Make in-cluster configuration easy
Splitting from discussion in #394:
Tangentially, I would suggest that we configure this to "just work" inside a Kubernetes cluster. That is detect and implement the code in the README section "Inside a Kubernetes Cluster" when no other authorization is provided.
That sounds like a good idea. Looking at how client-go implements rest.InClusterConfig, looks like we can just lift that wholesale. In fact, that's pretty much what I've seen most apps doing (unsurprisingly).
I think adding the in-cluster ability as a new method on
Kubeclient::Configshould be sufficient, and we'll leave the responsibility of calling the appropriate method to the caller (since sometimes clients are run in-cluster, but with a mountedkubeconfigto speak with other clusters). This has the nice benefit of mirroring the conventions of the client-go package as well
For reference see also our gem that implements this (in ruby): https://github.com/keylimetoolbox/resque-kubernetes/blob/v2.0.0/lib/resque/kubernetes/context/well_known.rb
And yes, we should do this as a last resort. If there's a provided configuration use that; if not, check for GCP; final step is to check for in-cluster.
BTW, there is a small discrepancy between what k8s documents and what client-go does, related to rare issue https://github.com/kubernetes/kubernetes/issues/40973 where the env vars are not always set. See previous discussion on #316.
I think it'll make sense to extract config & auth parts from kubeclient + https://github.com/kubernetes-client/ruby/ into a new gem and make both projects use it.
They already have InClusterConfig class, Kubernetes.load_incluster_config helper, and default logic in https://github.com/kubernetes-client/ruby/blob/master/kubernetes/src/kubernetes/loader.rb that tries:
$KUBECONFIG, if file exists~/.kube/config, if file existsInClusterConfig.in_cluster?
Kubernetes plans to change service account tokens to short-lived: https://github.com/kubernetes/kubernetes/issues/70679 This even simple in-cluster config will require on-the fly auth updates (#393)