Deprecated authentication plugin for Kubernetes clients


In Kubernetes version 1.22, the Kubernetes project deprecated the built-in authentication mechanism used by clients such as the kubectl command-line tool to access the Kubernetes API server. The built-in authentication mechanism is scheduled for removal in Kubernetes 1.26. For context, refer to GitHub PR 102181.

The removal doesn't affect operators that are deployed in the cluster and use Kubernetes service accounts to communicate with the API server.

What should you do?

GKE released an updated authentication plugin, gke-gcloud-auth-plugin. This plugin uses the client-go Credential Plugins framework to provide authentication tokens to communicate with GKE clusters.

You must install the plugin before you update your command-line clients to version 1.26 and later. If you don't install the plugin, you'll notice an error message similar to the following.

For instructions, refer to Install required plugins.

Example error: No auth provider found

Unable to connect to the server: getting credentials: exec: executable gke-gcloud-auth-plugin not found

panic: no Auth Provider found for name gcp

Example error: Executable gke-cloud-auth-plugin not found

Unable to connect to the server: getting credentials: exec: executable gke-gcloud-auth-plugin not found

It looks like you are trying to use a client-go credential plugin that is not installed.

To learn more about this feature, consult the documentation available at:
      https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

Install gke-gcloud-auth-plugin for use with kubectl by following \
https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke.