exec credential provider: ProvideClusterInfo and kubeconfig shadow

- The main idea here is that we want to 1) prevent potentially large CA
  bundles from being set in an exec plugin's environment and 2) ensure
  that the exec plugin is getting everything it needs in order to talk to
  a cluster.
- Avoid breaking existing manual declarations of rest.Config instances by
  moving exec Cluster to kubeconfig internal type.
- Use client.authentication.k8s.io/exec to qualify exec cluster extension.
- Deep copy the exec Cluster.Config when we copy a rest.Config.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>

Kubernetes-commit: c4299d15d5289768808034676858e76a177eeae5

rest/config.go

@@ -87,7 +87,7 @@ type Config struct {
 	AuthConfigPersister AuthProviderConfigPersister
 
 	// Exec-based authentication provider.
-	Exec Exec
+	ExecProvider *clientcmdapi.ExecConfig
 
 	// TLSClientConfig contains settings to enable transport layer security
 	TLSClientConfig
@@ -192,40 +192,12 @@ func (c *Config) String() string {
 	if cc.AuthConfigPersister != nil {
 		cc.AuthConfigPersister = sanitizedAuthConfigPersister{cc.AuthConfigPersister}
 	}
-	if cc.Exec.Config != nil {
-		cc.Exec.Config = sanitizedObject{Object: cc.Exec.Config}
+	if cc.ExecProvider != nil && cc.ExecProvider.Config != nil {
+		cc.ExecProvider.Config = sanitizedObject{Object: cc.ExecProvider.Config}
 	}
 	return fmt.Sprintf("%#v", cc)
 }
 
-// Exec plugin authentication provider.
-type Exec struct {
-	// ExecProvider provides the config needed to execute the exec plugin.
-	ExecProvider *clientcmdapi.ExecConfig
-
-	// Config holds additional config data that is specific to the exec
-	// plugin with regards to the cluster being authenticated to.
-	//
-	// This data is sourced from the clientcmd Cluster object's extensions[exec] field:
-	//
-	// clusters:
-	// - name: my-cluster
-	//   cluster:
-	//     ...
-	//     extensions:
-	//     - name: exec  # reserved extension name for per cluster exec config
-	//       extension:
-	//         audience: 06e3fbd18de8  # arbitrary config
-	//
-	// In some environments, the user config may be exactly the same across many clusters
-	// (i.e. call this exec plugin) minus some details that are specific to each cluster
-	// such as the audience.  This field allows the per cluster config to be directly
-	// specified with the cluster info.  Using this field to store secret data is not
-	// recommended as one of the prime benefits of exec plugins is that no secrets need
-	// to be stored directly in the kubeconfig.
-	Config runtime.Object
-}
-
 // ImpersonationConfig has all the available impersonation options
 type ImpersonationConfig struct {
 	// UserName is the username to impersonate on each request.
@@ -627,7 +599,7 @@ func AnonymousClientConfig(config *Config) *Config {
 
 // CopyConfig returns a copy of the given config
 func CopyConfig(config *Config) *Config {
-	return &Config{
+	c := &Config{
 		Host:            config.Host,
 		APIPath:         config.APIPath,
 		ContentConfig:   config.ContentConfig,
@@ -642,10 +614,7 @@ func CopyConfig(config *Config) *Config {
 		},
 		AuthProvider:        config.AuthProvider,
 		AuthConfigPersister: config.AuthConfigPersister,
-		Exec: Exec{
-			ExecProvider: config.Exec.ExecProvider,
-			Config:       config.Exec.Config,
-		},
+		ExecProvider:        config.ExecProvider,
 		TLSClientConfig: TLSClientConfig{
 			Insecure:   config.TLSClientConfig.Insecure,
 			ServerName: config.TLSClientConfig.ServerName,
@@ -669,4 +638,8 @@ func CopyConfig(config *Config) *Config {
 		Dial:               config.Dial,
 		Proxy:              config.Proxy,
 	}
+	if config.ExecProvider != nil && config.ExecProvider.Config != nil {
+		c.ExecProvider.Config = config.ExecProvider.Config.DeepCopyObject()
+	}
+	return c
 }

