Deprecate Kubernetes client API version v1alpha1 #6476

micahhausler · 2021-10-13T17:04:02Z

Kubernetes has deprecated v1alpha1, v1beta1 has been available since Kubernetes
v1.11 (kubernetes/kubernetes#64482), and EKS currently supports Kubernetes
versions v1.16 through v1.21. This is a breaking change for clients running
versions v1.10 and older, which haven't been supported by EKS since September
2019.

"aws eks get-token" now respects the KUBERNETES_EXEC_INFO environment
variable and conservatively falls back to v1alpha1, which is supported
by Kubernetes versions 1.10 through 1.22 (released upstream August 2021, to be
released by EKS in Q4 2021). It also now supports clients requesting credentials
using the "v1beta1" and "v1" versions.

"aws eks update-kubeconfig" now writes "v1beta1" in the kubeconfig which
will be supported by Kubernetes until 1.29 (aproximately December 2023).
At or around that date, we can change the default version written to
kubeconfigs to "v1"

Signed-off-by: Micah Hausler mhausler@amazon.com

Issue #, if available:

Description of changes:

See above

cc: @nckturner @sgundapu

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

codecov-commenter · 2021-10-13T17:17:27Z

Codecov Report

Merging #6476 (320f898) into develop (e564532) will increase coverage by 0.01%.
The diff coverage is 100.00%.

@@             Coverage Diff             @@
##           develop    #6476      +/-   ##
===========================================
+ Coverage    92.85%   92.87%   +0.01%     
===========================================
  Files          204      204              
  Lines        16310    16344      +34     
===========================================
+ Hits         15145    15179      +34     
  Misses        1165     1165

Impacted Files	Coverage Δ
awscli/customizations/eks/get_token.py	`100.00% <100.00%> (ø)`
awscli/customizations/eks/update_kubeconfig.py	`97.93% <100.00%> (ø)`

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e564532...320f898. Read the comment docs.

awscli/customizations/eks/get_token.py

nckturner · 2021-10-18T18:31:43Z

tests/functional/eks/test_get_token.py

@@ -143,3 +144,105 @@ def test_url_different_partition(self):
            expected_endpoint='sts.cn-north-1.amazonaws.com.cn',
            expected_signing_region='cn-north-1'
        )
+
+    def test_api_version_discovery_deprecated(self):


When do these tests get run?

They're run by pytest. See scripts/ci/run-tests

nckturner · 2021-10-18T18:33:09Z

tests/functional/eks/test_get_token.py

+    def test_api_version_discovery_deprecated(self):
+        os.environ["KUBERNETES_EXEC_INFO"] = '{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1alpha1","spec":{"interactive":true}}'
+        cmd = 'eks get-token --cluster-name %s' % self.cluster_name
+        stdout, stderr, _ = self.run_cmd(cmd)


Is this testing with an external kubectl binary? If so, what version?

No, this is called just by the test runner.

It would be cool if we had an integration test that used client-go in some capacity, even if it was only a manual test initially. Not a blocker.

sgundapu

LGTM

stealthycoin · 2022-04-05T22:54:40Z

fixes #6308

justindho · 2022-05-05T18:15:04Z

tests/functional/eks/test_get_token.py

+        del os.environ["KUBERNETES_EXEC_INFO"]
+
+    def test_api_version_discovery_malformed(self):
+        os.environ["KUBERNETES_EXEC_INFO"] = '{{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1alpha1","spec":{"interactive":true}}'


I think we should be using a copy of the environment variables here (and the other tests) instead (i.e., os.environ.copy()). The tests are run in parallel, and directly modifying envvars (os.environ["KUBERNETES_EXEC_INFO"] = ..., del os.environ["KUBERNETES_EXEC_INFO"]) may interfere with other tests running in parallel.

