kubectl没有获取正确的kubeconfig

Question

请在下面找到我正在执行的操作序列，以针对kubectl进行授权和身份验证，从而能够在EKS CLuster 上执行部署

1. SAML登录
2. 从Artifactory下载正确的kubeconfig
3. 使用下载的kubeconfig#问题发生在这个阶段

Jenkins执行日志如下：

Logged in as: arn:aws:sts::XXXXXXXXXXXX:assumed-role/dev-role/testusername
Your new access key pair has been stored in the AWS configuration
Note that it will expire at 2021-02-08 15:18:59 +0000 UTC
To use this credential, call the AWS CLI with the --profile option (e.g. aws --profile saml ec2 describe-instances).
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Compose Source Structure)
[Pipeline] sh
+ set -x
+ cat
+ kubectl config view
apiVersion: v1
clusters: []
contexts: []
current-context: ""
kind: Config
preferences: {}
users: []
+ rm -vf config
+ wget -nv --no-check-certificate https://testcompanyname.com.au/testrepo/jenkins/eks-nonprod-black-config
2021-02-08 14:19:35 URL:https://testcompanyname.com.au/testrepo/jenkins/eks-nonprod-black-config [2383/2383] -> "eks-nonprod-black-config" [1]
+ mv eks-nonprod-black-config config
+ pwd
/home/jenkins/agent/workspace/k8s-sync-from-cluster
+ ls -lrt
total 11640
-rwxrwxr-x    1 jenkins  jenkins   11801948 Feb 28  2017 saml2aws
-rw-r--r--    1 jenkins  jenkins       2383 Jan 22 03:03 config
drwxr-xr-x    2 jenkins  jenkins       4096 Feb  8 14:19 vars
drwxr-xr-x    3 jenkins  jenkins       4096 Feb  8 14:19 test
drwxr-xr-x    3 jenkins  jenkins       4096 Feb  8 14:19 src
-rw-r--r--    1 jenkins  jenkins        153 Feb  8 14:19 settings.gradle
drwxr-xr-x    9 jenkins  jenkins       4096 Feb  8 14:19 resources
drwxr-xr-x    5 jenkins  jenkins       4096 Feb  8 14:19 pipelines
-rw-r--r--    1 jenkins  jenkins       2841 Feb  8 14:19 gradlew.bat
-rwxr-xr-x    1 jenkins  jenkins       5916 Feb  8 14:19 gradlew
drwxr-xr-x    3 jenkins  jenkins       4096 Feb  8 14:19 gradle
drwxr-xr-x    3 jenkins  jenkins       4096 Feb  8 14:19 csa-kubernetes-env
-rw-r--r--    1 jenkins  jenkins       1532 Feb  8 14:19 build.gradle
-rw-r--r--    1 jenkins  jenkins        208 Feb  8 14:19 README.md
+ cat config
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
server: https://xxxxxxxxxxxxxxxxxxxxxxxxxx.gr7.ap-southeast-2.eks.amazonaws.com
name: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
contexts:
- context:
cluster: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
user: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
name: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
current-context: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
kind: Config
preferences: {}
users:
- name: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
user:
exec:
apiVersion: client.authentication.k8s.io/v1alpha1
args:
- --region
- ap-southeast-2
- eks
- get-token
- --cluster-name
- test-eks
command: aws
env:
- name: AWS_PROFILE
value: saml
+ kubectl config view --kubeconfig ./config
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: REDACTED
server: https://7FE00E432DC6BEB1EB17DEF18DB1B926.gr7.ap-southeast-2.eks.amazonaws.com
name: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
contexts:
- context:
cluster: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
user: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
name: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
current-context: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
kind: Config
preferences: {}
users:
- name: arn:aws:eks:ap-southeast-2:XXXXXXXXXXXX:cluster/test-eks
user: {}
+ kubectl get namespaces --kubeconfig ./config
Please enter Username: Please enter Username: Please enter Username: error: EOF
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
ERROR: script returned exit code 1
Finished: FAILURE

因此，正如您所看到的，问题是当我对文件进行cat时，会有用户信息，但当我运行kubectl时，它会在不应该的情况下查询凭据。

Answer 1

@learner我知道您已经通过将kubectl升级到新版本解决了问题
此外，我想提供更多关于Kubernetes组件版本及其之间关系的信息。

---

Kubernetesversion skew support policy描述了各种Kubernete组件之间支持的最大版本偏斜。您可以在版本倾斜策略文档中找到更多信息。

我将描述一般规则来说明它是如何工作的。

让我们假设kube-apiserver的版本1.n。在这种情况下：

• kubelet和kube-proxy在1.n、1.(n-1)和1.(n-2)
• kube-controller-manager、kube-scheduler和1.n和1.(n-1)支持cloud-controller-manager
• kubectl在1。(n+1)、1.n和1.(n-1)
  
  上受支持

注意：CoreDNS和etcd是独立的项目，它们有自己的版本。

Answer 2

这听起来可能很傻，但问题出在kubectl客户端版本上。

这个问题是因为我使用的是kubectl 1.9，升级到最新版本解决了这个问题。