rest/config_test.go

@@ -358,8 +358,7 @@ func TestAnonymousConfig(t *testing.T) {
 		expected.Password = ""
 		expected.AuthProvider = nil
 		expected.AuthConfigPersister = nil
-		expected.Exec.ExecProvider = nil
-		expected.Exec.Config = nil
+		expected.ExecProvider = nil
 		expected.TLSClientConfig.CertData = nil
 		expected.TLSClientConfig.CertFile = ""
 		expected.TLSClientConfig.KeyData = nil
@@ -535,12 +534,10 @@ func TestConfigStringer(t *testing.T) {
 				AuthProvider: &clientcmdapi.AuthProviderConfig{
 					Config: map[string]string{"secret": "s3cr3t"},
 				},
-				Exec: Exec{
-					ExecProvider: &clientcmdapi.ExecConfig{
-						Args: []string{"secret"},
-						Env:  []clientcmdapi.ExecEnvVar{{Name: "secret", Value: "s3cr3t"}},
-					},
-					Config: &runtime.Unknown{Raw: []byte("super secret password")},
+				ExecProvider: &clientcmdapi.ExecConfig{
+					Args:   []string{"secret"},
+					Env:    []clientcmdapi.ExecEnvVar{{Name: "secret", Value: "s3cr3t"}},
+					Config: &runtime.Unknown{Raw: []byte("here is some config data")},
 				},
 			},
 			expectContent: []string{
@@ -559,7 +556,7 @@ func TestConfigStringer(t *testing.T) {
 				formatBytes([]byte("fake key")),
 				"secret",
 				"s3cr3t",
-				"super secret password",
+				"here is some config data",
 				formatBytes([]byte("super secret password")),
 			},
 		},
@@ -603,13 +600,12 @@ func TestConfigSprint(t *testing.T) {
 			Config: map[string]string{"secret": "s3cr3t"},
 		},
 		AuthConfigPersister: fakeAuthProviderConfigPersister{},
-		Exec: Exec{
-			ExecProvider: &clientcmdapi.ExecConfig{
-				Command: "sudo",
-				Args:    []string{"secret"},
-				Env:     []clientcmdapi.ExecEnvVar{{Name: "secret", Value: "s3cr3t"}},
-			},
-			Config: &runtime.Unknown{Raw: []byte("super secret password")},
+		ExecProvider: &clientcmdapi.ExecConfig{
+			Command:            "sudo",
+			Args:               []string{"secret"},
+			Env:                []clientcmdapi.ExecEnvVar{{Name: "secret", Value: "s3cr3t"}},
+			ProvideClusterInfo: true,
+			Config:             &runtime.Unknown{Raw: []byte("super secret password")},
 		},
 		TLSClientConfig: TLSClientConfig{
 			CertFile:   "a.crt",
@@ -630,7 +626,7 @@ func TestConfigSprint(t *testing.T) {
 		Proxy:          fakeProxyFunc,
 	}
 	want := fmt.Sprintf(
-		`&rest.Config{Host:"localhost:8080", APIPath:"v1", ContentConfig:rest.ContentConfig{AcceptContentTypes:"application/json", ContentType:"application/json", GroupVersion:(*schema.GroupVersion)(nil), NegotiatedSerializer:runtime.NegotiatedSerializer(nil)}, Username:"gopher", Password:"--- REDACTED ---", BearerToken:"--- REDACTED ---", BearerTokenFile:"", Impersonate:rest.ImpersonationConfig{UserName:"gopher2", Groups:[]string(nil), Extra:map[string][]string(nil)}, AuthProvider:api.AuthProviderConfig{Name: "gopher", Config: map[string]string{--- REDACTED ---}}, AuthConfigPersister:rest.AuthProviderConfigPersister(--- REDACTED ---), Exec:rest.Exec{ExecProvider:api.AuthProviderConfig{Command: "sudo", Args: []string{"--- REDACTED ---"}, Env: []ExecEnvVar{--- REDACTED ---}, APIVersion: ""}, Config:runtime.Object(--- REDACTED ---)}, TLSClientConfig:rest.sanitizedTLSClientConfig{Insecure:false, ServerName:"", CertFile:"a.crt", KeyFile:"a.key", CAFile:"", CertData:[]uint8{0x2d, 0x2d, 0x2d, 0x20, 0x54, 0x52, 0x55, 0x4e, 0x43, 0x41, 0x54, 0x45, 0x44, 0x20, 0x2d, 0x2d, 0x2d}, KeyData:[]uint8{0x2d, 0x2d, 0x2d, 0x20, 0x52, 0x45, 0x44, 0x41, 0x43, 0x54, 0x45, 0x44, 0x20, 0x2d, 0x2d, 0x2d}, CAData:[]uint8(nil), NextProtos:[]string{"h2", "http/1.1"}}, UserAgent:"gobot", DisableCompression:false, Transport:(*rest.fakeRoundTripper)(%p), WrapTransport:(transport.WrapperFunc)(%p), QPS:1, Burst:2, RateLimiter:(*rest.fakeLimiter)(%p), WarningHandler:rest.fakeWarningHandler{}, Timeout:3000000000, Dial:(func(context.Context, string, string) (net.Conn, error))(%p), Proxy:(func(*http.Request) (*url.URL, error))(%p)}`,
+		`&rest.Config{Host:"localhost:8080", APIPath:"v1", ContentConfig:rest.ContentConfig{AcceptContentTypes:"application/json", ContentType:"application/json", GroupVersion:(*schema.GroupVersion)(nil), NegotiatedSerializer:runtime.NegotiatedSerializer(nil)}, Username:"gopher", Password:"--- REDACTED ---", BearerToken:"--- REDACTED ---", BearerTokenFile:"", Impersonate:rest.ImpersonationConfig{UserName:"gopher2", Groups:[]string(nil), Extra:map[string][]string(nil)}, AuthProvider:api.AuthProviderConfig{Name: "gopher", Config: map[string]string{--- REDACTED ---}}, AuthConfigPersister:rest.AuthProviderConfigPersister(--- REDACTED ---), ExecProvider:api.ExecConfig{Command: "sudo", Args: []string{"--- REDACTED ---"}, Env: []ExecEnvVar{--- REDACTED ---}, APIVersion: "", ProvideClusterInfo: true, Config: runtime.Object(--- REDACTED ---)}, TLSClientConfig:rest.sanitizedTLSClientConfig{Insecure:false, ServerName:"", CertFile:"a.crt", KeyFile:"a.key", CAFile:"", CertData:[]uint8{0x2d, 0x2d, 0x2d, 0x20, 0x54, 0x52, 0x55, 0x4e, 0x43, 0x41, 0x54, 0x45, 0x44, 0x20, 0x2d, 0x2d, 0x2d}, KeyData:[]uint8{0x2d, 0x2d, 0x2d, 0x20, 0x52, 0x45, 0x44, 0x41, 0x43, 0x54, 0x45, 0x44, 0x20, 0x2d, 0x2d, 0x2d}, CAData:[]uint8(nil), NextProtos:[]string{"h2", "http/1.1"}}, UserAgent:"gobot", DisableCompression:false, Transport:(*rest.fakeRoundTripper)(%p), WrapTransport:(transport.WrapperFunc)(%p), QPS:1, Burst:2, RateLimiter:(*rest.fakeLimiter)(%p), WarningHandler:rest.fakeWarningHandler{}, Timeout:3000000000, Dial:(func(context.Context, string, string) (net.Conn, error))(%p), Proxy:(func(*http.Request) (*url.URL, error))(%p)}`,
 		c.Transport, fakeWrapperFunc, c.RateLimiter, fakeDialFunc, fakeProxyFunc,
 	)
 

rest/exec.go

@@ -0,0 +1,85 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package rest
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"k8s.io/client-go/pkg/apis/clientauthentication"
+	clientauthenticationapi "k8s.io/client-go/pkg/apis/clientauthentication"
+)
+
+// This file contains Config logic related to exec credential plugins.
+
+// ConfigToExecCluster creates a clientauthenticationapi.Cluster with the corresponding fields from
+// the provided Config.
+func ConfigToExecCluster(config *Config) (*clientauthenticationapi.Cluster, error) {
+	caData, err := dataFromSliceOrFile(config.CAData, config.CAFile)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load CA bundle for execProvider: %v", err)
+	}
+
+	var proxyURL string
+	if config.Proxy != nil {
+		req, err := http.NewRequest("", config.Host, nil)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create proxy URL request for execProvider: %w", err)
+		}
+		url, err := config.Proxy(req)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get proxy URL for execProvider: %w", err)
+		}
+		if url != nil {
+			proxyURL = url.String()
+		}
+	}
+
+	return &clientauthentication.Cluster{
+		Server:                   config.Host,
+		TLSServerName:            config.ServerName,
+		InsecureSkipTLSVerify:    config.Insecure,
+		CertificateAuthorityData: caData,
+		ProxyURL:                 proxyURL,
+		Config:                   config.ExecProvider.Config,
+	}, nil
+}
+
+// ExecClusterToConfig creates a Config with the corresponding fields from the provided
+// clientauthenticationapi.Cluster. The returned Config will be anonymous (i.e., it will not have
+// any authentication-related fields set).
+func ExecClusterToConfig(cluster *clientauthentication.Cluster) (*Config, error) {
+	var proxy func(*http.Request) (*url.URL, error)
+	if cluster.ProxyURL != "" {
+		proxyURL, err := url.Parse(cluster.ProxyURL)
+		if err != nil {
+			return nil, fmt.Errorf("cannot parse proxy URL: %w", err)
+		}
+		proxy = http.ProxyURL(proxyURL)
+	}
+
+	return &Config{
+		Host: cluster.Server,
+		TLSClientConfig: TLSClientConfig{
+			Insecure:   cluster.InsecureSkipTLSVerify,
+			ServerName: cluster.TLSServerName,
+			CAData:     cluster.CertificateAuthorityData,
+		},
+		Proxy: proxy,
+	}, nil
+}

rest/exec_test.go

@@ -0,0 +1,384 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package rest
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	fuzz "github.com/google/gofuzz"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/pkg/apis/clientauthentication"
+	clientauthenticationapi "k8s.io/client-go/pkg/apis/clientauthentication"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+	"k8s.io/client-go/transport"
+	"k8s.io/client-go/util/flowcontrol"
+)
+
+func TestConfigToExecCluster(t *testing.T) {
+	t.Parallel()
+
+	const proxyURL = "https://some-proxy-url.com/tuna/fish"
+	proxy := func(r *http.Request) (*url.URL, error) {
+		return url.Parse(proxyURL)
+	}
+
+	tests := []struct {
+		name            string
+		in              Config
+		wantOut         clientauthenticationapi.Cluster
+		wantErrorPrefix string
+	}{
+		{
+			name: "CA data from memory",
+			in: Config{
+				ExecProvider: &clientcmdapi.ExecConfig{
+					ProvideClusterInfo: true,
+					Config: &runtime.Unknown{
+						Raw: []byte("stuff"),
+					},
+				},
+				Host: "some-host",
+				TLSClientConfig: TLSClientConfig{
+					ServerName: "some-server-name",
+					Insecure:   true,
+					CAData:     []byte("some-ca-data"),
+				},
+				Proxy: proxy,
+			},
+			wantOut: clientauthenticationapi.Cluster{
+				Server:                   "some-host",
+				TLSServerName:            "some-server-name",
+				InsecureSkipTLSVerify:    true,
+				CertificateAuthorityData: []byte("some-ca-data"),
+				ProxyURL:                 proxyURL,
+				Config: &runtime.Unknown{
+					Raw: []byte("stuff"),
+				},
+			},
+		},
+		{
+			name: "CA data from file",
+			in: Config{
+				ExecProvider: &clientcmdapi.ExecConfig{
+					ProvideClusterInfo: true,
+					Config: &runtime.Unknown{
+						Raw: []byte("stuff"),
+					},
+				},
+				Host: "some-host",
+				TLSClientConfig: TLSClientConfig{
+					ServerName: "some-server-name",
+					Insecure:   true,
+					CAFile:     "testdata/ca.pem",
+				},
+				Proxy: proxy,
+			},
+			wantOut: clientauthenticationapi.Cluster{
+				Server:                   "some-host",
+				TLSServerName:            "some-server-name",
+				InsecureSkipTLSVerify:    true,
+				CertificateAuthorityData: []byte("a CA bundle lives here"),
+				ProxyURL:                 proxyURL,
+				Config: &runtime.Unknown{
+					Raw: []byte("stuff"),
+				},
+			},
+		},
+		{
+			name: "no CA data",
+			in: Config{
+				ExecProvider: &clientcmdapi.ExecConfig{
+					ProvideClusterInfo: true,
+				},
+				TLSClientConfig: TLSClientConfig{
+					CAFile: "this-file-does-not-exist",
+				},
+			},
+			wantErrorPrefix: "failed to load CA bundle for execProvider: ",
+		},
+		{
+			name: "nil proxy",
+			in: Config{
+				ExecProvider: &clientcmdapi.ExecConfig{
+					ProvideClusterInfo: true,
+					Config: &runtime.Unknown{
+						Raw: []byte("stuff"),
+					},
+				},
+				Host: "some-host",
+				TLSClientConfig: TLSClientConfig{
+					ServerName: "some-server-name",
+					Insecure:   true,
+					CAFile:     "testdata/ca.pem",
+				},
+			},
+			wantOut: clientauthenticationapi.Cluster{
+				Server:                   "some-host",
+				TLSServerName:            "some-server-name",
+				InsecureSkipTLSVerify:    true,
+				CertificateAuthorityData: []byte("a CA bundle lives here"),
+				Config: &runtime.Unknown{
+					Raw: []byte("stuff"),
+				},
+			},
+		},
+		{
+			name: "bad proxy",
+			in: Config{
+				ExecProvider: &clientcmdapi.ExecConfig{
+					ProvideClusterInfo: true,
+				},
