int128 / kubelogin

kubectl plugin for Kubernetes OpenID Connect authentication (kubectl oidc-login)
Apache License 2.0
1.65k stars 191 forks source link

Add support for client.authentication.k8s.io/v1 api #1049

Open ahublersos opened 6 months ago

ahublersos commented 6 months ago

Purpose of the feature (why)

the client.authentication.k8s.io/v1beta1 api is deprecated and will be removed in a future Kubernetes release. The new version of this api is client.authentication.k8s.io/v1, but using that version in exec config gives this error:

E0213 10:28:08.147879   51131 memcache.go:265] couldn't get current server API group list: Get "https://api.<cluster-url>/api?timeout=32s": getting credentials: exec plugin is configured to use API version client.authentication.k8s.io/v1, plugin returned version client.authentication.k8s.io/v1beta1

Your idea (how)

Moving completely over to client.authentication.k8s.io/v1 may be a breaking change depending on users kubeconfigs and Kubernetes versions. Perhaps defaulting to the new v1 version but having a flag available to preserve the current v1beta1 version would be a good middle ground.

At the very least clientauthenticationv1beta1 in pkg/credentialplugin/writer/credential_plugin.go and integration_test/credetial_plugin_test.go will need to be updated.

It doesn't look like the ExecCredential object changes between API versions, so changes to the write() function and tests shoud be minimal.

client-authentication.v1 docs client-authentication.v1beta1 docs