search

kubernetes / test-infra

Test infrastructure for the Kubernetes project.
Apache License 2.0
3.82k stars 2.63k forks source link

Deprecate using `gencred` and switch to using Google principals to authenticate to GKE clusters #28142

Open upodroid opened 1 year ago

upodroid commented 1 year ago

The new gke auth plugin doesn't store access tokens in the kubeconfig file.

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: SOME CERT
    server: https://34.90.233.66
  name: gke_mahamed_europe-west4_dev
contexts:
- context:
    cluster: gke_mahamed_europe-west4_dev
    user: gke_mahamed_europe-west4_dev
  name: gke_mahamed_europe-west4_dev
current-context: gke_mahamed_europe-west4_dev
kind: Config
preferences: {}
users:
- name: gke_mahamed_europe-west4_dev
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      command: gke-gcloud-auth-plugin
      installHint: Install gke-gcloud-auth-plugin for use with kubectl by following
        https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke
      provideClusterInfo: true

Intree gcp plugin used to do the following which wasn't great.

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: SOME CERT
    server: https://34.90.233.66
  name: gke_mahamed_europe-west4_dev
contexts:
- context:
    cluster: gke_mahamed_europe-west4_dev
    user: gke_mahamed_europe-west4_dev
  name: gke_mahamed_europe-west4_dev
current-context: gke_mahamed_europe-west4_dev
kind: Config
preferences: {}
users:
- name: gke_mahamed_europe-west4_dev
  user:
    auth-provider:
      config:
        access-token: REDACTED
        cmd-args: config config-helper --format=json
        cmd-path: /Users/REDACTED/google-cloud-sdk/bin/gcloud
        expiry: "2022-11-30T15:48:48Z"
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
      name: gcp

Related to https://github.com/kubernetes/test-infra/issues/27896

/sig testing /sig k8s-infra

ameukam commented 1 year ago

cc @chaodaiG @cjwagner

k8s-triage-robot commented 1 year ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

upodroid commented 1 year ago

/priority important-longterm

k8s-triage-robot commented 1 year ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

BenTheElder commented 1 month ago

@upodroid [edit: is this] still important with the migration? (not sure what we settled on in k8s-infra)

upodroid commented 1 month ago

It is important, Argo is configured to access clusters using gke-auth plugin and we want prow to do the same as well