DevOpsPadDownload

Why exec-based kubeconfig auth fails

DevOpsPad does not run kubeconfig exec plugins. If the context’s user has an exec section, connecting fails with “Exec-based kubeconfig authentication is not supported yet; use a token or client certificate”. In the connection dialog such contexts are labeled (exec auth unsupported).

Contexts that authenticate with a bearer token or a client certificate and key work normally.

How to tell if a context uses exec

Look at the users entry the context refers to. An exec-based user looks like this:

users:
  - name: my-cloud-user
    user:
      exec:
        apiVersion: client.authentication.k8s.io/v1beta1
        command: some-cloud-cli
        args: ["get-token", "--cluster", "prod"]

Managed Kubernetes services often generate kubeconfig entries like this, calling their CLI to fetch a short-lived token.

Why DevOpsPad does not run them

An exec plugin is an arbitrary program run with your user’s permissions every time a token is needed. DevOpsPad reads kubeconfig files without executing anything: listing contexts never runs a plugin, and connection metadata never includes credentials. Running plugins safely from a desktop app (prompts, timeouts, which binaries to trust) is not implemented yet.

Workarounds

  • Use a K3s or self-managed cluster kubeconfig. K3s writes a client-certificate kubeconfig at /etc/rancher/k3s/k3s.yaml on the server. Copy it to your machine, change server: to an address you can reach (or use an SSH tunnel), and point DevOpsPad at it.
  • Create a service account token. Create a service account with a read-only Role (see Kubernetes permissions DevOpsPad needs), issue a token, and put it in a separate kubeconfig with a token: user. Keep that file outside shared folders.
  • Use a client certificate issued by your cluster’s CA if your platform supports it.

Whichever you choose, keep the kubeconfig file private: DevOpsPad reads credentials from that file at connection time and does not copy them into its own storage.

  • One context per connection; add a connection per cluster.
  • Proxy settings in the kubeconfig or environment are bypassed when the connection uses an SSH tunnel.

Frequently asked questions

Will exec-based authentication be supported?

It is listed as not available yet. Until then, use a context that authenticates with a bearer token or a client certificate.