From 6fc4e102b89326cef416e4b6c47e8bfc5447b812 Mon Sep 17 00:00:00 2001 From: Andrew Keesler Date: Mon, 19 Oct 2020 10:22:38 -0400 Subject: [PATCH 1/2] exec credential provider: cluster info details Signed-off-by: Andrew Keesler --- .../access-authn-authz/authentication.md | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index a97dca823f..439b6c5900 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -882,11 +882,20 @@ users: On Fedora: dnf install example-client-go-exec-plugin ... + + # Whether or not to provide cluster information, which could potentially contain + # very large CA data, to this exec plugin as a part of the KUBERNETES_EXEC_INFO + # environment variable. + provideClusterInfo: true clusters: - name: my-cluster cluster: server: "https://172.17.4.100:6443" certificate-authority: "/etc/kubernetes/ca.pem" + extensions: + - name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config + extension: + some-config-per-cluster: config-data # arbitrary config contexts: - name: my-cluster context: @@ -968,3 +977,26 @@ RFC3339 timestamp. Presence or absence of an expiry has the following impact: } ``` +The plugin can optionally be called with an environment variable, `KUBERNETES_EXEC_INFO`, +that contains information about the cluster for which this plugin is obtaining +credentials. This information can be used to perform cluster-specific credential +acquisition logic. In order to enable this behavior, the `provideClusterInfo` field must +be set on the exec user field in the +[kubeconfig](/docs/concepts/configuration/organize-cluster-access-kubeconfig/). Here is an +example of the aforementioned `KUBERNETES_EXEC_INFO` environment variable. + +```json +{ + "apiVersion": "client.authentication.k8s.io/v1beta1", + "kind": "ExecCredential", + "spec": { + "cluster": { + "server": "https://172.17.4.100:6443", + "certificate-authority-data": "LS0t...", + "config": { + "some-config-per-cluster": "config-data" + } + } + } +} +``` From c855d5d68cf05f2fee08db8030ef439ad8fbafa4 Mon Sep 17 00:00:00 2001 From: Andrew Keesler Date: Tue, 3 Nov 2020 12:19:16 -0500 Subject: [PATCH 2/2] exec credential provider: make arbitrary JSON more explicit Signed-off-by: Andrew Keesler --- .../docs/reference/access-authn-authz/authentication.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index 439b6c5900..f727644992 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -895,7 +895,9 @@ clusters: extensions: - name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: - some-config-per-cluster: config-data # arbitrary config + arbitrary: config + this: can be provided via the KUBERNETES_EXEC_INFO environment variable upon setting provideClusterInfo + you: ["can", "put", "anything", "here"] contexts: - name: my-cluster context: @@ -994,7 +996,9 @@ example of the aforementioned `KUBERNETES_EXEC_INFO` environment variable. "server": "https://172.17.4.100:6443", "certificate-authority-data": "LS0t...", "config": { - "some-config-per-cluster": "config-data" + "arbitrary": "config", + "this": "can be provided via the KUBERNETES_EXEC_INFO environment variable upon setting provideClusterInfo", + "you": ["can", "put", "anything", "here"] } } }