Unable to connect to an Azure AKS cluster

[stevehedrick]

Similar to #12, When I attempt to add an AKS cluster kube-forwarder see's my cluster in the config, but fails to connect with a message Failed to connect to myakscluster cluster(s). Do you want to continue saving?

If I continue, I can manually add resources, but they won't forward. If I edit the cluster and choose to test the connection again, it will fail with an 'unauthorized' response.

I believe the issue is that our clusters have Azure authentication enabled. Essentially we have a user section that looks like this:

users:
- name: <username>
  user:
    auth-provider:
      name: azure
      config:
        apiserver-id: <apiserver-app-id>
        client-id: <kubectl-app-id>
        tenant-id: <tenant-id>

I'm not sure if the forwarder isn't picking up existing tokens from the kube config file, or if it's attempting to get a new token, and failing at azure's whole go to https://microsoft.com/devicelogin and enter a code demand.

Here's a little background on the Azure authentication: https://docs.giantswarm.io/guides/authenticating-with-microsoft-azure-active-directory/

Really hoping that this works out, as it looks like a really cool and handy tool.

[lnikell]

Thank you for the feedback @stevehedrick , could you please check our latest release and let us know. The issue should be fixed.

[stevehedrick]

I tried the v1.3.0 release for windows, During setup I can select a cluster that was detected out of my kube config file, but when I click on Add selected clusters a turning busy icon appears on the button and never completes. I let it sit for about 10 minutes just to be sure.

[proAlexandr]

@stevehedrick we've just released a new version could you please check it?

[lnikell]

I'm closing issue, but let us know if you still have that issue with the new version.

[hi-im-aren]

@lnikell I just checked it with the new version, it's better but still not perfect. Before, I had to repaste the whole kubernetes config after the token expired to have the forwarder work for an hour before the token expiration. Now when I add the config by path I don't have to repaste it once the token is refreshed but I still have to run a command like get pods so a new valid token is requested and added to the config file. Ideally if the token is expired in the config file and I click on the button to start forwarding, it should automatically renew the token behind the scenes. Maybe run a command behind the scenes that asks for some resource so it renews the token?

[SaschaAusUlm]

We're hitting the same issue. It would be great to get a fix for that .... maybe?