frontend,backend: support exec/teleport/cert based auth to clusters #4279

rushrs · 2025-12-16T16:21:06Z

Summary

Problem

Headlamp didn't properly handle Teleport's exec credential plugin authentication. When users loaded clusters configured with tsh kube credentials, they would see:

Token prompt dialogs (which don't apply to Teleport)
Redirect loops
Failed auth tests (because SelfSubjectRulesReview API is blocked by Teleport's RBAC proxy)

Solution

Added first-class support for Teleport's tsh authentication:

Backend: Detect tsh auth type (backend/pkg/kubeconfig/kubeconfig.go)
- Added detection for tsh in exec command
- Returns auth_type: "tsh" instead of generic "exec" for Teleport clusters
Frontend: Use /version endpoint for auth test (frontend/src/lib/k8s/api/v1/clusterApi.ts)
- For tsh/exec/client-cert auth, use /version endpoint instead of SelfSubjectRulesReview
- The /version endpoint is accessible to any authenticated user without RBAC restrictions
- Keeps original SelfSubjectRulesReview flow for token/OIDC auth
Frontend: Teleport-specific error messages (frontend/src/components/App/RouteSwitcher.tsx)
- When tsh auth fails (expired session), shows: "Teleport authentication failed. Please run 'tsh login' to refresh your credentials"
- No redirect to login page (since Teleport auth is handled externally)

Related Issue

Steps to Test

I built the frontend backend and app locally and tried it with these changes and the tsh based auth worked.

Screenshots (if applicable)

Notes for the Reviewer

[e.g., This touches the i18n layer, so please check language consistency.]

k8s-ci-robot · 2025-12-16T16:21:15Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rushrs
Once this PR has been reviewed and has the lgtm label, please assign sniok for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

linux-foundation-easycla · 2025-12-16T16:21:15Z

The committers listed above are authorized under a signed CLA.

✅ login: rushrs / name: rush (e039819)

k8s-ci-robot · 2025-12-16T16:21:15Z

Welcome @rushrs!

It looks like this is your first PR to kubernetes-sigs/headlamp 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/headlamp has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

vyncent-t

Submitting this for a copilot suggestions, feel free to adjust as you see fit.

Copilot

Pull request overview

This PR adds first-class support for Teleport's tsh authentication and improves authentication handling for exec credential plugins and client certificate authentication. The key changes differentiate between authentication types to use appropriate endpoints and provide better error messages.

Backend now detects and returns specific auth types: "tsh", "exec", and "client-cert" instead of generic types
Frontend uses the /version endpoint for authentication tests with tsh/exec/client-cert auth (instead of SelfSubjectRulesReview which Teleport blocks)
Teleport-specific error messages guide users to run tsh login when authentication fails

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
backend/pkg/kubeconfig/kubeconfig.go	Extends AuthType() to detect and return "tsh", "exec", and "client-cert" auth types by inspecting kubeconfig AuthInfo
frontend/src/lib/k8s/api/v1/clusterApi.ts	Modifies testAuth() to accept authType parameter and use /version endpoint for exec-based auth instead of SelfSubjectRulesReview
frontend/src/components/authchooser/index.tsx	Skips auth testing for exec and client-cert auth types to avoid conflicts with RouteSwitcher
frontend/src/components/App/RouteSwitcher.tsx	Adds authType to AuthRoute, shows Teleport-specific error messages for failed tsh authentication

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

frontend/src/components/authchooser/index.tsx

frontend/src/lib/k8s/api/v1/clusterApi.ts

backend/pkg/kubeconfig/kubeconfig.go

rushrs · 2025-12-17T18:59:05Z

Submitting this for a copilot suggestions, feel free to adjust as you see fit.

Just had a scan through and added the tsh check. happy with it now

rushrs · 2025-12-23T16:12:11Z

addressed the failing github actions steps and rebased, thanks all

illume · 2026-01-02T13:32:48Z

Thanks @rushrs

I will review and test over the next days. I ran the CI jobs again (they have to be manually run the first time someone contributes a PR).

Would it be possible to squash some of the commits together and to get rid of the merge commits? We follow a Linux kernel style commit message formatting… please see https://headlamp.dev/docs/latest/contributing#2-follow-commit-guidelines

Are there instructions somewhere for teleport with the exec credential so we can test this manually?

