kubernetes / kubernetes/kubectl
Basic authentication was removed but kubectl config set-credentials can set basic auth infos
- Dominant language
- Go
- Stars
- 3.3k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
### What happened?
Basic authentication was removed in v1.19 kubernetes/kubernetes#89069, but kubectl config set-credentials command remains, which can be used to set basic auth infos.
Some users may misuse this command to save password to kubeconfig file, this will lead a password leak issue.
### What did you expect to happen?
Remove the basic auth flags **password**, and update all referenced documents.
### How can we reproduce it (as minimally and precisely as possible)?
example from https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-set-credentials-em-
`kubectl config set-credentials cluster-admin --username=admin --password=uXFGweU9l35qcif`
### Anything else we need to know?
_No response_
### Kubernetes version
```console
$ kubectl version
v1.25+
### Cloud provider
### OS version
```console
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here
# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
```
### Install tools
### Container runtime (CRI) and version (if applicable)
### Related plugins (CNI, CSI, ...) and versions (if applicable)
Contributor guide
Assessment
This issue has not been assessed yet.