Is there a standalone binary version of gke-gcloud-auth-plugin (no gcloud->python dep)?

[traviswt]

Per this post https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke we have to use the gke-gcloud-auth-plugin going forward.

This approach looks great for kubectl interactions, but for k8s.io/client-go I am a bit confused by the proposed implementation. It appears that the gke-gcloud-auth-plugin is a wrapper around gcloud that is implemented in python.

This means that after adding the proper dependencies and abandoning my distroless image, which was 98MB, it is now 1.4GB, not distroless, and has many security issues when snyk scanned.

I would appreciate some guidance here and hope there is an actual standalone binary version of the gke-gcloud-auth-plugin. Does this exist?

Is there another approach that does not have this large dependency graph?

[garisingh]

Are you running this container within your GKE cluster itself?
If so, are you only connecting to the API server of the cluster in which you are running the image?

[traviswt]

This is outside of the cluster. We have automation applications that interact from a central location across GKE, EKS, and AKS. 

[garisingh · Accepted solution]

Have a look at https://github.com/kubernetes/cloud-provider-gcp/tree/master/pkg/clientauthplugin .
Even though it won't continue to be supported, you can use it as a reference.

You might also want to have a look at https://gist.github.com/ahmetb/548059cdbf12fb571e4e2f1e29c48997 .
It's a pretty clean example of using the native GCP auth libs directly as well.

[traviswt]

So it seems there will not be a Google built and supported standalone binary as of now? Only the plugin->gcloud->python mechanism. All golang implementations will have to include python in their images to auth with GKE if outside of the cluster?

[traviswt]

I learned from the gist and created a drop-in replacement standalone binary; thanks for the insights and advice.

 https://github.com/traviswt/gke-auth-plugin