/ 
Kubernetes-REST-1.110
⭐ Starred 2 / Kubernetes::REST::AuthExec

NAME

Kubernetes::REST::AuthExec - Bearer token from an exec credential plugin, run again before it expires

VERSION

version 1.110

SYNOPSIS

use Kubernetes::REST::AuthExec;

my $auth = Kubernetes::REST::AuthExec->new(
    command => 'aws',
    args    => [qw( eks get-token --cluster-name prod )],
);

my $api = Kubernetes::REST->new(
    server      => $server,
    credentials => $auth,
);

DESCRIPTION

Authentication credentials from a kubeconfig exec block (kubectl's exec-credential-plugin mechanism, used for cloud IAM logins such as aws eks get-token). The plugin is run when the object is built, and its output - YAML, which also accepts the JSON real plugins emit - supplies status.token and optionally status.expirationTimestamp.

The plugin is run again when the expirationTimestamp lies within "expiry_margin" seconds of now (or already behind it). A plugin that reports no expirationTimestamp is never run a second time: the token is taken to be valid for as long as the object lives.

The first run is fatal: the constructor dies if the plugin cannot be started, is killed, exits non-zero, or returns no token, because there is nothing to fall back on yet. A later run that fails only warns and the last good token stays in use. Nothing runs the plugin again in reaction to a 401 from the cluster; a token the server rejects before its announced expiry stays in use until the margin is reached.

Only token plugins are supported. A plugin that answers with clientCertificateData/clientKeyData and no token makes the constructor die with exec credential did not return a token: only token plugins are supported, not client certificate credentials.

Kubernetes::REST asks its credentials for a token() on every request, so passing one of these is all a long-running process needs.

command

Required. The plugin program, run without a shell.

args

Array reference of arguments, each one argv element. Defaults to none.

env

Array reference of { name => ..., value => ... } entries set in the plugin's environment.

expiry_margin

Seconds before expirationTimestamp at which the plugin is run again. Defaults to 60. Has no effect for a plugin that reports no expirationTimestamp.

description

How this credential is named in error messages.

token

my $token = $auth->token;

The bearer token. Runs the plugin again when its expirationTimestamp is within expiry_margin seconds; without an expirationTimestamp the token is never renewed. A failed re-run warns and keeps the last good token.

SEE ALSO

SUPPORT

Issues

Please report bugs and feature requests on GitHub at https://github.com/pplu/kubernetes-rest/issues.

IRC

Join #kubernetes on irc.perl.org or message Getty directly.

CONTRIBUTING

Contributions are welcome! Please fork the repository and submit a pull request.

AUTHORS

  • Torsten Raudssus <getty@cpan.org>

  • Jose Luis Martinez Torres <jlmartin@cpan.org>

COPYRIGHT AND LICENSE

This software is Copyright (c) 2019-2026 by Jose Luis Martinez Torres <jlmartin@cpan.org>.

This is free software, licensed under:

The Apache License, Version 2.0, January 2004