Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OIDC Device Flow with extra variables #7939

Closed
Tracked by #7561
smira opened this issue Nov 8, 2023 · 0 comments · Fixed by #7959
Closed
Tracked by #7561

OIDC Device Flow with extra variables #7939

smira opened this issue Nov 8, 2023 · 0 comments · Fixed by #7959
Assignees

Comments

@smira
Copy link
Member

smira commented Nov 8, 2023

Allow talos.config= flow for metal platform to use OIDC device auth flow to acquire the machine configuration.

We might want to have a lightweight implementation, great overview.

talos.config= will be parsed to get the base hostname for OAuth API.

We need following input params:

  • client_id (mandatory)
  • audience
  • scopes
  • extra variables to send with the request, out of those available in talos.config URL interpolation, e.g. uuid

Proposal:
talos.config.oidc.client_id=foo talos.config.oidc.audience=world talos.config.oidc.scopes=auth talos.config.oidc.extra_variables=uuid,mac

Once the URL & user_code are available, show it in the console, plus show the QR (library).

We can print QR & URL, user_code to the console. Plus if the dashboard is running, we can use it to show the QR, we need some integration e.g. via resources.

Keep polling OAuth until we get the token or failure.

Once the token is acquired, fetch machine config with token using regular flow via talos.config=.

@smira smira self-assigned this Nov 16, 2023
smira added a commit to smira/talos that referenced this issue Nov 16, 2023
Fixes siderolabs#7939

See documentation in the PR for the description of the feature.

Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jun 9, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant