Parsing kubeconfig's certificate-authority-data fails

[arnisoph]

certificate-authority-data (k8s. Cluster.CertificateAuthorityData) normally is a base64 string, but the current code somehow tries to translate it into []uint8:

yaml: unmarshal errors:
  line 6: cannot unmarshal !!str `LS0tLS1...` into []uint8

[ericchiang]

What yaml library are you using? Can you share a reproducible test case?

[arnisoph]

see

• https://github.com/inovex/trovilo/blob/master/client/client.go#L7
• https://github.com/inovex/trovilo/blob/master/client/client.go#L22

I will provide an example config later this weekend.

[Ulexus]

I am using go-yaml/yaml (which is the same repo as the OP, but not using gopkg.in), and I have the same issue. (yaml)String -> (go)[]uint8 apparently doesn't work with its Unmarshal().

An example YAML file which fails (though it really only matters that certificate-authority-data is defined):

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: Qk9HVVMgQ2VydCBBdXRob3JpdHkgRGF0YQ==
    server: https://192.168.101.101
  name: gke_PROJECTID
contexts:
- context:
    cluster: gke_PROJECTID
    user: gke_PROJECTID
  name: gke_PROJECTID
current-context: gke_PROJECTID
kind: Config
preferences: {}
users:
- name: gke_PROJECTID
  user:
    auth-provider:
      config:
        access-token: ya29.REMOVED
        cmd-args: config config-helper --format=json
        cmd-path: /home/MY-USER/google-cloud-sdk/bin/gcloud
        expiry: 2017-07-23T17:07:48Z
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
      name: gcp

(note that the cert-authority-data is bogus but correctly-encoded base64 data)

[Ulexus]

It is probably best to simply recommend that users use github.com/ghodss/yaml instead, which does parse correctly.

[ericchiang]

I'd recommend using github.com/ghodss/yaml if you want this conversion.

As you may have noticed, this client doesn't support things like auth providers too. Full kubeconfig loading is black magic that's best left to kubectl. I'd recommend shelling out to kubectl config view -o=json --raw=true and loading that using json.Unmarshal if you want a more reliable way of doing this.