Pass cluster info to exec credential plugins (provideClusterInfo) by mutsaddi-deshaw · Pull Request #1808 · kubernetes-client/csharp

mutsaddi-deshaw · 2026-06-17T06:12:48Z

Implements support for provideClusterInfo: true in a kubeconfig user's exec block. Per the exec credential plugin protocol (client.authentication.k8s.io), when this flag is set the client passes the cluster's connection details to the plugin via spec.cluster in KUBERNETES_EXEC_INFO. The provideClusterInfo / installHint fields were added in #620, but forwarding the cluster info was left as a TODO (#618 / #620). This PR completes that.

Forwards server, insecure-skip-tls-verify, certificate-authority-data (resolved from inline data or a CA file path), tls-server-name, and the exec extension config.

Note: the AOT client forwards all scalar cluster fields but not config. The AOT ClusterEndpoint anyway omits Extensions currently.

k8s-ci-robot · 2026-06-17T06:12:54Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mutsaddi-deshaw
Once this PR has been reviewed and has the lgtm label, please assign brendandburns for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

linux-foundation-easycla · 2026-06-17T06:12:54Z

The committers listed above are authorized under a signed CLA.

✅ login: mutsaddi-deshaw / name: Atharva Mutsaddi (3749bdf, 4db8289, 5e2729f, 615741e, cce84f7, df9c643)

k8s-ci-robot · 2026-06-17T06:12:57Z

Welcome @mutsaddi-deshaw!

It looks like this is your first PR to kubernetes-client/csharp 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-client/csharp has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds support for passing cluster details to Kubernetes exec credential plugins (via KUBERNETES_EXEC_INFO.spec.cluster) and ensures CA data can be surfaced consistently (inline or file-resolved), with new unit tests covering cluster mapping/serialization.

Changes:

Add CaData to persist base64 CA data resolved from kubeconfig inline data or CA file path.
Extend exec credential flow to optionally include spec.cluster in KUBERNETES_EXEC_INFO, with shared ToExecClusterInfo conversion.
Add/expand tests validating cluster info mapping, optional field omission, and nested extension serialization.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
tests/KubernetesClient.Tests/ExternalExecutionTests.cs	Adds unit tests for exec cluster info mapping and inclusion/omission in `KUBERNETES_EXEC_INFO`.
src/KubernetesClient/KubernetesClientConfiguration.cs	Adds `CaData` property to retain resolved base64 CA data.
src/KubernetesClient/KubernetesClientConfiguration.ConfigFile.cs	Resolves/records `CaData`, adds cluster injection for exec plugins, and introduces `ToExecClusterInfo`.
src/KubernetesClient/Authentication/ExecTokenProvider.cs	Threads optional cluster info through token refresh exec calls.
src/KubernetesClient.Aot/KubernetesClientConfiguration.ConfigFile.cs	Mirrors exec cluster injection and `ToExecClusterInfo` for AOT build (without extensions).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Omit spec.cluster key when ProvideClusterInfo is false (don't emit null) - Omit insecure-skip-tls-verify when false (omitempty per spec) - Resolve CA from file path (mirroring client-go's dataFromSliceOrFile) - Use resolved Host/TlsServerName/CaData instead of raw kubeconfig values - Preserve binary compatibility via method overloads - Guard against cluster=null when ProvideClusterInfo=true - Add nested extension and edge-case tests

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

mutsaddi-deshaw · 2026-06-17T09:15:37Z

+            var execExtension = cluster.Extensions?
+                .FirstOrDefault(e => e.Name == "client.authentication.k8s.io/exec");
+            if (execExtension != null)
+            {
+                object extConfig = execExtension.Extension;
+                if (extConfig != null)
+                {
+                    node["config"] = JsonNode.Parse(JsonSerializer.Serialize(extConfig));
+                }
+            }


Dictionary<object, object> serialization with System.Text.Json is officially supported with default options when the runtime key type is a supported type. See Supported key types

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

mutsaddi-deshaw · 2026-06-17T09:25:49Z

+                object extConfig = execExtension.Extension;
+                if (extConfig != null)
+                {
+                    node["config"] = JsonNode.Parse(JsonSerializer.Serialize(extConfig));
+                }


Same as #1808 (comment)

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

mutsaddi-deshaw · 2026-06-18T15:45:13Z

+                    var caPath = GetFullPath(k8SConfig, clusterDetails.ClusterEndpoint.CertificateAuthority);
+                    CertificateAuthorityData = Convert.ToBase64String(File.ReadAllBytes(caPath));
+
+                    // File-path loaders auto-detect cert format (PEM/DER/PFX), which the
+                    // byte-based APIs do not reliably do on pre-.NET 9. The second read is


Can a non-PEM CA file can realistically occur? kubeconfig CA files are PEM per spec, and I think such a file wouldn't work with kubectl or client-go either. client-go appears to forward the raw bytes unchanged and the non-AOT C# client also seems to assume PEM (CertUtils.LoadPemFileCert). Do we have a real scenario that produces a DER/PFX CA in a kubeconfig? If not, I'd rather not add handling for input the spec disallows.

tg123 · 2026-06-22T16:28:14Z

@mutsaddi-deshaw clean up git commit author

mutsaddi-deshaw · 2026-06-22T16:38:23Z

@mutsaddi-deshaw clean up git commit author

@tg123 happy to fix, but could you clarify what you'd like cleaned up on the commit author?

Copilot AI review requested due to automatic review settings June 17, 2026 06:12

k8s-ci-robot requested review from brendandburns and tg123 June 17, 2026 06:12

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 17, 2026

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Pass cluster info to exec credential plugins (provideClusterInfo)

3749bdf

mutsaddi-deshaw force-pushed the mutsaddi-deshaw-provide-cluster-info branch from e6c77d0 to 3749bdf Compare June 17, 2026 06:30

Copilot AI review requested due to automatic review settings June 17, 2026 08:27

Copilot AI reviewed Jun 17, 2026

View reviewed changes

rename CaData to CertificateAuthorityData

615741e

mutsaddi-deshaw requested a review from Copilot June 17, 2026 09:17

Copilot AI reviewed Jun 17, 2026

View reviewed changes

make caByte reads PEM Safe

cce84f7

mutsaddi-deshaw requested a review from Copilot June 17, 2026 10:00

Copilot AI reviewed Jun 17, 2026

View reviewed changes

mutsaddi-deshaw added 2 commits June 18, 2026 11:10

Add ExecExtensionName constant and improve certificate loading logic

df9c643

Reset CA data so it always reflects the cluster currently being resolved

4db8289

Copilot AI review requested due to automatic review settings June 18, 2026 12:55

Copilot started reviewing on behalf of mutsaddi-deshaw June 18, 2026 12:55 View session

Copilot AI reviewed Jun 18, 2026

View reviewed changes

kubernetes-prow Bot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jun 22, 2026

Conversation

mutsaddi-deshaw commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Jun 17, 2026

Uh oh!

linux-foundation-easycla Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Jun 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

mutsaddi-deshaw Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

mutsaddi-deshaw Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

mutsaddi-deshaw Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tg123 commented Jun 22, 2026

Uh oh!

mutsaddi-deshaw commented Jun 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mutsaddi-deshaw commented Jun 17, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Jun 17, 2026 •

edited

Loading

mutsaddi-deshaw Jun 18, 2026 •

edited

Loading