Support authentication helper for kubectl #9667

justinsb · 2020-08-02T18:23:57Z

We create a simple exec plugin command which can create and renew
short-lived admin credentials on the fly, essentially leveraging the
security of the underlying cloud credentials.

k8s-ci-robot · 2020-08-02T18:24:15Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [justinsb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

justinsb · 2020-08-02T18:24:16Z

cc @johngmyers

pkg/commands/helpers/kubectl_auth.go

justinsb · 2020-08-02T18:26:22Z

pkg/kubeconfig/create_kubecfg.go

+			"kubectl-auth",
+			"--cluster=" + clusterName,
+			"--state=" + kopsStateStore,
+			"--api-version=" + "v1alpha1",


We might be able to default to v1beta1 now

cmd/kops/export_kubecfg.go

cmd/kops/main.go

pkg/commands/helpers/kubectl_auth.go

johngmyers · 2020-08-09T23:17:57Z

pkg/commands/helpers/kubectl_auth.go

+	cacheFilePath := cacheFilePath(f.KopsStateStore(), options.ClusterName)
+	cached, err := loadCachedExecCredential(cacheFilePath)
+	if err != nil {
+		klog.Warningf("cached credential %q was not valid: %v", cacheFilePath, err)


Not sure this and the wrong API version count as warnings.

I believe this is when the credential is an error, not just expired, but you're right - going with Infof

pkg/commands/helpers/kubectl_auth.go

justinsb · 2020-08-16T18:30:25Z

This seems to work, marking as no longer WIP. Thanks for the feedback @johngmyers and @rifelpet

Also added a test!

johngmyers

/lgtm
/hold to give opportunity to address review comment

pkg/kubeconfig/create_kubecfg.go

We create a simple exec plugin command which can create and renew short-lived admin credentials on the fly, essentially leveraging the security of the underlying cloud credentials. Co-authored-by: John Gardiner Myers <[email protected]>

Also slightly simplify the tests and Kubecfg Builder signature by passing in the ConfigAccess only when needed.

johngmyers · 2020-08-30T20:34:45Z

/retest

johngmyers · 2020-08-30T23:37:25Z

/retest

johngmyers · 2020-08-30T23:43:24Z

/lgtm
/hold cancel

fejta-bot · 2020-08-31T02:28:29Z

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

k8s-ci-robot · 2020-08-31T03:03:25Z

@justinsb: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
pull-kops-e2e-k8s-containerd	`4827817`	link	`/test pull-kops-e2e-k8s-containerd`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

johngmyers · 2020-08-31T03:32:09Z

/retest

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 2, 2020

k8s-ci-robot requested review from KashifSaadat and olemarkus August 2, 2020 18:24

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 2, 2020

justinsb commented Aug 2, 2020

View reviewed changes

pkg/commands/helpers/kubectl_auth.go Show resolved Hide resolved

justinsb commented Aug 2, 2020

View reviewed changes

johngmyers reviewed Aug 9, 2020

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 10, 2020

justinsb force-pushed the kubectl_auth_helper branch from 6f5f714 to 0eb3860 Compare August 16, 2020 15:49

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 16, 2020

justinsb force-pushed the kubectl_auth_helper branch from 0eb3860 to 6b307a0 Compare August 16, 2020 17:59

justinsb changed the title ~~WIP: Support authentication helper for kubectl~~ Support authentication helper for kubectl Aug 16, 2020

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 16, 2020

justinsb force-pushed the kubectl_auth_helper branch from 6b307a0 to bd2aaa7 Compare August 16, 2020 18:29

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 16, 2020

justinsb force-pushed the kubectl_auth_helper branch from bd2aaa7 to 4827817 Compare August 16, 2020 18:38

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 17, 2020

justinsb force-pushed the kubectl_auth_helper branch from 4827817 to 2b65dec Compare August 28, 2020 17:37

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 28, 2020

justinsb force-pushed the kubectl_auth_helper branch 2 times, most recently from 85897f6 to d021004 Compare August 29, 2020 12:44

k8s-ci-robot added the area/documentation label Aug 29, 2020

johngmyers reviewed Aug 29, 2020

View reviewed changes

pkg/kubeconfig/create_kubecfg.go Outdated Show resolved Hide resolved

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 29, 2020

k8s-ci-robot assigned johngmyers Aug 29, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 29, 2020

justinsb force-pushed the kubectl_auth_helper branch from d021004 to f7c1685 Compare August 30, 2020 14:08

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 30, 2020

justinsb and others added 2 commits August 30, 2020 15:16

Support authentication helper for kubectl

0cda0f5

We create a simple exec plugin command which can create and renew short-lived admin credentials on the fly, essentially leveraging the security of the underlying cloud credentials. Co-authored-by: John Gardiner Myers <[email protected]>

kubeconfig generation: add tests for kops plugin

8757a2c

Also slightly simplify the tests and Kubecfg Builder signature by passing in the ConfigAccess only when needed.

justinsb force-pushed the kubectl_auth_helper branch from f7c1685 to 8757a2c Compare August 30, 2020 19:19

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. labels Aug 30, 2020

k8s-ci-robot merged commit 5d09a9a into kubernetes:master Aug 31, 2020

k8s-ci-robot added this to the v1.19 milestone Aug 31, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support authentication helper for kubectl #9667

Support authentication helper for kubectl #9667

justinsb commented Aug 2, 2020

k8s-ci-robot commented Aug 2, 2020

justinsb commented Aug 2, 2020

justinsb Aug 2, 2020

johngmyers Aug 9, 2020

justinsb Aug 16, 2020

justinsb commented Aug 16, 2020

johngmyers left a comment

johngmyers commented Aug 30, 2020

johngmyers commented Aug 30, 2020

johngmyers commented Aug 30, 2020

fejta-bot commented Aug 31, 2020

k8s-ci-robot commented Aug 31, 2020 •

edited

Loading

johngmyers commented Aug 31, 2020

Support authentication helper for kubectl #9667

Support authentication helper for kubectl #9667

Conversation

justinsb commented Aug 2, 2020

k8s-ci-robot commented Aug 2, 2020

justinsb commented Aug 2, 2020

justinsb Aug 2, 2020

Choose a reason for hiding this comment

johngmyers Aug 9, 2020

Choose a reason for hiding this comment

justinsb Aug 16, 2020

Choose a reason for hiding this comment

justinsb commented Aug 16, 2020

johngmyers left a comment

Choose a reason for hiding this comment

johngmyers commented Aug 30, 2020

johngmyers commented Aug 30, 2020

johngmyers commented Aug 30, 2020

fejta-bot commented Aug 31, 2020

k8s-ci-robot commented Aug 31, 2020 • edited Loading

johngmyers commented Aug 31, 2020

k8s-ci-robot commented Aug 31, 2020 •

edited

Loading