+				Proxy: func(_ *http.Request) (*url.URL, error) {
+					return nil, errors.New("some proxy error")
+				},
+			},
+			wantErrorPrefix: "failed to get proxy URL for execProvider: some proxy error",
+		},
+		{
+			name: "proxy returns nil",
+			in: Config{
+				ExecProvider: &clientcmdapi.ExecConfig{
+					ProvideClusterInfo: true,
+				},
+				Proxy: func(_ *http.Request) (*url.URL, error) {
+					return nil, nil
+				},
+				Host: "some-host",
+				TLSClientConfig: TLSClientConfig{
+					ServerName: "some-server-name",
+					Insecure:   true,
+					CAFile:     "testdata/ca.pem",
+				},
+			},
+			wantOut: clientauthenticationapi.Cluster{
+				Server:                   "some-host",
+				TLSServerName:            "some-server-name",
+				InsecureSkipTLSVerify:    true,
+				CertificateAuthorityData: []byte("a CA bundle lives here"),
+			},
+		},
+		{
+			name: "invalid config host",
+			in: Config{
+				ExecProvider: &clientcmdapi.ExecConfig{
+					ProvideClusterInfo: true,
+				},
+				Proxy: func(_ *http.Request) (*url.URL, error) {
+					return nil, nil
+				},
+				Host: "invalid-config-host\n",
+			},
+			wantErrorPrefix: "failed to create proxy URL request for execProvider: ",
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			out, err := ConfigToExecCluster(&test.in)
+			if test.wantErrorPrefix != "" {
+				if err == nil {
+					t.Error("wanted error")
+				} else if !strings.HasPrefix(err.Error(), test.wantErrorPrefix) {
+					t.Errorf("wanted error prefix %q, got %q", test.wantErrorPrefix, err.Error())
+				}
+			} else if diff := cmp.Diff(&test.wantOut, out); diff != "" {
+				t.Errorf("unexpected returned cluster: -got, +want:\n %s", diff)
+			}
+		})
+	}
+}
+
+func TestConfigToExecClusterRoundtrip(t *testing.T) {
+	t.Parallel()
+
+	f := fuzz.New().NilChance(0.5).NumElements(1, 1)
+	f.Funcs(
+		func(r *runtime.Codec, f fuzz.Continue) {
+			codec := &fakeCodec{}
+			f.Fuzz(codec)
+			*r = codec
+		},
+		func(r *http.RoundTripper, f fuzz.Continue) {
+			roundTripper := &fakeRoundTripper{}
+			f.Fuzz(roundTripper)
+			*r = roundTripper
+		},
+		func(fn *func(http.RoundTripper) http.RoundTripper, f fuzz.Continue) {
+			*fn = fakeWrapperFunc
+		},
+		func(fn *transport.WrapperFunc, f fuzz.Continue) {
+			*fn = fakeWrapperFunc
+		},
+		func(r *runtime.NegotiatedSerializer, f fuzz.Continue) {
+			serializer := &fakeNegotiatedSerializer{}
+			f.Fuzz(serializer)
+			*r = serializer
+		},
+		func(r *flowcontrol.RateLimiter, f fuzz.Continue) {
+			limiter := &fakeLimiter{}
+			f.Fuzz(limiter)
+			*r = limiter
+		},
+		func(h *WarningHandler, f fuzz.Continue) {
+			*h = &fakeWarningHandler{}
+		},
+		// Authentication does not require fuzzer
+		func(r *AuthProviderConfigPersister, f fuzz.Continue) {},
+		func(r *clientcmdapi.AuthProviderConfig, f fuzz.Continue) {
+			r.Config = map[string]string{}
+		},
+		func(r *func(ctx context.Context, network, addr string) (net.Conn, error), f fuzz.Continue) {
+			*r = fakeDialFunc
+		},
+		func(r *func(*http.Request) (*url.URL, error), f fuzz.Continue) {
+			*r = fakeProxyFunc
+		},
+		func(r *runtime.Object, f fuzz.Continue) {
+			unknown := &runtime.Unknown{}
+			f.Fuzz(unknown)
+			*r = unknown
+		},
+	)
+	for i := 0; i < 100; i++ {
+		expected := &Config{}
+		f.Fuzz(expected)
+
+		// This is the list of known fields that this roundtrip doesn't care about. We should add new
+		// fields to this list if we don't want to roundtrip them on exec cluster conversion.
+		expected.APIPath = ""
+		expected.ContentConfig = ContentConfig{}