We've used this in the past for setting env vars: #6476 (comment)

kyleknap

Looks fine. All of my feedback was related to Python-specifics and codebase usage/organization.

awscli/customizations/eks/get_token.py

tests/functional/eks/test_get_token.py

kyleknap · 2022-05-05T18:21:04Z

awscli/customizations/eks/get_token.py

@@ -13,6 +13,8 @@
 import base64


It would also be great if we can get a changelog for this feature? You can use the scripts/new-change script to generate a changelog entry. For the type field, I'd recommend setting the type to enhancement and the category to eks get-token

awscli/customizations/eks/get_token.py

tests/functional/eks/test_get_token.py

awscli/customizations/eks/get_token.py

Kubernetes has deprecated v1alpha1, v1beta1 has been available since Kubernetes v1.11 (kubernetes/kubernetes#64482), and EKS currently supports Kubernetes versions v1.16 through v1.21. This is a breaking change for clients running versions v1.10 and older, which haven't been supported by EKS since September 2019. "aws eks get-token" now respects the KUBERNETES_EXEC_INFO environment variable and conservatively falls back to v1alpha1, which is supported by Kubernetes versions 1.10 through 1.22 (released upstream August 2021, to be released by EKS in Q4 2021). It also now supports "v1beta1" and "v1". "aws eks update-kubeconfig" now writes "v1beta1" in the kubeconfig which will be supported by Kubernetes until 1.29 (aproximately December 2023). At or around that date, we can change the default version written to kubeconfigs to "v1" Signed-off-by: Micah Hausler <mhausler@amazon.com>

kyleknap

Looks good. Just had some more suggestions.

.changes/next-release/enhancement-eksgettoken-91863.json

.changes/next-release/enhancement-eksupdatekubeconfig-63017.json

tests/functional/eks/test_get_token.py

awscli/customizations/eks/get_token.py

kyleknap

Looks good! 🚢

nckturner · 2022-05-06T02:04:00Z

LGTM

nckturner · 2022-05-06T02:08:32Z

awscli/customizations/eks/get_token.py

+]
+
+ERROR_MSG_TPL = (
+    "{0} KUBERNETES_EXEC_INFO, defaulting to {1}. This is likely a "


Should it say "Error reading KUBERNETES_EXEC_INFO" instead of just "KUBERNETES_EXEC_INFO"

It will say Error parsing to start the sentence as the variable is being used as a template. Tests also confirm that too: https://github.com/aws/aws-cli/pull/6476/files#diff-ee0c03e30582b485e61dba3f70f956a6024118bdffe8657c476fee7f9ac655afR194.

zawachte-c · 2022-05-10T12:18:23Z

@micahhausler I am hitting an issue using kubectl 1.19 where it doesn't set KUBERNETES_EXEC_INFO. So the following flow is broken...

# update to latest aws-cli
 aws eks update-kubeconfig
 kubectl get pods <= with kubectl 1.19

This returns the following error:

Empty KUBERNETES_EXEC_INFO, defaulting to client.authentication.k8s.io/v1alpha1. This is likely a bug in your Kubernetes client. Please update your Kubernetes client.
Unable to connect to the server: getting credentials: exec plugin is configured to use API version client.authentication.k8s.io/v1beta1, plugin returned version client.authentication.k8s.io/v1alpha1

kubectl >- 1.20 works as expected. I still have some 1.19 clusters running so i kept kubectl at 1.19, but I can update kubectl, but since eks still supports kubernetes 1.19 I figured it was worth a post.

micahhausler · 2022-05-11T20:49:45Z

@zawachte-c thank you! Take a look at #6940, as this should resolve the <= 1.19 problems

nckturner reviewed Oct 18, 2021

View reviewed changes

sgundapu approved these changes Oct 19, 2021

View reviewed changes

nckturner approved these changes Oct 20, 2021

View reviewed changes

z0rc mentioned this pull request Nov 3, 2021

Support KUBERNETES_EXEC_INFO for kube_exec_auth cloudposse/terraform-aws-eks-cluster#131

Closed

kdaily added the needs-review This issue or pull request needs review from a core team member. label Nov 6, 2021

z0rc mentioned this pull request Nov 16, 2021

Support KUBERNETES_EXEC_INFO env var for exec provider configuration hashicorp/terraform-provider-kubernetes#1495

Closed

kdaily mentioned this pull request Dec 8, 2021

POD log is flooded with warning message from aws cli. #6596

Closed

5 tasks

kdaily added customization Issues related to CLI customizations (located in /awscli/customizations) eks-kubeconfig labels Dec 14, 2021

kdaily linked an issue May 4, 2022 that may be closed by this pull request

CLI versions 1.20.9 and 2.2.24 shipped a breaking change in a dot release #6308

Closed

2 tasks

kdaily added ready-for-review and removed needs-review This issue or pull request needs review from a core team member. labels May 4, 2022

