Azure-cli: az aks get-credentials downloads invalid json

[colemickens]

Wasted a huge amount of time tonight only to find out that aks downloads invalid credentials that just happen to work because kubectl's yaml parser is incredibly generous.

$ pip install --upgrade --user azure-cli
$ rm -rf ~/.kube
$ az aks get-credentials --resource-group foo --name bar
$ cat ~/.kube/config

observe the invalid json!

[colemickens]

Note, I may have misspoken. I don't know if it downloads invalid json, but the CLI seems to merge, even when the specified location doesn't exist. So it's possible the bug is in the merge logic.

[colemickens]

Note, I checked with --debug. The kubeConfig comes down as base64 encoded. When I decode it, I get a proper, valid YAML file. Signs point to the bug being in the merge logic?

(Note, this is also easier than trying to repair the file by hand...)

[serbrech]

I have put my nose in the merge logic before and wondered if it could use something built-in such as :

KUBECONFIG=newconfig.yml:~/.kube/config kubectl config view --flatten > ~/.kube/config

or is that short-sighted?

[squillace]

+1 for getting that fixed.

[mboersma]

Some of this issue might be that the CLI defaults to using YAML flow style for non-nested collections, which is an unhappy surprise to humans reading it. I fixed that with #5751.

I do think there are issues with the merge logic--it seems to silently skip merging sections based on a shallow key comparison, for example. I wonder if we could just outsource the merge logic to kubectl view --flatten.

[mboersma]

After #5751 and #6529, az aks get-credentials is working well and has unit tests. I'm not aware of any current YAML or merge bugs.

@tjprescott I think we can close this issue. If anyone finds a problem with get-credentials, please open a new issue with steps to reproduce.