Port exec-based client auth provider to Python client

[dbenhur]

With 1.10, this exec-based client auth credential provider alpha feature was introduced kubernetes/features#541 for client-go. Exec-based auth plugin should be supported by this Python client in addition to client-go. Umbrella issue: kubernetes#62185

/kind feature
/sig api-machinery

[roycaihw]

Link to the credential plugin feature: https://kubernetes.io/docs/admin/authentication#client-go-credential-plugins
Design proposal: https://github.com/ericchiang/community/blob/2bfa7e1e624a5c87cbd1d07566e617563e2280fd/contributors/design-proposals/auth/kubectl-exec-plugins.md

The feature is in alpha state which means the API may change and support may be dropped in future. Python client auth is happening in kubeconfig loader class in python base repo: https://github.com/kubernetes-client/python-base/tree/master/config.

cc @Lawouach

[jasonkriss]

With AWS EKS going GA, this seems to be a pretty important feature. @dbenhur any chance you guys are already working on this? It's currently blocking us from moving to EKS.

[palnabarun]

Hi, Can the client communicate with EKS clusters at this point of time?

[naumvd95]

Subscribe and hope , that this feature will be implemented asap) ill try to investigate it by myself and do my best in help-offer

[fillbit]

Hi,

I am looking for this feature as well. Is anyone working on it? I'm willing to do work on it if not.

Phil

[dovreshef]

Hi

I've implemented it here: kubernetes-client/python-base#75.

[qubusp]

experiencing the same thing

import boto3 
import simplejson as json 
from base64 import b64decode
from kubernetes import client, config
from pprint import pprint
ecr = boto3.client('ecr',
    region_name='eu-central-1'
)


response = ecr.get_authorization_token()
raw_data=response['authorizationData'][0]['authorizationToken']
user, decoded_data=b64decode(raw_data).decode('UTF-8').split(":")


config.load_kube_config()
v1 = client.CoreV1Api()
namespace = 'default'
metadata = {'name': 'aws-login', 'namespace': 'dev'}
data = {'user': 'AWS', 'token': decoded_data}
api_version = 'v1'
kind = 'Secret'
body = client.V1Secret(api_version, data , kind, metadata, type='kubernetes.io/tls')
api_response = v1.create_namespaced_secret(namespace, body, async=True)
pprint(api_response)

The result is bad request 400. There is only one context on the machine.