This was referenced May 4, 2022

Add --api-version flag to aws eks get-token to support newer versions #6916

Open

aws eks update-kubeconfig invalid apiVersion #6920

Closed

kdaily added review bug This issue is a bug. and removed ready-for-review labels May 5, 2022

justindho reviewed May 5, 2022

View reviewed changes

kyleknap reviewed May 5, 2022

View reviewed changes

nateprewitt reviewed May 5, 2022

View reviewed changes

micahhausler and others added 2 commits May 5, 2022 16:36

Address feedback in PR

18fdfa3

justindho force-pushed the eks-token-api-version-deprecation branch from 5ea108a to 18fdfa3 Compare May 5, 2022 23:39

kyleknap reviewed May 5, 2022

View reviewed changes

Address PR feedback

3124795

justindho force-pushed the eks-token-api-version-deprecation branch from 3a2c6d6 to 3124795 Compare May 6, 2022 00:26

Fix string formatting

320f898

kyleknap approved these changes May 6, 2022

View reviewed changes

nckturner reviewed May 6, 2022

View reviewed changes

jstastny mentioned this pull request May 6, 2022

EKS: Update API version of ExecCredential to v1 #6912

Closed

kyleknap merged commit 71f07ad into aws:develop May 6, 2022

DannyGoldberg mentioned this pull request May 6, 2022

awscli 2.6.3 Homebrew/homebrew-core#100980

Closed

Voxelot mentioned this pull request May 6, 2022

aws eks update-kubeconfig invalid apiVersion aws-actions/configure-aws-credentials#437

Closed

tim-finnigan mentioned this pull request May 10, 2022

Empty KUBERNETES_EXEC_INFO warning when running aws eks get-token #6935

Closed

micahhausler deleted the eks-token-api-version-deprecation branch May 11, 2022 21:02

micahhausler mentioned this pull request May 11, 2022

Default to beta API for eks get-token #6940

Merged

bryantbiggs mentioned this pull request Jun 17, 2022

fix: Upgrade K8s auth API due to deprecation aws-ia/terraform-aws-eks-blueprints#646

Merged

6 tasks

Nuru mentioned this pull request Jun 27, 2022

2.6.0 provider version causing Error: Kubernetes cluster unreachable: exec plugin: invalid apiVersion hashicorp/terraform-provider-helm#893

Closed

gavin-stackrox mentioned this pull request Jul 27, 2022

Upgrade AWS CLI stackrox/rox-ci-image#152

Merged

luolanzone mentioned this pull request Aug 23, 2022

Antctl doesn't work on EKS clusters antrea-io/antrea#4140

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecate Kubernetes client API version v1alpha1 #6476

Deprecate Kubernetes client API version v1alpha1 #6476

micahhausler commented Oct 13, 2021 •

edited

Loading

codecov-commenter commented Oct 13, 2021 •

edited

Loading

nckturner Oct 18, 2021

micahhausler Oct 18, 2021

nckturner Oct 18, 2021

micahhausler Oct 18, 2021

nckturner Oct 18, 2021

sgundapu left a comment

stealthycoin commented Apr 5, 2022

justindho May 5, 2022 •

edited

Loading

kyleknap May 5, 2022

kyleknap left a comment

kyleknap May 5, 2022

kyleknap left a comment

kyleknap left a comment

nckturner commented May 6, 2022

nckturner May 6, 2022

kyleknap May 6, 2022

zawachte-c commented May 10, 2022

micahhausler commented May 11, 2022

Deprecate Kubernetes client API version v1alpha1 #6476

Deprecate Kubernetes client API version v1alpha1 #6476

Conversation

micahhausler commented Oct 13, 2021 • edited Loading

codecov-commenter commented Oct 13, 2021 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sgundapu left a comment

Choose a reason for hiding this comment

stealthycoin commented Apr 5, 2022

justindho May 5, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kyleknap left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kyleknap left a comment

Choose a reason for hiding this comment

kyleknap left a comment

Choose a reason for hiding this comment

nckturner commented May 6, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zawachte-c commented May 10, 2022

micahhausler commented May 11, 2022

micahhausler commented Oct 13, 2021 •

edited

Loading

codecov-commenter commented Oct 13, 2021 •

edited

Loading

justindho May 5, 2022 •

edited

Loading