+		expected.Username = ""
+		expected.Password = ""
+		expected.BearerToken = ""
+		expected.BearerTokenFile = ""
+		expected.Impersonate = ImpersonationConfig{}
+		expected.AuthProvider = nil
+		expected.AuthConfigPersister = nil
+		expected.ExecProvider = &clientcmdapi.ExecConfig{} // ConfigToExecCluster assumes != nil.
+		expected.TLSClientConfig.CertFile = ""
+		expected.TLSClientConfig.KeyFile = ""
+		expected.TLSClientConfig.CAFile = ""
+		expected.TLSClientConfig.CertData = nil
+		expected.TLSClientConfig.KeyData = nil
+		expected.TLSClientConfig.NextProtos = nil
+		expected.UserAgent = ""
+		expected.DisableCompression = false
+		expected.Transport = nil
+		expected.WrapTransport = nil
+		expected.QPS = 0.0
+		expected.Burst = 0
+		expected.RateLimiter = nil
+		expected.WarningHandler = nil
+		expected.Timeout = 0
+		expected.Dial = nil
+
+		// Manually set URLs so we don't get an error when parsing these during the roundtrip.
+		if expected.Host != "" {
+			expected.Host = "https://some-server-url.com/tuna/fish"
+		}
+		if expected.Proxy != nil {
+			expected.Proxy = func(_ *http.Request) (*url.URL, error) {
+				return url.Parse("https://some-proxy-url.com/tuna/fish")
+			}
+		}
+
+		cluster, err := ConfigToExecCluster(expected)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		actual, err := ExecClusterToConfig(cluster)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if actual.Proxy != nil {
+			actualURL, actualErr := actual.Proxy(nil)
+			expectedURL, expectedErr := expected.Proxy(nil)
+			if actualErr != nil {
+				t.Fatalf("failed to get url from actual proxy func: %s", actualErr.Error())
+			}
+			if expectedErr != nil {
+				t.Fatalf("failed to get url from expected proxy func: %s", actualErr.Error())
+			}
+			if diff := cmp.Diff(actualURL, expectedURL); diff != "" {
+				t.Fatal("we dropped the Config.Proxy field during conversion")
+			}
+		}
+		actual.Proxy = nil
+		expected.Proxy = nil
+
+		if actual.ExecProvider != nil {
+			t.Fatal("expected actual Config.ExecProvider field to be set to nil")
+		}
+		actual.ExecProvider = nil
+		expected.ExecProvider = nil
+
+		if diff := cmp.Diff(actual, expected); diff != "" {
+			t.Fatalf("we dropped some Config fields during roundtrip, -got, +want:\n %s", diff)
+		}
+	}
+}
+
+func TestExecClusterToConfigRoundtrip(t *testing.T) {
+	t.Parallel()
+
+	f := fuzz.New().NilChance(0.5).NumElements(1, 1)
+	f.Funcs(
+		func(r *runtime.Object, f fuzz.Continue) {
+			// We don't expect the clientauthentication.Cluster.Config to show up in the Config that
+			// comes back from the roundtrip, so just set it to nil.
+			*r = nil
+		},
+	)
+	for i := 0; i < 100; i++ {
+		expected := &clientauthentication.Cluster{}
+		f.Fuzz(expected)
+
+		// Manually set URLs so we don't get an error when parsing these during the roundtrip.
+		if expected.Server != "" {
+			expected.Server = "https://some-server-url.com/tuna/fish"
+		}
+		if expected.ProxyURL != "" {
+			expected.ProxyURL = "https://some-proxy-url.com/tuna/fish"
+		}
+
+		config, err := ExecClusterToConfig(expected)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// ConfigToExecCluster assumes config.ExecProvider is not nil.
+		config.ExecProvider = &clientcmdapi.ExecConfig{}
+
+		actual, err := ConfigToExecCluster(config)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if diff := cmp.Diff(actual, expected); diff != "" {
+			t.Fatalf("we dropped some Cluster fields during roundtrip: -got, +want:\n %s", diff)
+		}
+	}
+}

