From 6fc4e102b89326cef416e4b6c47e8bfc5447b812 Mon Sep 17 00:00:00 2001 From: Andrew Keesler Date: Mon, 19 Oct 2020 10:22:38 -0400 Subject: [PATCH] exec credential provider: cluster info details Signed-off-by: Andrew Keesler --- .../access-authn-authz/authentication.md | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index a97dca823f..439b6c5900 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -882,11 +882,20 @@ users: On Fedora: dnf install example-client-go-exec-plugin ... + + # Whether or not to provide cluster information, which could potentially contain + # very large CA data, to this exec plugin as a part of the KUBERNETES_EXEC_INFO + # environment variable. + provideClusterInfo: true clusters: - name: my-cluster cluster: server: "https://172.17.4.100:6443" certificate-authority: "/etc/kubernetes/ca.pem" + extensions: + - name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config + extension: + some-config-per-cluster: config-data # arbitrary config contexts: - name: my-cluster context: @@ -968,3 +977,26 @@ RFC3339 timestamp. Presence or absence of an expiry has the following impact: } ``` +The plugin can optionally be called with an environment variable, `KUBERNETES_EXEC_INFO`, +that contains information about the cluster for which this plugin is obtaining +credentials. This information can be used to perform cluster-specific credential +acquisition logic. In order to enable this behavior, the `provideClusterInfo` field must +be set on the exec user field in the +[kubeconfig](/docs/concepts/configuration/organize-cluster-access-kubeconfig/). Here is an +example of the aforementioned `KUBERNETES_EXEC_INFO` environment variable. + +```json +{ + "apiVersion": "client.authentication.k8s.io/v1beta1", + "kind": "ExecCredential", + "spec": { + "cluster": { + "server": "https://172.17.4.100:6443", + "certificate-authority-data": "LS0t...", + "config": { + "some-config-per-cluster": "config-data" + } + } + } +} +```