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

frontend/src/lib/k8s/api/v1/clusterApi.ts

backend/pkg/kubeconfig/kubeconfig.go

frontend/src/components/App/RouteSwitcher.tsx

backend/pkg/kubeconfig/kubeconfig.go

illume · 2026-01-05T11:32:40Z

It looks like teleport isn't open source exactly, so I can not manually test it myself.

rushrs · 2026-01-05T14:55:26Z

It looks like teleport isn't open source exactly, so I can not manually test it myself.

exec based auth

tsh
aws-iam-auth
gke gcloud auth

cert based auth

minikube
kind
k3s

sniok · 2026-01-05T15:23:53Z

Hi, we already support client cert and exec auth. Is there a reason for changes you're introducing for those?
Also I'm not sure if we should add support for commercial product like teleport

rushrs · 2026-01-05T15:33:03Z

there is a self hosted opensource version which has an apache 2.0 license

rushrs · 2026-01-05T15:42:53Z

Hi, we already support client cert and exec auth. Is there a reason for changes you're introducing for those?
Also I'm not sure if we should add support for commercial product like teleport

Hey! the exec based support doesnt work in the frontend, it results to auth_type = "" this is likely to be teleport specific - when connecting via the gke-auth-plugin for the clusters, I do not run into the same issues.

When connecting via teleport headlamp asks for a client id which isn't present as tsh creates short lived certs for access. In the kube config it runs an exec for tsh kube credentials for the given cluster which is proxied behind teleport

selfsubjectrulesreviews causes problems for the connection check some exec based solutions like teleport have minimal rbac - users can access resources but can't call authorization APIs.

illume · 2026-01-05T15:57:55Z

there is a self hosted opensource version which has an apache 2.0 license

Ah right. Thanks for the clarification.

illume · 2026-01-05T16:30:20Z

@rushrs do you have a link that explains the licensing? There is this file that seems to be a non open source license? https://github.com/gravitational/teleport/blob/master/build.assets/LICENSE-community

I especially want to know how to use the "self hosted opensource version which has an apache 2.0 license" version in order to be able to manually test this.

rushrs · 2026-01-05T17:34:53Z

@rushrs do you have a link that explains the licensing? There is this file that seems to be a non open source license? https://github.com/gravitational/teleport/blob/master/build.assets/LICENSE-community

I especially want to know how to use the "self hosted opensource version which has an apache 2.0 license" version in order to be able to manually test this.

ah I hadn't realised they moved away from that licence a while back. i've just used the enterprise version mainly. looks like the new one builds on apache 2.0 but restricts building products from their source code. we are not doing that in this case just enabling support for it

Add support for exec-based credential plugins (Teleport tsh, aws-iam-authenticator) and client certificate authentication. Backend changes: - kubeconfig: Detect auth type from exec config - kubeconfig: Return "tsh" for Teleport, "exec" for others Frontend changes: - clusterApi: Use /version endpoint for exec/cert auth - clusterApi: Add backward-compatible options parameter - RouteSwitcher: Show auth-type specific error messages - RouteSwitcher: Wait for clusters to load before auth check

illume · 2026-01-06T15:33:31Z

ah I hadn't realised they moved away from that licence a while back. i've just used the enterprise version mainly. looks like the new one builds on apache 2.0 but restricts building products from their source code. we are not doing that in this case just enabling support for it

Cool. It's just none of the headlamp maintainers has Teleport experience, and I guess we can't manually test it ourselves. Do you think you would be around if any Teleport related issues pop up? We don't have regression tests for this code either so far... so we'd have to rely on you and other Teleport users to report/fix issues.

Are you able to write testing steps in the PR description? This way another teleport user in the future would find the testing steps useful for testing this if you're not around.

illume · 2026-01-06T15:43:34Z

frontend/src/components/App/RouteSwitcher.tsx

+            'Exec credential plugin authentication failed. Please refresh your credentials and try again.';
+        } else {
+          errorMessage =
+            'Client certificate authentication failed. Please check your certificates.';


Strings need to be translated with t() from useTranslate. See other strings in different components.

