OIDC auth refresh flow differs from kubectl behavior

[nurus]

I've been testing OIDC for authentication using the work done in kubernetes-client/python-base#48 and came across an issue refreshing credentials because I do not specify idp-certificate-authority-data in my kubeconfig. This issue has already been brought up: #368 (comment). As kubectl does not require this key I don't think the python client should either.

Another potential issue is the lack of support for the idp-certificate-authority key which allows you to load CA certificates from a file. I was attempting to use this to get around the issue mentioned above by loading a trusted root CA bundle. I could convert the entire file to base64 and add it as a value for idp-certificate-authority-data but this results in an unwieldy kubeconfig file.

[mvle]

I also ran into this problem when my kubeconfig does not have idp-certificate-authority-data field. This is not needed for kubectl and I don't think it should be forced on users w/o this requirement. It can be unsafe.
I created patch to skip over the certificate check when idp-certificate-authority-data is not specified.

Ping @yliaog

[yliaog]

i think the patch looks good. idp-certificate-authority-data does not need to be required. could you send a PR?

[mvle]

ping @yliaog. PR is there, any chance for comment/review?

[yliaog]

sorry for late response, i did not get notification about it until you pinged explicitly. the PR looks good.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.