Use the apiversion from KUBERNETES_EXEC_INFO #439

jyotimahapatra · 2022-03-09T03:45:50Z

When using the latest builds of aws-iam-authenticator(v0.5.3-v0.5.5), the default value of apiVersion in the ExecCredential object is client.authentication.k8s.io/v1beta1. This change was done here. However, when using the newer builds, clients have to update the apiVersion in kubeConfig to match the apiVersion being sent as part of the stdout here.
A difference in the values causes errors

Unable to connect to the server: getting credentials: exec plugin is configured to use API version 
client.authentication.k8s.io/v1alpha1, plugin returned version client.authentication.k8s.io/v1beta1

The current PR adds a migration path such that the aws-iam-authenticator will return the apiVersion being used in the KUBERNETES_EXEC_INFO env var being set from the client-go code. This code will be removed in the future after a period of deprecation and with a minor version change in aws-iam-authenticator.

Similar change in aws-cli https://github.com/aws/aws-cli/pull/6476/files

Signed-off-by: Jyoti Mahapatra <jyotima@amazon.com>

k8s-ci-robot · 2022-03-09T03:46:09Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jyotimahapatra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [jyotimahapatra]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Signed-off-by: Jyoti Mahapatra <jyotima@amazon.com>

jaypipes

Couple small questions, @jyotimahapatra but overall looks solid.

jaypipes · 2022-03-09T15:29:44Z

cmd/aws-iam-authenticator/verify.go

@@ -70,6 +72,7 @@ var verifyCmd = &cobra.Command{

 func init() {
 	rootCmd.AddCommand(verifyCmd)
+	metrics.InitMetrics(prometheus.DefaultRegisterer)


is this change unrelated?

yes. it fixes #438
i can get rid of it if causing confusion. it was in my workspace, so i let it be part of the PR

Probably would be best to isolate this to a different PR, thanks Jyoti. Then you can link to #438 from that other PR summary :)

pkg/token/token_test.go

nckturner · 2022-03-09T08:21:34Z

pkg/token/token.go

@@ -338,11 +341,23 @@ func (g generator) GetWithSTS(clusterID string, stsAPI stsiface.STSAPI) (Token,

 // FormatJSON formats the json to support ExecCredential authentication
 func (g generator) FormatJSON(token Token) string {
+	apiVersion := clientauthv1beta1.SchemeGroupVersion.String()
+	for _, e := range os.Environ() {


Don't parse this manually, instead use LoadExecCredentialFromEnv(). Example usage:

package main import ( "fmt" "k8s.io/client-go/tools/auth/exec" ) func main() { obj, config, err := exec.LoadExecCredentialFromEnv() fmt.Printf("%#v, %#v, %#v\n", obj, config, err) }

nice. Thank you!!

Looks like https://github.com/kubernetes/client-go/blob/master/pkg/apis/clientauthentication/types.go#L54-L59 is sending an error ExecCredential does not contain cluster information .. We have to keep this implementation and work on fixing the error in client-go. wdyt?

jyotimahapatra · 2022-03-09T06:52:07Z

cmd/aws-iam-authenticator/verify.go

@@ -70,6 +72,7 @@ var verifyCmd = &cobra.Command{

 func init() {
 	rootCmd.AddCommand(verifyCmd)
+	metrics.InitMetrics(prometheus.DefaultRegisterer)


jyotimahapatra · 2022-03-09T18:00:26Z

cmd/aws-iam-authenticator/verify.go

@@ -70,6 +72,7 @@ var verifyCmd = &cobra.Command{

 func init() {
 	rootCmd.AddCommand(verifyCmd)
+	metrics.InitMetrics(prometheus.DefaultRegisterer)


yes. it fixes #438
i can get rid of it if causing confusion. it was in my workspace, so i let it be part of the PR

wongma7 · 2022-03-24T19:15:39Z

lgtm, works for me . plz squash commits.

in 1.24 alpha api will be removed from client-go and probably kubectl as well, not sure what their migration plan exactly (will there be some way for me to find/replace all the v1alpha1 entries in my kubeconfig??) but we will see

  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - token
      - -i
      - cluster-0
      command: aws-iam-authenticator

