backend: headlamp: Add pkce support #3692

k-airos · 2025-07-26T10:02:53Z

Summary

Add PKCE support for OIDC authentication flow

Related Issue

Fixes #3137

Changes

Added PKCE configuration: Newflag (default: true) to enable/disable PKCE
Updated Config struct: Added OidcUsePKCE field to support PKCE configuration
Implemented PKCE cryptographic functions
Enhanced OauthConfig struct: Added field to store PKCE verifier

linux-foundation-easycla · 2025-07-26T10:02:57Z

The committers listed above are authorized under a signed CLA.

✅ login: k-airos / name: k-airos (5f14a59, eb171ed)

k8s-ci-robot · 2025-07-26T10:03:00Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: k-airos
Once this PR has been reviewed and has the lgtm label, please assign sniok for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2025-07-26T10:03:02Z

Welcome @k-airos!

It looks like this is your first PR to kubernetes-sigs/headlamp 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/headlamp has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

illume · 2025-07-27T15:24:13Z

Thanks @k-airos !

I asked in the issue for feedback, and ran the CI checks.

We'd need to documentation into the headlamp helm chart at some point (README.md, values.yaml and values.schema. Let me know if you'd like to add it in this PR, or we can do it after this is merged.

k-airos · 2025-07-27T20:13:12Z

Thanks! I've added the documentation to README.md, updated values.yaml and values.schema.json accordingly.
Let me know if anything else should be adjusted!

illume · 2025-07-28T06:56:51Z

@k-airos much appreciated.

I see Erik from the issue gave a thumbs up. Let's wait a little bit to see if anyone else from that issue has feedback.

I see there's an error in CI:

Testing Helm chart templates against expected output...
Error: parse error at (headlamp/templates/deployment.yaml:227): undefined variable "$usePKCE"

Use --debug flag to render out invalid YAML

To test this locally you can run:
make helm-template-test

Copilot

Pull Request Overview

This PR adds PKCE (Proof Key for Code Exchange) support to the OIDC authentication flow in Headlamp, enhancing security for OAuth 2.0 authorization code flows. PKCE is particularly important for public clients and helps mitigate authorization code interception attacks.

Added PKCE configuration option with default value of false
Implemented cryptographic functions for PKCE code verifier and challenge generation
Updated OIDC flow to conditionally use PKCE parameters during authorization and token exchange

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
charts/headlamp/values.yaml	Added usePKCE configuration option with default false
charts/headlamp/values.schema.json	Added schema definition for usePKCE boolean field
charts/headlamp/templates/secret.yaml	Added usePKCE to secret template
charts/headlamp/templates/deployment.yaml	Added OIDC_USE_PKCE environment variable handling
charts/headlamp/README.md	Updated documentation to include usePKCE configuration
backend/pkg/config/config.go	Added OidcUsePKCE field and flag definition
backend/cmd/server.go	Added oidcUsePKCE to server configuration
backend/cmd/headlamp.go	Implemented PKCE cryptographic functions and updated OAuth flow

Comments suppressed due to low confidence (1)

backend/cmd/headlamp.go:264

[nitpick] The default value for PKCE should be true rather than false. PKCE is a security enhancement recommended by RFC 7636 and OAuth 2.1, and there's no significant downside to enabling it by default. Consider changing the default to improve security posture.

		case strings.HasPrefix(r.Host, "localhost:") || r.TLS == nil:

Copilot · 2025-07-28T07:03:50Z

charts/headlamp/templates/deployment.yaml

@@ -213,6 +224,10 @@ spec:
            # Check if useAccessToken is non false either from env or oidc.config
            - "-oidc-use-access-token=$(OIDC_USE_ACCESS_TOKEN)"
            {{- end }}
+            {{- if or (ne ($oidc.usePKCE | toString) "false") (ne $usePKCE "") }}


The variable $usePKCE is referenced but not defined in this context. This appears to be a copy-paste error from the useAccessToken logic above. It should likely be ($oidc.usePKCE | toString) or the environment variable check should be removed.

