path":"/api-kube/version","href":"http://127.0.0.1:46251/api-kube/version"},"method":"GET","headers":{"host":"9482819f-0a1f-4fed-9d0c-6bb4baf94ae4.localhost:46251","accept":"application/json"}}}}

Kubeconfig:

Kubeconfig's look like this (but with more servers typically)..

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: REDACTED
    server: https://api.main.eu-staging.acmecorp.org
  name: main.eu-staging
contexts:
- context:
    cluster: main.eu-staging
    namespace: default
    user: [email protected]
  name: main.eu-staging
current-context: main.eu-staging
kind: Config
preferences: {}
users:
- name: [email protected]
  user:
    auth-provider:
      config:
        client-id: kubernetes
        client-secret: REDACTED
        id-token: REDACTED
        idp-issuer-url: https://dex.acmecorp.org
        refresh-token: REDACTED
      name: oidc

[ocdi]

I'm using an Azure AD connected AKS cluster which has a similar issue, the but I am not seeing any token refresh, just start getting 401 failures after the token expires. The annoying thing in this situation is the tokens only last an hour so I need to remove the cluster from Lens, use kubectl on a command line to manually refresh the token and then re-add it to Lens.

I had a look at the code to see if I can fix it, but unfortunately the cluster management code is written in Vue and I think the copying of cluster config into a private copy means this won't be easy to solve, especially as I know nothing about this codebase.

Given the kubectl tools work nicely, it would be nice if we could run our own external proxy that Lens could use.

[ocdi]

FWIW I actually followed the instructions on the welcome screen and for my scenerio used https://github.com/Azure/kubelogin to solve the refresh token issue (hopefully - need to check back in an hour). I didn't think this was an option but it appears their download includes binaries for all platforms in a single zip file, which confused me initially.

[chriske]

I'm in the same situation here, but with on prem cluster. Is there any solution or workaround to solve this problem? Thx!

[jakolehm]

This behaviour should be fixed in the upcoming 3.6 release where Lens does not import kubeconfig from a filesystem. First beta should be out within couple of days.

[chriske]

Thank you so much! :)

[nevalla]

Please could you test 3.6.0-beta.1 which is out now.

[chriske]

@nevalla thank you very much, we tested it in the weekend and it seems working! thanks for the help and the feature! :)

[starkers]

Thanks!

[thugyecz]

Hi!
Up until v3.6.4 this feature was working well (re-importing after token expiration), but now with v3.6.4 it seems to be broken again, at least for me (both on my Windows and Ubuntu machine).
We are using the exact same OIDC+dex as before (we are working together with @chriske ) and for me/us at least, the "400 Bad Response" error message about the token problems came back:

Is there anyone else who is experiencing the same or is it just me/us somehow? :)

[ocdi]

I too think 3.6.4 is broken with respect to this issue. I've been fine as I am using the external azure kubelogin, however a colleague who is using the AzureAD auth started having this issue happen again.