core: Add STACKIT CLI Auth flow

[jkroepke]

Description

relates to stackitcloud/terraform-provider-stackit#719

This PR adds the ability to obtain a token from a locally installed CLI. This is great for local development, where a real user is logged in via the CLI, and other STACKIT-related tools like the Terraform provider can use the token from the authenticated CLI context to make additional requests against the STACKIT API.

While developing this feature, I found stackitcloud/stackit-cli#736.

Due limited STACKIT access, tests with real human accounts can not be done by myself.

The Stackit CLI flow is enabled by default. There is an option to disable the cli flow. On CLI itself, the option should set to false to prevent infinite loops.

The path of the STACKIT CLI is not configurable. The SDK expects the CLI to be available within the system PATH. I modified the Github Action to ensure that the Stackit CLI is present.

Tests are using a custom CLI profile to avoid interrupting the local default configuration.

Code inspired from https://github.com/Azure/azure-sdk-for-go/blob/f4b3a417e0bc39a5051028c4f9d0fc36bc612317/sdk/azidentity/azure_cli_credential.go#L119-L166

Checklist

• Issue was linked above
• No generated code was adjusted manually (check comments in file header)
• Changelogs
  • Changelog in the root directory was adjusted (see here)
  • Changelog(s) of the service(s) were adjusted (see e.g. here)
• Code format was applied: make fmt
• Examples were added / adjusted (see examples/ directory)
• Unit tests got implemented or updated
• Unit tests are passing: make test (will be checked by CI)
• No linter issues: make lint (will be checked by CI)

[BackInBash]

Thank you for your contribution.

I left a comment regarding the GitHub Workflow dependency

[github-actions]

This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it.

[marceljk]

Looks very good and works as expected. 😃 Can you just update the date of the changelog?

[jkroepke]

@marceljk Done and thanks for the additional testing.

Keep in mind to set DisableCLIAuthFlow: true in the STACKIT CLI to avoid auth loops.

[marceljk]

@jkroepke We just discussed the field DisableCLIAuthFlow: true in our team and we would prefer that we have to enable the CLIAuthFlow by setting it to true and that it is disabled by default.
This would avoid unexpected behavior for people who are not aware of the CLIAuthFlow and since you then have to enable the option, you automatically become aware of it.

[jkroepke]

Hi @marceljk

I would have a different sight on that:

On the Azure SDK, it's enabled by default. This at least guarantees that CLI authentication is always available, even for third-party programs like Prometheus, Terraform. And it's documented:
https://learn.microsoft.com/en-us/azure/developer/go/sdk/authentication/authentication-overview

The AWS SDK works in a similar way. An authenticated CLI is sufficient for the Terraform provider. That is great for local development where I can use a personal account to run terraform locally.

From an end-user perspective, I would assume that CLI authentication is enabled by default.

So I wound recommend that CLI Auth Flow is part of the Standard Credential Chain.

But I respect your decision and have changed it as requested.

[marceljk]

Hi @jkroepke,

that's a good point that the CLI authentication is by default always available and even for third-party programs. We will discuss it again internal, what's the better option here and will come back to you.

[github-actions]

This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it.

[marceljk]

Hi @jkroepke,
I just want to inform you, that we have still a look into this. I will inform you as soon as we have new information

[github-actions]

This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it.