exec credential provider: use stdin to detect user interaction

We are not sure why this was stdout, since stdin is what the user uses to pass
information to the exec plugin.

There is a question of backwards compatibility here. Our take is that this is a
bug, and so we are ameliorating behavior instead of breaking behavior. There are
2 main cases to consider with respect to backwards compatibility:

1. an existing exec plugin depended on stdin being hooked up to them if stdout
   was a terminal (e.g., echo foo | client-go-command-line-tool); we believe
   this is an anti-pattern, since the client-go-command-line-tool could be using
   stdin elsewhere (e.g., echo foo | kubectl apply -f -)

2. an existing exec plugin depended on stdin not being hooked up to them if
   stdout was not a terminal (e.g., client-go-command-line-tool >/dev/null);
   hopefully there are very few plugins that have tried to base logic off of
   whether stdin returned EOF immediately, since this could also happen when
   something else is wrong with stdin

We hope to apply a stronger fix to this exec plugin user interaction stuff in a
future release.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>

Kubernetes-commit: aea995c45ff057406b586144e28bd9575162b8df
This commit is contained in:
Andrew Keesler
2021-03-02 14:30:42 -05:00
committed by Kubernetes Publisher
parent a337294871
commit 149c501b92

View File

@@ -198,7 +198,7 @@ func newAuthenticator(c *cache, config *api.ExecConfig, cluster *clientauthentic
stdin: os.Stdin,
stderr: os.Stderr,
interactive: term.IsTerminal(int(os.Stdout.Fd())),
interactive: term.IsTerminal(int(os.Stdin.Fd())),
now: time.Now,
environ: os.Environ,