Request method of `kubectl exec` changed from `POST` to `GET` now?

[NewbMiao]

What happened:

Why has the request method of kubectl exec changed from POST to GET now, eg, v1.33.3. It was POST in v1.26.15?
And now pods/exec no need create verbs, get is enough to make it happen, is it intended?

What you expected to happen:
pods/exec still using create verbs not get

How to reproduce it (as minimally and precisely as possible):

Grant k8s user viewer access, which has get pods/exec

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ns:viewer-nonprod
rules:
  - apiGroups:
      - "*"
    resources:
      - "*"
    verbs:
      - get
      - list
      - watch

Try kubectl exec -v6 -it {pod_name} -- bash by using version v1.33.3 (GET) and v1.26.15(POST)
eg:

Anything else we need to know?:

Environment:

• Kubernetes client and server versions (use kubectl version):
  Client Version: v1.33.3
  Kustomize Version: v5.6.0
  Server Version: v1.31.1-aliyun.1
• Cloud provider or hardware configuration:
  AliCloud ACK
• OS (e.g: cat /etc/os-release):
  Darwin MacBook-Pro.local 24.5.0 Darwin Kernel Version 24.5.0: Tue Apr 22 19:54:49 PDT 2025; root:xnu-11417.121.6~2/RELEASE_ARM64_T6000 arm64

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[rxinui]

I think this change occurred back in v1.27, so quite a long time ago.
Therefore I don't think it will ever rollback to POST method.

You can try this out

rules:
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: [""] # block any exec

[NewbMiao]

Yeah, I see, just curious, is there a offical document for this? @rxinui

[rxinui]

@NewbMiao no official documentation, rather this can be found on the codebase. See https://pkg.go.dev/k8s.io/api/core/v1#LifecycleHandler

I believe ExecAction is map to pods/exec resource. Probably sig maintainers know more about it than I do. CC: @ardaguclu