Support KUBERNETES_EXEC_INFO env var for exec provider configuration

[z0rc]

Description

For a long time aws eks get-token returned apiVersion: client.authentication.k8s.io/v1alpha1, there was attempt to switch it to v1beta1, but was hastly reverted, see aws/aws-cli#6289 and aws/aws-cli#6309.

Now aws-cli is going to approach this in planned manner and make it configurable, see aws/aws-cli#6476. It's planned to honor env var KUBERNETES_EXEC_INFO, which is documented here https://kubernetes.io/docs/reference/access-authn-authz/_print/#input-and-output-formats

As provider's exec configuration requires api_version attribute, it will make hard for module authors to support multiple aws-cli versions, once it makes a switch.

Please make this provider support KUBERNETES_EXEC_INFO as source of api_version value, and potentially other attributes too.

Potential Terraform Configuration

Following snippet should work when KUBERNETES_EXEC_INFO is set and valid.

provider "kubernetes" {
  host                   = var.cluster_endpoint
  cluster_ca_certificate = base64decode(var.cluster_ca_cert)
  exec {
    args    = ["eks", "get-token", "--cluster-name", var.cluster_name]
    command = "aws"
  }
}

References

cloudposse/terraform-aws-eks-cluster#131 here is problem that module authors has to deal with.

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[stevehipwell]

@z0rc I assume that the provider would work with KUBERNETES_EXEC_INFO passed to env and the same api set manually?

[z0rc]

@stevehipwell I didn't think through the overrides and/or priority order of configuration at this case. Hopefully this can be prioritized with kubectl 1.24 deprecating v1alpha1 client auth version.

[z0rc]

aws/aws-cli#6920 (comment)

[z0rc]

Reading more into this issue, my initial assumption about setting env var was wrong.

KUBERNETES_EXEC_INFO is set by k8s.io/client-go when doing exec call. I'm testing by setting api_version = client.authentication.k8s.io/v1beta1 and api_version = client.authentication.k8s.io/v1alpha1, and both settings work with aws-cli 2.6.3. So I assume nothing needs to be changed on provider side, as aws-cli uses api_version which is requested by provider configuration.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.