Suggested change

{{- if or (ne ($oidc.usePKCE | toString) "false") (ne $usePKCE "") }}

{{- if or (ne ($oidc.usePKCE | toString) "false") (ne $usePKCE "false") }}

Copilot · 2025-07-28T07:03:50Z

backend/cmd/headlamp.go

+				oauth2Token, err = oauthConfig.Config.Exchange(
+					oauthConfig.Ctx,
+					r.URL.Query().Get("code"),
+					oauth2.SetAuthURLParam("code_verifier", oauthConfig.CodeVerifier),


The oauth2.SetAuthURLParam function is being used incorrectly for token exchange. For PKCE token exchange, you should use oauth2.SetAuthURLParam with the Exchange method, but the parameter should be passed as an option to Exchange, not as an auth URL parameter. Use oauth2.SetAuthURLParam("code_verifier", oauthConfig.CodeVerifier) as an option to the Exchange call.

illume · 2025-07-28T07:05:50Z

@yolossn @ashu8912 When you get a chance, can you please review?

yolossn

I tried testing this in in-cluster and the app doesn't work without the client-secret because of this client-secret check. We have to make client-secret optional in the kubconfig.OidcConfig for the user to make headlamp work without client-secret.

headlamp/backend/pkg/kubeconfig/kubeconfig.go

Line 911 in 68e7477

    
           if oidcClientID != "" && oidcClientSecret != "" && oidcIssuerURL != "" && oidcScopes != "" {

k8s-ci-robot · 2025-08-08T23:45:52Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Jul 26, 2025

k8s-ci-robot requested review from ashu8912 and skoeva July 26, 2025 10:03

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jul 26, 2025

backend: headlamp: Add pkce support

eb171ed

k-airos force-pushed the pkce_extention_support branch from 76a41bf to eb171ed Compare July 26, 2025 10:12

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jul 26, 2025

illume mentioned this pull request Jul 27, 2025

Enable Headlamp to use Public OIDC Client #3137

Open

helm: Add pkce support to the helm and readme docs

5f14a59

illume requested review from yolossn and Copilot and removed request for skoeva July 28, 2025 07:03

Copilot AI reviewed Jul 28, 2025

View reviewed changes

illume added kind/feature Categorizes issue or PR as related to a new feature. oidc Issue related to OIDC labels Jul 28, 2025

yolossn reviewed Aug 3, 2025

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 8, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

backend: headlamp: Add pkce support #3692

backend: headlamp: Add pkce support #3692

Uh oh!

k-airos commented Jul 26, 2025

Uh oh!

linux-foundation-easycla bot commented Jul 26, 2025 •

edited

Loading

Uh oh!

k8s-ci-robot commented Jul 26, 2025

Uh oh!

k8s-ci-robot commented Jul 26, 2025

Uh oh!

illume commented Jul 27, 2025

Uh oh!

k-airos commented Jul 27, 2025

Uh oh!

illume commented Jul 28, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jul 28, 2025

Uh oh!

Copilot AI Jul 28, 2025

Uh oh!

illume commented Jul 28, 2025

Uh oh!

yolossn left a comment

Uh oh!

k8s-ci-robot commented Aug 8, 2025

Uh oh!

Uh oh!

	{{- if or (ne ($oidc.usePKCE \| toString) "false") (ne $usePKCE "") }}
	{{- if or (ne ($oidc.usePKCE \| toString) "false") (ne $usePKCE "false") }}

backend: headlamp: Add pkce support #3692

Are you sure you want to change the base?

backend: headlamp: Add pkce support #3692

Uh oh!

Conversation

k-airos commented Jul 26, 2025

Summary

Related Issue

Changes

Uh oh!

linux-foundation-easycla bot commented Jul 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Jul 26, 2025

Uh oh!

k8s-ci-robot commented Jul 26, 2025

Uh oh!

illume commented Jul 27, 2025

Uh oh!

k-airos commented Jul 27, 2025

Uh oh!

illume commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jul 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 28, 2025

Choose a reason for hiding this comment

Uh oh!

illume commented Jul 28, 2025

Uh oh!

yolossn left a comment

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Aug 8, 2025

Uh oh!

Uh oh!

linux-foundation-easycla bot commented Jul 26, 2025 •

edited

Loading

illume commented Jul 28, 2025 •

edited

Loading