For GKE users, the kubeconfig is modified by the gcloud command.
( I’m using the gcloud snap which also happens to use classic confinement. )
When running gcloud container clusters get-credentials, the resulting kubeconfig sets cmd-path to the path of the binary in use.
On my ubuntu system, you can see that this path is set to the full path of my snap gcloud binary:
- name: gke_redacted_us-central1-a_test-kubeconfig-1
user:
auth-provider:
config:
cmd-args: config config-helper --format=json
cmd-path: /snap/google-cloud-sdk/104/bin/gcloud
expiry-key: '{.credential.token_expiry}'
token-key: '{.credential.access_token}'
This means that snaps like fluxctl and kontena-lens can’t easily provide their own copy as the path is difficult to anticipate.