azure / k8s-set-context

GitHub Action for setting context and retrieving Kubeconfig before deploying to Kubernetes clusters

Kubernetes set context

This action can be used to set cluster context before other actions like azure/k8s-deploy and azure/k8s-create-secret. It should also be used before kubectl commands (in script) are run subsequently in the workflow.

It is a requirement to use azure/login in your workflow before using this action when using the service-account or service-principal methods.

There are three approaches for specifying the deployment target:

• Kubeconfig file provided as input to the action
• Service account approach where the secret associated with the service account is provided as input to the action
• Service principal approach (only applicable for arc cluster) where service principal provided with 'creds' is used as input to action

In all these approaches it is recommended to store these contents (kubeconfig file content or secret content) in a secret.

Refer to the action metadata file for details about inputs. Note that different inputs are required for different method and cluster types. Use the below examples as a reference.

Example usage

Kubeconfig approach

- uses: azure/k8s-set-context@v4
  with:
     method: kubeconfig
     kubeconfig: <your kubeconfig>
     context: <context name> # current-context from kubeconfig is used as default

Please note that the input requires the contents of the kubeconfig file, and not its path.

Following are the ways to fetch kubeconfig file onto your local development machine so that the same can be used in the action input shown above.

Azure Kubernetes Service cluster

az aks get-credentials --name
                       --resource-group
                       [--admin]
                       [--file]
                       [--overwrite-existing]
                       [--subscription]

Further details can be found in az aks get-credentials documentation.

Generic Kubernetes cluster

Please refer to documentation on fetching kubeconfig for any generic K8s cluster

Service account approach

- uses: azure/k8s-set-context@v4
  with:
     method: service-account
     k8s-url: <URL of the cluster's API server>
     k8s-secret: <secret associated with the service account>

For fetching Server URL, execute the following command on your shell:

kubectl config view --minify -o 'jsonpath={.clusters[0].cluster.server}'

For fetching Secret object required to connect and authenticate with the cluster, the following sequence of commands need to be run:

kubectl get serviceAccounts <service-account-name> -n <namespace> -o 'jsonpath={.secrets[*].name}'

kubectl get secret <service-account-secret-name> -n <namespace> -o yaml

Service account approach for arc cluster

- uses: azure/k8s-set-context@v4
  with:
     method: service-account
     cluster-type: arc
     cluster-name: <cluster-name>
     resource-group: <resource-group>
     token: '${{ secrets.SA_TOKEN }}'

Service principal approach for arc cluster

- uses: azure/k8s-set-context@v4
  with:
     method: service-principal
     cluster-type: arc
     cluster-name: <cluster-name>
     resource-group: <resource-group>

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

k8s-set-context's Issues

Feature Request: Created tag for version v4

Feature request

According to previous version conventions, all major versions had the tag like v4.

This aligns with best practices in version management as outlined in the GitHub documentation.

Therefore, could a tag v4 for version 4.0.0 be created?

Provide a simple instruction to get kubeconfig file content for generic kubernetes cluster

At first it was not clear to me what 'the contents' of kubeconfig means and spent some time to find a way.

The README gives a link to the official documentation but for those who are not familiar with k8s(like me), it would be useful if they can find more explicit way to retrieve the contents of kubeconfig file, like the following:

cat $HOME/.kube/config

Error: Error: Input required and not supplied: kubeconfig

Hi,

I am using in my [repository] your Azure/k8s-set-context and it works perfect for me.
The problem start when other usesr trying to push PR and they failed:

Run azure/k8s-set-context@v1
Error: Error: Input required and not supplied: kubeconfig

Do you know what can be the reason that I can run it as repository owner and other admin user cannot run it and failed ?

Solved you can close it

service-account usage with k8s-create-secret

When I use k8s-url and k8s-secret:

- uses: azure/k8s-set-context@v2
  with:
    method: service-account
    k8s-url: <URL of the cluster's API server>
    k8s-secret: <secret associated with the service account>

with azure/k8s-create-secret:

- name: Set secret
  uses: azure/k8s-create-secret@v2
  with:
    namespace: 'myapp'
    secret-type: 'generic'
    secret-name: 'myapp-secret'
    string-data: ${{ secrets.SECRET_STRING_DATA }}
  id: create-secret

I get an error in the create secret step: Error: clusters[0].name is missing

https://github.com/kubernetes-client/javascript/blob/6626ff029d5369680a5497d31c8f3094d7af26d8/src/config_types.ts#L45-L49

I assume it's because we do not set a name here:

k8s-set-context/src/kubeconfigs/default.ts

Lines 65 to 70 in 6c102e2

	{
	cluster: {
	"certificate-authority-data": certAuth,
	server: clusterUrl,
	},
	},

Error: Input required and not supplied: kubeconfig (bump v2)

After dependabot tried to upgrade dependency from v1 to v2 workflows brake with error: "Error: Input required and not supplied: kubeconfig"

How to set multiple contexts?

I'm sorry if this is not the right place for this.
Thanks for your tool , we rely on it at our client. 🙏

I'm not sure if it's possible or not with this github action. And not sure where to ask?
I'm moving a file from one cluster to another (let's say tst to acc for example).