~/g/s/s/aws-iam-authenticator (try|✚1) $ kubectl version 
ERRO[2022-03-24T12:13:40-07:00] apiVersion client.authentication.k8s.io/v1beta1 
Client Version: version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.3", GitCommit:"ca643a4d1f7bfe34773c74f79527be4afd95bf39", GitTreeState:"clean", BuildDate:"2021-07-15T21:04:39Z", GoVersion:"go1.16.6", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"22+", GitVersion:"v1.22.6-eks-7d68063", GitCommit:"f24e667e49fb137336f7b064dba897beed639bad", GitTreeState:"clean", BuildDate:"2022-02-23T19:29:12Z", GoVersion:"go1.16.12", Compiler:"gc", Platform:"linux/amd64"}

  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - token
      - -i
      - cluster-0
      command: aws-iam-authenticator

~/g/s/s/aws-iam-authenticator (try|✚1) $ kubectl version
ERRO[2022-03-24T12:13:47-07:00] apiVersion client.authentication.k8s.io/v1alpha1 
Client Version: version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.3", GitCommit:"ca643a4d1f7bfe34773c74f79527be4afd95bf39", GitTreeState:"clean", BuildDate:"2021-07-15T21:04:39Z", GoVersion:"go1.16.6", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"22+", GitVersion:"v1.22.6-eks-7d68063", GitCommit:"f24e667e49fb137336f7b064dba897beed639bad", GitTreeState:"clean", BuildDate:"2022-02-23T19:29:12Z", GoVersion:"go1.16.12", Compiler:"gc", Platform:"linux/amd64"}

jyotimahapatra added 2 commits March 8, 2022 19:41

use the apiversion from stdin

a701bd0

Signed-off-by: Jyoti Mahapatra <jyotima@amazon.com>

use the apiversion from stdin

837a59e

Signed-off-by: Jyoti Mahapatra <jyotima@amazon.com>

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Mar 9, 2022

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 9, 2022

k8s-ci-robot requested review from jaypipes and micahhausler March 9, 2022 03:46

use the apiversion from stdin

5037775

Signed-off-by: Jyoti Mahapatra <jyotima@amazon.com>

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Mar 9, 2022

jaypipes reviewed Mar 9, 2022

View reviewed changes

nckturner reviewed Mar 9, 2022

View reviewed changes

jyotimahapatra commented Mar 9, 2022

View reviewed changes

jyotimahapatra added 2 commits March 9, 2022 10:28

remove redundant test

095a4ad

remove for loop

cb19d5f

jaxesn mentioned this pull request Mar 10, 2022

Update client.authorization to v1beta1 aws/eks-anywhere#1426

Merged

wongma7 mentioned this pull request Mar 24, 2022

Revert "[pkg/token]: Update credential API version" #443

Closed

nckturner merged commit 27337b2 into kubernetes-sigs:master Mar 30, 2022

jyotimahapatra deleted the try branch March 31, 2022 17:26

nckturner mentioned this pull request Apr 1, 2022

Breaking changes with patch release #440

Closed

iambenkay mentioned this pull request May 6, 2022

Specifying versions causes issues kodermax/kubectl-aws-eks#23

Closed

initanmol mentioned this pull request Jun 21, 2022

2.6.0 provider version causing Error: Kubernetes cluster unreachable: exec plugin: invalid apiVersion hashicorp/terraform-provider-helm#893

Closed

jasonmcintosh mentioned this pull request Feb 27, 2024

feat(aws): Install AWS CLI v2, upgrade aws-iam-authenticator, remove s3cmd spinnaker/clouddriver#6156

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use the apiversion from KUBERNETES_EXEC_INFO #439

Use the apiversion from KUBERNETES_EXEC_INFO #439

jyotimahapatra commented Mar 9, 2022 •

edited

k8s-ci-robot commented Mar 9, 2022

jaypipes left a comment

jaypipes Mar 9, 2022

jyotimahapatra Mar 9, 2022

jaypipes Mar 10, 2022

jyotimahapatra Mar 10, 2022

nckturner Mar 9, 2022

jyotimahapatra Mar 9, 2022

jyotimahapatra Mar 9, 2022

jyotimahapatra Mar 9, 2022

jyotimahapatra Mar 9, 2022

wongma7 commented Mar 24, 2022

Use the apiversion from KUBERNETES_EXEC_INFO #439

Use the apiversion from KUBERNETES_EXEC_INFO #439

Conversation

jyotimahapatra commented Mar 9, 2022 • edited

k8s-ci-robot commented Mar 9, 2022

jaypipes left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wongma7 commented Mar 24, 2022

jyotimahapatra commented Mar 9, 2022 •

edited