Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[k8s] Support exec based auth kubeconfigs on controllers #4379

Open
romilbhardwaj opened this issue Nov 17, 2024 · 0 comments
Open

[k8s] Support exec based auth kubeconfigs on controllers #4379

romilbhardwaj opened this issue Nov 17, 2024 · 0 comments
Labels
help wanted Extra attention is needed k8s Kubernetes related items

Comments

@romilbhardwaj
Copy link
Collaborator

GKE and EKS rely on exec based auth in the kubeconfig to authenticate with the k8s API server. This is currently not supported on SkyPilot controllers:

Using exec-based authentication is problematic when used in conjunction
with kubernetes.remote_identity = LOCAL_CREDENTIAL in ~/.sky/config.yaml.
This is because the exec-based authentication may not have the relevant
dependencies installed on the remote cluster or may have hardcoded paths
that are not available on the remote cluster.

The current suggested workaround is to create a kubeconfig that uses token based auth with a service account (generate_kubeconfig.sh).

This workaround introduces friction for users, and may not be be feasible in environments where users cannot create service accounts.

We should support exec based auth, maybe starting with supporting GKE and EKS. This would require installing relevant dependencies and copying over the cloud credentials.

@romilbhardwaj romilbhardwaj added the k8s Kubernetes related items label Nov 26, 2024
@romilbhardwaj romilbhardwaj added the help wanted Extra attention is needed label Dec 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted Extra attention is needed k8s Kubernetes related items
Projects
None yet
Development

No branches or pull requests

1 participant