How to get access token (Oauth device flow) for AKS cluster using the ReST API

Pranab Bhatta 0 Reputation points
2023-03-22T10:07:15.3033333+00:00

Hi Team,

I want to automate the pod status check (AKS cluster) and send mail in case not Running.

The current authentication device_code mechanism always requires keying the code and require human intervention. I am planning to use java kubernetes API https://github.com/kubernetes-client/java/tree/master/kubernetes

Hence, I wanted to know is there a way by which i can get a long-lived token.

Thanks,

Pranab

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
1,877 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ovidiu Borlean 1 Reputation point Microsoft Employee
    2023-03-23T07:38:53.3833333+00:00

    Hello Pranab,

    Thank you for reaching Microsoft Q&A section.

    You can geta Pod status with a REST API request by creating a new service account and generate a token as follows.

    kubectl create serviceaccount jenkins
kubectl create token jenkins --duration 9999h> ./token
kubectl create clusterrole jenkins --verb=* --resource=*
kubectl create clusterrolebinding jenkins --clusterrole=jenkins --serviceaccount=default:jenkins
  
TOKEN=$(cat ./token)
# Generate the Rest API call to API Server
curl -sS -m 10 --cacert ./ca.crt --header "Authorization: Bearer ${TOKEN}" -X GET https://aks-fqdn.hcp.westeurope.azmk8s.io:443/api/v1/namespaces/default/pods/jenkins/status

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments
  2. vipullag-MSFT 24,441 Reputation points
    2023-03-27T04:51:42.7+00:00

    Hello Pranab Bhatta

    Welcome to Microsoft Q&A Platform, thanks for posting your query here.

    Currently, there is no way to get long lived token for a user by design.

    However, you can choose any of the supported non-interactive methods with kubelogin (https://github.com/Azure/kubelogin#features) for example using Service Principal. Noting that the kubeconfig file should be compatible with the official k8s Java client according to https://github.com/kubernetes-client/java/wiki/2.-Versioning-and-Compatibility.

    Alternatively, you can choose to generate a service account token following https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#manually-create-an-api-token-for-a-serviceaccount and use the Kubernetes method to authenticate to AKS apiserver.

    Hope this helps.

    If you need further help on this, tag me in a comment.

    If the suggested response helped you resolve your issue, please 'Accept as answer', so that it can help others in the community looking for help on similar topics.

    0 comments