<p dir="auto"><strong>Is this a request for help?</strong> (If yes, you should use our troubleshooting guide and community support channels, see <a href="http://kubernetes.io/docs/troubleshooting/" rel="nofollow">http://kubernetes.io/docs/troubleshooting/</a>.): No</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.): Looked at the API docs.  Discussed on the kubernetes/sig-auth slack channel with <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/ericchiang/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/ericchiang">@ericchiang</a> and <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/whitlockjc/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/whitlockjc">@whitlockjc</a></p>
<hr>
<p dir="auto"><strong>Is this a BUG REPORT or FEATURE REQUEST?</strong> (choose one): FEATURE REQUEST</p>
<p dir="auto">Once OIDC is integrated, it would be helpful to have an endpoint that will reply with information about the logged in user, mainly the username, uid, groups and roles.  Something similar to OpenShift's /oapi/v1/users/~ service.  Ideally this would return json similar to:</p>
<div class="highlight highlight-source-json notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="{
  &quot;username&quot;:&quot;me&quot;,
  &quot;uid&quot;:&quot;myuid&quot;,
  &quot;groups&quot;:[
                  &quot;admins&quot;,
                  &quot;devs&quot;,
                  &quot;etc&quot;,
                ],
  &quot;roles&quot;:[
               &quot;adminrole&quot;,
               &quot;userrole&quot;,
               &quot;etc&quot;
            ]
}"><pre class="notranslate">{
  <span class="pl-ent">"username"</span>:<span class="pl-s"><span class="pl-pds">"</span>me<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"uid"</span>:<span class="pl-s"><span class="pl-pds">"</span>myuid<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"groups"</span>:[
                  <span class="pl-s"><span class="pl-pds">"</span>admins<span class="pl-pds">"</span></span>,
                  <span class="pl-s"><span class="pl-pds">"</span>devs<span class="pl-pds">"</span></span>,
                  <span class="pl-s"><span class="pl-pds">"</span>etc<span class="pl-pds">"</span></span>,
                ],
  <span class="pl-ent">"roles"</span>:[
               <span class="pl-s"><span class="pl-pds">"</span>adminrole<span class="pl-pds">"</span></span>,
               <span class="pl-s"><span class="pl-pds">"</span>userrole<span class="pl-pds">"</span></span>,
               <span class="pl-s"><span class="pl-pds">"</span>etc<span class="pl-pds">"</span></span>
            ]
}</pre></div>
<p dir="auto">That way someone can easily test that OIDC is setup correctly, the dashboard can show who the logged in user is and external tool developers can verify/display the logged in user.</p>
<p dir="auto"><strong>What you expected to happen</strong>:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ curl -H &quot;Authorization: bearer ASDFV...&quot; https://myapi.k8s.io/api/path/to/whoami
{
  &quot;username&quot;:&quot;me&quot;,
  &quot;uid&quot;:&quot;myuid&quot;,
  &quot;groups&quot;:[
                  &quot;admins&quot;,
                  &quot;devs&quot;,
                  &quot;etc&quot;,
                ],
  &quot;roles&quot;:[
               &quot;adminrole&quot;,
               &quot;userrole&quot;,
               &quot;etc&quot;
            ]
}"><pre class="notranslate"><code class="notranslate">$ curl -H "Authorization: bearer ASDFV..." https://myapi.k8s.io/api/path/to/whoami
{
  "username":"me",
  "uid":"myuid",
  "groups":[
                  "admins",
                  "devs",
                  "etc",
                ],
  "roles":[
               "adminrole",
               "userrole",
               "etc"
            ]
}
</code></pre></div>
<p dir="auto"><strong>Is this a request for help?</strong> (If yes, you should use our troubleshooting guide and community support channels, see <a href="http://kubernetes.io/docs/troubleshooting/" rel="nofollow">http://kubernetes.io/docs/troubleshooting/</a>.):</p>
<p dir="auto">No.</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.):</p>
<p dir="auto">"bazel"</p>
<hr>
<p dir="auto"><strong>Is this a BUG REPORT or FEATURE REQUEST?</strong> (choose one):</p>
<p dir="auto">Bug Report</p>
<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>):</p>
<p dir="auto">1.5 beta2 (source)</p>
<p dir="auto"><strong>How to reproduce it</strong> (as minimally and precisely as possible):</p>
<p dir="auto">Use github.com/kubernetes/kubernetes as a git_repository in another Bazel project. The "set-gen" genrule in pkg/util/sets/BUILD will fail because its "--input-dirs" argument assumes some things about the path it is operating on. It works fine in the kubernetes tree, but the paths will have "external/" prepended to them when imported into another project. The "--go-header-file" argument works fine because it uses $location.</p>
<p dir="auto"><strong>Anything else do we need to know</strong>:</p>
<p dir="auto">I fixed this here by doing some path-chopping in bash, but the solution is ugly:</p>
<p dir="auto"><a href="https://github.com/sayrer/kubernetes/blob/4d14457d6297ab98ca46c75601195cd9d67eb339/pkg/util/sets/BUILD#L43">https://github.com/sayrer/kubernetes/blob/4d14457d6297ab98ca46c75601195cd9d67eb339/pkg/util/sets/BUILD#L43</a></p>
<p dir="auto"><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mikedanese/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/mikedanese">@mikedanese</a></p>