One of my first steps is

  move-file:
    environment: 
      name: tst
    steps:
      - uses: azure/k8s-set-context@v1
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
        id: setcontext

After this I can display the contexts like so:
kubectl config get-contexts
It shows me the 1 cluster:

CURRENT   NAME      CLUSTER            AUTHINFO   NAMESPACE
*         context   example-tst   user       examplenamespace-tst

When I issue the setcontext again, nothing changes (I think because the environment is declared on a higher level (environment)?

So I'm not sure on how in a step to

• change the context?
• set 2 clusters as contexts from the start (but how then)?
  (and what would the best option be?

Where should I look to find answers to this?

Error: File not found: '/home/runner/work/_actions/azure/k8s-set-context/v3/lib/run.js'

$ git branch --show-current
releases/v3
$ git rev-parse HEAD
52d71d28bd61f06ee5a667046a6f0d235e6de095
$ ll ./lib
-rw-rw-r--@ 1 staff  staff   947B Jun 29 23:41 exec-child.js
-rw-rw-r--@ 1 staff  staff   7.8M Jun 29 23:41 index.js

Error: File not found: '/home/runner/work/_actions/azure/k8s-set-context/v4/lib/index.js'

What happened?

Bumped up from v3 to v4 and got the error in the title.

Version

• I am using the latest version

Runner

github runner

Relevant log output

https://github.com/python-discord/site/actions/runs/8231726001/job/22507717765

Allow setting certificate-authority-data with service account approach of configuration

Deprecation Warning for Node.js 12, update to Node.js 16

The following warning arises from using: azure/k8s-set-context@v2

Node.js 12 actions are deprecated. For more information see: https://github.blog/changelog/2022-09-22-github-actions-all-actions-will-begin-running-on-node16-instead-of-node12/. Please update the following actions to use Node.js 16: azure/k8s-set-context@v2

-

Delete

Question: where is kubectl?

What happened?

Hi there, sorry for my newbie question.
The k8s-set-context also installs kubectl as per the documentation.
I was using kubectl inside a workflow like the yml snippet below.
It was working fine as of May 2023 if I remember correctly.
Today when I ran the workflow, the kubectl is no longer inside "/usr/local/bin/" (I ls'ed "/usr/local/bin/" and it's not there).
May I know where it could be located now? (ubuntu-latest in May2023 could be Ubuntu 20.04. Now it's Ubuntu 22.04)

name: Test CI
on:
  push:
    branches: [ test ]
    paths:
    - '.github/workflows/test.yml'
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: setting the azure kubernetes context
        uses: Azure/k8s-set-context@v1
        with:
          kubeconfig: ${{ secrets.KUBE_CONFIG }}
      - name: Check pods
        run: /usr/local/bin/kubectl get pods -o wide --namespace ab71f066-5279-46bc-8cb8-d15f3cca9a67

The error for the above workflow is as follows:

I am not sure why I had to use the kubectl inside "/usr/local/bin/" instead of calling kubectl directly.
If I call kubectl directly today, I am getting some TLS errors.
Does this mean kubectl is actually there, and maybe some certificate field inside {{secrets.KUBE_CONFIG}} just needs to be updated?
(Sorry i don't have access to the Secrets Page in our Github repo)

Other things I tried (no success):
• use "ubuntu-20.04" in the "runs-on" field
• use Azure/k8s-set-context@v3
• calling "kubectl version" also leads to TLS errors

Version

• I am using the latest version

Runner

ubuntu-latest and ubuntu-20.04

Relevant log output

kubeconfig with context dosen't work

I am trying to use this action but failed.

Here is the workflow:

# This is a basic workflow to help you get started with Actions

name: Setup K8s cluster

# Controls when the action will run. Triggers the workflow on push or pull request
# events but only for the master branch
on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  build:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
    - uses: actions/checkout@v2

    - name: Kubernetes set context
      uses: Azure/k8s-set-context@v1
      with:
        method: kubeconfig
        # Kubernetes Config
        kubeconfig: ${{ secrets.K8S_CONFIG }}
        # If your kubeconfig has multiple contexts, use this field to use a specific context, otherwise the default one would be chosen
        context: ${{ secrets.K8S_CURRENT_CONTEXT }}

And I got this error:

But if I didn't use the context, and append with another step with a script to manually using context, everything works fine.

    - run: |
        cat ${KUBECONFIG}
        kubectl config get-contexts
        kubectl config use-context ${{ secrets.K8S_CURRENT_CONTEXT }}
        kubectl config current-context

Please provide normal documentation for the "kubeconfig" input

It says:
(Relevant for kubeconfig approach) Configuration file to be used with kubectl

But in reality it expects the contents of my kubeconfig, not the path. More often than not, the words "configuration file" mean a file path.

Lots of k8s platforms provide kubeconfig as a file through their CLI, so it feels natural to feed it to your action, which in turn usually leads to 2 hours of debugging & cursing. Your other actions stating calling k8s-set-context is mandatory are not helping at all.

Perhaps you could support a file name through a separate input. SetKubeConfigEx?