kubectl versions Error: exec plugin is configured to use API version client.authentication.k8s.io/v1alpha1

Question

I was setting up my new Mac for my eks environment. After the installation of kubectl, aws-iam-authenticator and the kubeconfig file placement in default location. I ran the command kubectl command and got this error mentioned below in command block.

My cluster uses v1alpha1 client auth api version so basically i wanted to use the same one in my Mac as well.

I tried with latest version (1.23.0) of kubectl as well, still the same error. Whereas When i tried to do with aws-iam-authenticator (version 0.5.5) I was not able to download lower version.

Can someone help me to resolve it?

% kubectl version          
Client Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.0", GitCommit:"af46c47ce925f4c4ad5cc8d1fca46c7b77d13b38", GitTreeState:"clean", BuildDate:"2020-12-08T17:59:43Z", GoVersion:"go1.15.5", Compiler:"gc", Platform:"darwin/amd64"}
Unable to connect to the server: getting credentials: exec plugin is configured to use API version client.authentication.k8s.io/v1alpha1, plugin returned version client.authentication.k8s.io/v1beta1

Thanks and Regards, Saravana

Answer 1

I have the same problem

You're using aws-iam-authenticator 0.5.5, AWS changed the way it behaves in 0.5.4 to require v1beta1.

It depends on your configuration, but you can try to change the K8s context you're using to v1beta1 by checking your kubeconfig file (usually in ~/.kube/config) from client.authentication.k8s.io/v1alpha1 to client.authentication.k8s.io/v1beta1

Otherwise switch back to aws-iam-authenticator 0.5.3 - you might need to build it from source if you're using the M1 architecture as there's no darwin-arm64 binary built for it

Answer 2

This worked for me using M1 chip

sed -i .bak -e 's/v1alpha1/v1beta1/' ~/.kube/config

Answer 3

I fixed the issue with command below

aws eks update-kubeconfig --name mycluster 

Answer 4

I also solved this by updating the apiVersion value in my kube config file (~/.kube/config).

client.authentication.k8s.io/v1alpha1 to client.authentication.k8s.io/v1beta1

Answer 5

Also make sure the AWS CLI version is up-to-date. Otherwise, AWS IAM Authenticator might not work with v1beta1:

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install --update

as shown in https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html

Answer 6

Please change the authentication apiVersion from v1alpha1 to v1beta1.

Old

apiVersion: client.authentication.k8s.io/v1alpha1

New

apiVersion: client.authentication.k8s.io/v1beta1

Answer 7

Downgrading/Upgrading kubectl version worked for me.

You must use a kubectl version that is within one minor version difference of your cluster. For example, a v1.27 client can communicate with v1.26, v1.27, and v1.28 control planes. Using the latest compatible version of kubectl helps avoid unforeseen issues

Answer 8

TL;DR It might not seem to make sense, but upgrading the AWS CLI as mentioned here is probably the solution you are seeking. Then re-run 'aws update-kubeconfig' to properly fix your .kube/config file.

I had this issue in a terraform project with an AWS backend. I first tried replacing v1alpha1 with v1beta1, but that resulted in a different error running 'terraform apply':

Error: Post "https://XXXX.gr7.us-west-1.eks.amazonaws.com/api/v1/namespaces/default/secrets": getting credentials: decoding stdout: no kind "ExecCredential" is registered for version "client.authentication.k8s.io/v1alpha1" in scheme "pkg/runtime/scheme.go:100"

Another reference that suggested my kubectl might be out of date. I'm on OSX and /usr/local/bin/kubectl is symbolically linked to a path inside my Docker Destop app. Indeed Docker Desktop was v4.6.1 and kubectl was version 1.22. After update to Docker Desktop 4.20.1, 'kubectl version' itself resulted in:

error: exec plugin: invalid apiVersion "client.authentication.k8s.io/v1alpha1"

After following examples trying to install a separate/downgraded kubectl, I noticed several people said that the AWS CLI needed to be upgraded. This didn't make sense to me, but after the upgrade to version 2.12.1, I see now that 'aws upgrade-kubeconfig' command fixes the ~/.kube/config file (and perhaps other state) properly, including the v1beta1 change.

In my environment, the command which made that fix is:

aws eks --region $(terraform output -raw region) update-kubeconfig --name $(terraform output -raw cluster_name) --profile ssa

Answer 9

This might be helpful to fix this issue for those who were using GitHub actions. For my situation I was using kodermax/kubectl-aws-eks with GitHub actions.

I added the KUBECTL_VERSION and IAM_VERSION environment variables for each steps using kodermax/kubectl-aws-eks to keep them in fixed versions.

  - name: deploy to cluster
    uses: kodermax/kubectl-aws-eks@master
    env:
      KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA_STAGING }}
      ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
      ECR_REPOSITORY: my-app
      IMAGE_TAG: ${{ github.sha }
      KUBECTL_VERSION: "v1.23.6"
      IAM_VERSION: "0.5.3"

Answer 10

Using kubectl 1.21.9 fixed it for me, with asdf:

asdf plugin-add kubectl https://github.com/asdf-community/asdf-kubectl.git
asdf install kubectl 1.21.9

And I would recommend having a .tools-versions file with:

kubectl 1.21.9

This question is a duplicate of error: exec plugin: invalid apiVersion "client.authentication.k8s.io/v1alpha1" CircleCI

Answer 11

Sometimes this can happen if the Kube cache is corrupted (which happened in my case).

Deleting and recreating the below folder worked for me.

sudo rm -rf $HOME/.kube && mkdir -p $HOME/.kube