rest/testdata/ca.pem

@@ -0,0 +1 @@
+a CA bundle lives here

rest/transport.go

@@ -19,7 +19,6 @@ package rest
 import (
 	"crypto/tls"
 	"errors"
-	"fmt"
 	"net/http"
 
 	"k8s.io/client-go/pkg/apis/clientauthentication"
@@ -91,22 +90,20 @@ func (c *Config) TransportConfig() (*transport.Config, error) {
 		Proxy: c.Proxy,
 	}
 
-	if c.Exec.ExecProvider != nil && c.AuthProvider != nil {
+	if c.ExecProvider != nil && c.AuthProvider != nil {
 		return nil, errors.New("execProvider and authProvider cannot be used in combination")
 	}
 
-	if c.Exec.ExecProvider != nil {
-		caData, err := dataFromSliceOrFile(c.CAData, c.CAFile)
-		if err != nil {
-			return nil, fmt.Errorf("failed to load CA bundle for execProvider: %v", err)
+	if c.ExecProvider != nil {
+		var cluster *clientauthentication.Cluster
+		if c.ExecProvider.ProvideClusterInfo {
+			var err error
+			cluster, err = ConfigToExecCluster(c)
+			if err != nil {
+				return nil, err
+			}
 		}
-		cluster := clientauthentication.Cluster{
-			Server:     c.Host,
-			ServerName: c.TLSClientConfig.ServerName,
-			CAData:     caData,
-			Config:     c.Exec.Config,
-		}
-		provider, err := exec.GetAuthenticator(c.Exec.ExecProvider, cluster)
+		provider, err := exec.GetAuthenticator(c.ExecProvider, cluster)
 		if err != nil {
 			return nil, err
 		}