Bearer Token is ignored by action.Configuration

[debarshibasak]

Note: This is not a helm bug, It is a k8s cli-runtime bug but it impacts helm. I am creating this issue as I am using this as reference in cli-runtime's issue.

see here and also here

While initializing genericclioptions.ConfigFlags with bearer Token, it is ignored during actionConfig.Init.

For Instance,

	actionConfig := new(action.Configuration)
	c := genericclioptions.NewConfigFlags(false)
        c.BearerToken := "some string pointer"

       if err := actionConfig.Init(c, namespace, os.Getenv("HELM_DRIVER"), func(format string, v ...interface{}) {}); err != nil {
		return nil, err
       }

If you output actionCfg.RESTClientGetter.ToRESTConfig()..BearerToken, it is empty. Therefore when helmClient is trying to perform any action, it fails.

I think it seems to be a kubernetes cli-runtime and clientcmd bug.

A workaround for solving this bug is to patch k8s.io/cli-runtime/pkg/genericclioptions/config_flags.go. Assign config's BearerToken with the flag's value.

func (f *ConfigFlags) ToRESTConfig() (*rest.Config, error) {
	config, err := f.ToRawKubeConfigLoader().ClientConfig()
	// replace client-go's ErrEmptyConfig error with our custom, more verbose version
	if clientcmd.IsEmptyConfig(err) {
		return nil, ErrEmptyConfig
	}

	config.BearerToken = *f.BearerToken

	return config, err
}

Output of helm version: 3.3.4
Output of kubectl version: 1.19.x

Cloud Provider/Platform (AKS, GKE, Minikube etc.):
All platforms

[mattfarina]

@debarshibasak thanks for finding this.

[github-actions]

This issue has been marked as stale because it has been open for 90 days with no activity. This thread will be automatically closed in 30 days if no further activity occurs.

[github-actions]

This issue has been marked as stale because it has been open for 90 days with no activity. This thread will be automatically closed in 30 days if no further activity occurs.

[Baytwt]

I also meet it today lol. The bug seems still exist on the master branch (@v0.28.3) when host starts with http.
Wont happen when host starts with https.

[Baytwt]

Solved by using WrapConfigFn which was added in the commit kubernetes/kubernetes@211fc12

clientConfig = new(genericclioptions.ConfigFlags)
clientConfig.APIServer = "..."
clientConfig.BearerToken = "..."
clientConfig.WrapConfigFn = func(c *rest.Config) *rest.Config{
  c.clientConfig = *clientConfig.BearerToken
  return c
}

// restConfig := clientConfig.ToRESTConfig()