{"record":{"id":"f67555677a720264","repo":"kubernetes/kops","slug":"auth-plugin-not-yet-supported-by-torestconfig","errorCode":null,"errorMessage":"auth plugin not yet supported by ToRESTConfig","messagePattern":"auth plugin not yet supported by ToRESTConfig","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/kubeconfig/kubecfg_builder.go","lineNumber":222,"sourceCode":"\n\tif err := clientcmd.ModifyConfig(configAccess, *config, true); err != nil {\n\t\treturn err\n\t}\n\n\tfmt.Printf(\"kOps has set your kubectl context to %s\\n\", b.Context)\n\treturn nil\n}\n\nfunc (b *KubeconfigBuilder) ToRESTConfig() (*rest.Config, error) {\n\trestConfig := &rest.Config{}\n\n\trestConfig.Host = b.Server\n\trestConfig.TLSClientConfig.CAData = b.CACerts\n\trestConfig.TLSClientConfig.ServerName = b.TLSServerName\n\n\tusingAuthPlugin := len(b.AuthenticationExec) != 0\n\tif usingAuthPlugin {\n\t\treturn nil, fmt.Errorf(\"auth plugin not yet supported by ToRESTConfig\")\n\t}\n\n\trestConfig.CertData = b.ClientCert\n\trestConfig.KeyData = b.ClientKey\n\n\treturn restConfig, nil\n}\n","sourceCodeStart":204,"sourceCodeEnd":230,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/kubeconfig/kubecfg_builder.go#L204-L230","documentation":"ToRESTConfig builds a rest.Config directly from stored TLS/host fields instead of going through clientcmd. Exec-based credential plugins (auth plugins) require the client-go auth loading machinery, which this method does not implement, so it refuses to produce a config that would silently lack credentials. It is a deliberate feature gap, not a data problem.","triggerScenarios":"Calling KubeconfigBuilder.ToRESTConfig() when b.AuthenticationExec is non-empty (builder was populated from a kubeconfig user that uses an exec auth plugin, e.g. aws-iam-authenticator or gke-gcloud-auth-plugin).","commonSituations":"Programmatically building a REST client for a cluster whose kubeconfig relies on an exec credential plugin; EKS/GKE/AWS-auth based clusters.","solutions":["Use clientcmd's clientconfig (e.g. clientcmd.NewNonInteractiveDeferredLoadingClientConfig(...).ClientConfig()) which supports exec plugins","Clear b.AuthenticationExec and set static credentials (ClientCert/ClientKey or bearer token) if plugin auth is unnecessary","If you control the code, implement exec-plugin support by wiring rest.Config.ExecProvider from b.AuthenticationExec","Fall back to shelling out through the generated kubeconfig with kubectl"],"exampleFix":"// before\nbuilder.AuthenticationExec = []string{\"aws\", \"eks\", \"get-token\", ...}\nrestConfig, err := builder.ToRESTConfig() // error\n// after: use clientcmd which resolves the exec plugin\nloadingRules := &clientcmd.ClientConfigLoadingRules{ExplicitPath: kubeconfigPath}\nrestConfig, err := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, nil).ClientConfig()","handlingStrategy":"fallback","validationCode":"if len(builder.AuthenticationExec) != 0 {\n\t// use clientcmd path instead of builder.ToRESTConfig()\n}\n","typeGuard":"func supportsToRESTConfig(b *kubeconfig.KubeconfigBuilder) bool {\n\treturn len(b.AuthenticationExec) == 0\n}\n","tryCatchPattern":"restConfig, err := builder.ToRESTConfig()\nif err != nil && strings.Contains(err.Error(), \"auth plugin not yet supported\") {\n\trestConfig, err = clientcmd.NewNonInteractiveDeferredLoadingClientConfig(\n\t\t&clientcmd.ClientConfigLoadingRules{ExplicitPath: kubeconfigPath}, nil).ClientConfig()\n}\n","preventionTips":["Prefer clientcmd.ClientConfig() when exec auth plugins may be in use","Check builder.AuthenticationExec before calling ToRESTConfig","Keep static client certs if you need programmatic REST access","Track upstream kOps for exec-plugin support in ToRESTConfig"],"tags":["auth-plugin","exec-credential","rest-config","go"],"backgroundTag":"auth-plugin-unsupported","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}