Afterwards “npm run i18n” needs to be run.

illume · 2026-01-06T15:46:00Z

frontend/src/components/App/RouteSwitcher.tsx

+        } else if (authType === 'exec') {
+          errorMessage =
+            'Exec credential plugin authentication failed. Please refresh your credentials and try again.';
+        } else {


Maybe match on "client-cert" to be more explicit?

illume · 2026-01-06T15:48:52Z

frontend/src/components/App/RouteSwitcher.tsx


    if (query.isError) {
+      // For tsh/exec/client-cert auth, show a helpful error message
+      if (isExecOrCertAuth) {


I think this could code be in it's own component. Called something like AuthenticationError?

rushrs · 2026-01-08T13:45:59Z

I will action these changes and don't mind being a maintainer for this part of the integration.

k8s-ci-robot requested review from skoeva and sniok December 16, 2025 16:21

vyncent-t reviewed Dec 17, 2025

View reviewed changes

vyncent-t requested a review from Copilot December 17, 2025 16:20

Copilot started reviewing on behalf of vyncent-t December 17, 2025 16:21 View session

Copilot AI reviewed Dec 17, 2025

View reviewed changes

frontend/src/components/authchooser/index.tsx Outdated Show resolved Hide resolved

frontend/src/lib/k8s/api/v1/clusterApi.ts Show resolved Hide resolved

frontend/src/lib/k8s/api/v1/clusterApi.ts Show resolved Hide resolved

backend/pkg/kubeconfig/kubeconfig.go Outdated Show resolved Hide resolved

rushrs requested a review from vyncent-t January 2, 2026 12:04

illume requested a review from Copilot January 2, 2026 13:33

Copilot started reviewing on behalf of illume January 2, 2026 13:33 View session

Copilot AI reviewed Jan 2, 2026

View reviewed changes

rushrs force-pushed the rushrs/exec-based-auth branch from 34f0261 to 89d0a5b Compare January 5, 2026 15:29

rushrs force-pushed the rushrs/exec-based-auth branch from 89d0a5b to 3a60699 Compare January 5, 2026 15:45

rushrs force-pushed the rushrs/exec-based-auth branch from 3a60699 to f1685fa Compare January 5, 2026 16:15

rushrs force-pushed the rushrs/exec-based-auth branch 2 times, most recently from f1685fa to 3d82547 Compare January 5, 2026 17:44

k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 5, 2026

rushrs force-pushed the rushrs/exec-based-auth branch from 3d82547 to 4bf29ac Compare January 5, 2026 17:45

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Jan 5, 2026

rushrs changed the title ~~support exec/teleport/cert based auth to clusters~~ frontend,backend: support exec/teleport/cert based auth to clusters Jan 5, 2026

rushrs force-pushed the rushrs/exec-based-auth branch from 4bf29ac to e039819 Compare January 6, 2026 10:50

illume reviewed Jan 6, 2026

View reviewed changes

frontend,backend: support exec/teleport/cert based auth to clusters #4279

Are you sure you want to change the base?

frontend,backend: support exec/teleport/cert based auth to clusters #4279

Uh oh!

Conversation

rushrs commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Solution

Related Issue

Steps to Test

Screenshots (if applicable)

Notes for the Reviewer

Uh oh!

k8s-ci-robot commented Dec 16, 2025

Uh oh!

linux-foundation-easycla bot commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Dec 16, 2025

Uh oh!

vyncent-t left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rushrs commented Dec 17, 2025

Uh oh!

rushrs commented Dec 23, 2025

Uh oh!

illume commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

illume commented Jan 5, 2026

Uh oh!

rushrs commented Jan 5, 2026

Uh oh!

sniok commented Jan 5, 2026

Uh oh!

rushrs commented Jan 5, 2026

Uh oh!

rushrs commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

illume commented Jan 5, 2026

Uh oh!

illume commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rushrs commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

illume commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

illume Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

illume Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

rushrs commented Dec 16, 2025 •

edited

Loading

linux-foundation-easycla bot commented Dec 16, 2025 •

edited

Loading

illume commented Jan 2, 2026 •

edited

Loading

rushrs commented Jan 5, 2026 •

edited

Loading

illume commented Jan 5, 2026 •

edited

Loading

rushrs commented Jan 5, 2026 •

edited

Loading

illume commented Jan 6, 2026 •

edited

Loading

illume Jan 6, 2026 •

edited

Loading

illume Jan 6, 2026 •

edited

Loading