exec credential provider: don't run exec plugin with basic auth

If a user specifies basic auth, then apply the same short circuit logic
that we do for bearer tokens (see comment).

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
This commit is contained in:
Andrew Keesler
2021-05-20 09:17:17 -04:00
parent 164ba3ad7d
commit 9dee2b95c2
4 changed files with 95 additions and 22 deletions

View File

@@ -329,12 +329,8 @@ func TestExecPluginViaClient(t *testing.T) {
c.Password = "unauthorized"
},
wantAuthorizationHeaderValues: [][]string{{"Basic " + basicAuthHeaderValue("unauthorized", "unauthorized")}},
wantCertificate: &tls.Certificate{},
wantClientErrorPrefix: "Unauthorized",
// I don't think we should be calling the exec plugin here. We don't call the exec
// plugin in the case where bearer tokens are already present, and this case is
// similar. See https://github.com/kubernetes/kubernetes/pull/102175.
wantMetrics: &execPluginMetrics{calls: []execPluginCall{{exitCode: 0, callStatus: "no_error"}}},
wantMetrics: &execPluginMetrics{},
},
{
name: "good token with static auth bearer token favors static auth bearer token",