Authentication with AWS broke with version 1.24

[azacchino]

What happened:

After update kubectl to 1.24 from 1.23 i get the message

Unable to connect to the server: getting credentials: decoding stdout: no kind "ExecCredential" is registered for version "client.authentication.k8s.io/v1alpha1" in scheme "pkg/client/auth/exec/exec.go:62"

when I try to perform any operation.

What you expected to happen:

ex: list pods

How to reproduce it (as minimally and precisely as possible):

.kube/config

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DA
    server: https://XXXXXXXXXXXXXXXXXXXXX.gr7.us-east-1.eks.amazonaws.com
  name: arn:aws:eks:us-east-1:XXXXXXXXX/cluster/test_cluster
contexts:
- context:
    cluster: arn:aws:eks:us-east-1:XXXXXXXXX/cluster/test_cluster
    user: arn:aws:eks:us-east-1:XXXXXXXXX/cluster/test_cluster
  name: arn:aws:eks:us-east-1:XXXXXXXXX/cluster/test_cluster
current-context: arn:aws:eks:us-east-1:XXXXXXXXX/cluster/test_cluster
kind: Config
preferences: {}
users:
- name: arn:aws:eks:us-east-1:XXXXXXXXX/cluster/test_cluster
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - --region
      - us-east-1
      - eks
      - get-token
      - --cluster-name
      - test_cluster
      command: aws

Anything else we need to know?:

Environment:

• Kubernetes client and server versions (use kubectl version): client 1.24 Server: 1.22

$ kubectl version
WARNING: This version information is deprecated and will be replaced with the output from kubectl version --short.  Use --output=yaml|json to get the full version.
Client Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.0", GitCommit:"4ce5a8954017644c5420bae81d72b09b735c21f0", GitTreeState:"clean", BuildDate:"2022-05-03T13:46:05Z", GoVersion:"go1.18.1", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.4
Unable to connect to the server: getting credentials: decoding stdout: no kind "ExecCredential" is registered for version "client.authentication.k8s.io/v1alpha1" in scheme "pkg/client/auth/exec/exec.go:62"

• Cloud provider or hardware configuration: AWS EKS
• OS (e.g: cat /etc/os-release Ubuntu 20.04.4 LTS

[k8s-ci-robot]

@azacchino: This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[code-is-art]

I am getting something similarly related switching from v1.23.6 to https://storage.googleapis.com/kubernetes-release/release/stable.txt which currently is v1.24.0.

aws eks update-kubeconfig --name ${EKS_CLUSTER_NAME} --region ${REGION}
kubectl version

I get

error: exec plugin: invalid apiVersion "client.authentication.k8s.io/v1alpha1"

[ismarslomic]

Same issue here

[appdog]

Probably related to this deprecation https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#deprecation

The client.authentication.k8s.io/v1alpha1 ExecCredential has been removed. If you are using a client-go credential plugin that relies on the v1alpha1 API please contact the distributor of your plugin for instructions on how to migrate to the v1 API. (kubernetes/kubernetes#108616, @margocrawf)

[robertorosas]

Running into the same scenario on our EKS deployments from Github Actions:

{Version:kustomize/v4.5.4 GitCommit:cf3a452ddd6f83945d39d582243b8592ec627ae3 BuildDate:2022-03-28T23:12:45Z GoOs:linux GoArch:amd64}
Unable to connect to the server: getting credentials: decoding stdout: no kind "ExecCredential" is registered for version "client.authentication.k8s.io/v1alpha1" in scheme "pkg/client/auth/exec/exec.go:62"

I was able to recreate by locally upgrading to kubectl 1.24 and running kubectl version:
error: exec plugin: invalid apiVersion "client.authentication.k8s.io/v1alpha1"

[vrodriguezcl]

Same issue here. :(.
Any walkaround of how to temporary solve this ?

[roccoblues]

I've you're using homebrew on a Mac you can downgrade with:

brew unlink kubernetes-cli
brew install [email protected]
brew link [email protected] --force

[bigLucas]

We have a fix on aws cli for this bug:
aws/aws-cli#6920 (comment)

[ismarslomic]

I can confirm that this issue is fixed in kubernetes-cli v1.24.0 and awscli v2.6.3 (installed on mac with homebrew). Just make sure that apiVersion in your cube config files is switched

from apiVersion: client.authentication.k8s.io/v1alpha1
to apiVersion: client.authentication.k8s.io/v1beta1

[ardaguclu]

This issue has been tracked in aws/aws-cli#6920 and it looks that this is not a bug regarding kubectl.

Thus, I'm closing that issue. If you think, there still is something related to kubectl, feel free re-open this issue again.

/close

[k8s-ci-robot]

@ardaguclu: Closing this issue.

In response to this:

This issue has been tracked in aws/aws-cli#6920 and it looks that this is not a bug regarding kubectl.

Thus, I'm closing that issue. If you think, there still is something related to kubectl, feel free re-open this issue again.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.