rancher: Kubectl error "You must be logged in to the server"
SURE-3029 SURE-3609 SURE-3394
Hi everyone !
What kind of request is this (question/bug/enhancement/feature request):
Question or bug
Steps to reproduce (least amount of steps as possible):
- Add a LDAP user (FreeIPA) on a project (owner, member …)
- Launch the kubectl command (through Rancher UI or using the kubeconfig file) : It must works
- After 24 hours, when the user execute a kubectl command, the following error is displayed :
error: You must be logged in to the server (the server has asked for the client to provide credentials)
Result: error: You must be logged in to the server (the server has asked for the client to provide credentials)
Other details that may be helpful:
- LDAP Authentication : FreeIPA
- Certificates signed by an intern PKI (CA Cert is imported during IPA connector configuration)
- Rancher upgraded from 2.1.8 to 2.4.5
- Problem still exists with a Rancher 2.4.5 fresh install
- Identified workaround : User has to delete his tokens to regenerate them when he gets his new kubeconfig file
- No problem with local users
Environment information
- Rancher version (
rancher/rancher/rancher/serverimage tag or shown bottom left in the UI): Rancher 2.4.5 - Installation option (single install/HA): Single Install
Cluster information
- Cluster type (Hosted/Infrastructure Provider/Custom/Imported): Vsphere Cluster
- Machine type (cloud/VM/metal) and specifications (CPU/memory): Virtual Machines
- Kubernetes version (use
kubectl version): v1.18.3 - Docker version (use
docker version): 19.3.11
Thank you for your help !
Nicolas
About this issue
- Original URL
- State: closed
- Created 4 years ago
- Reactions: 2
- Comments: 19 (3 by maintainers)
Commits related to this issue
- Merge pull request #36042 from MbolotSuse/2.5-ldap-backport backporting 737ae122f1268a87ff5b1e6f8375f0d1e33a39a2 to resolve #30230 — committed to rancher/rancher by MbolotSuse 2 years ago
definitively helped me 😉
Hmm forgot to write back here - but even after upgrading to 2.5.12 we kept running into the issue But then I got the idea of giving privs directly to individual users instead of via LDAP groups - and the issues disappeared !
this was solved in 2.5.12 and 2.6.3 and we will reopen if we see again
Has anyone experienced this issue with 2.6.3?
I’m thinking that this is caused by an integer overflow in v2.5 of the go-ldap package. We use that version in rancher up until 2.6.3, where we used v3.4. V3.4 has a larger destination int (there’s still potential for overflow, but the result code would have to be substantially higher), so the overflows shouldn’t happen (according to the IANA 4096 is the current highest error code, so uint16 should be sufficient).
The reasoning here is that rancher is because of this overflow, rancher isn’t seeing the errors, so it’s disabling the kubeconfig tokens (since it thinks that the errored searches indicate that the user lost access). It would help to know if people are still experiencing the issue on 2.6.3, as that would indicate the issue is elsewhere.