Add command to generate Kubernetes Secrets #202

versilis · 2023-03-15T18:23:09Z

This adds a new command akita kube secret which generates a Kubernetes secret configuration file that stores a user's base-64 encoded Akita API credentials.

To simplify file generation, I've used go's built-in templating utilities; akita-secret.tmpl is used as the template for creating the secret.

Example usage:

% ./bin/akita kube secret -n test -o ./tmp/deployments/configs/akita-secrets.yml
[INFO] Akita Agent 0.0.0
[INFO] Generated Kubernetes secret config to ./tmp/deployments/configs/akita-secrets.yml                                                                                                               

% less ./tmp/deployments/configs/akita-secrets.yml 
apiVersion: v1
kind: Secret
metadata:
  name: akita-secrets
  namespace: test
type: Opaque
data:
  akita-api-key: YXBrXzN1Y2h6WDyiOdyMzg2NldiM3Y0Q2Y=
  akita-api-secret: YmUzMzY5OTllNzNjc2DY3MmI5OWQzMTVmAnGaKmYzN2NlNjc2NWRiZDY4MzNjMWRkMzA4YjFjZDFlNWZkZg==
./tmp/deployments/configs/akita-secrets.yml lines 1-9/9 (END)

Signed-off-by: versilis <versilis@akitasoftware.com>

mgritter

Looks pretty good.

The must-fix items: let's add the ability to write to stdout, and use the default namespace. (And the redundant code in addAgentToECS.)

I would like to see us tackle YAML output with a library here on an easy case before we have to tackle parsing and rewriting a Deployment resource. Unless you were planning on using just string manipulation? But I don't insist on it.

cmd/internal/ecs/ecs.go

cmd/internal/kube/kube.go

cmd/internal/kube/secret.go

cmd/internal/kube/template/akita-secret.tmpl

cmd/internal/kube/secret.go

mgritter · 2023-03-16T03:36:26Z

cmd/internal/kube/secret.go

+	)
+	_ = secretCmd.MarkFlagRequired("namespace")
+
+	secretCmd.Flags().StringVarP(&output, "output", "o", "akita-secret.yml", "File to output the generated secret.")


This should have come up in the design review -- sorry. I think the correct default, which is most idiomatic to Kubernetes tools, is to print to standard output.

The idiomatic usage we are aiming for is something like "akita kube secret | kubectl apply -f -"

I've implemented printing in 5acfe06.

To avoid printing pre-run info logs, I've overriden the root command's PersistentPreRun handler. I've also had to make some updates to how we initialize telemetry which I've added as part of this commit: df81990

mgritter · 2023-03-16T03:37:54Z

cmd/internal/kube/secret.go

+func init() {
+	var err error
+
+	secretTemplate, err = template.ParseFS(templateFS, "template/akita-secret.tmpl")


I'm mostly OK with using a template here. But, I think this will be much harder to pull off for the next command, and I would like the two implementations to be consistent. If we have to have YAML parsing and output, let's start here with the easy case. :)

Currently, there's a discrepancy between the Kubernetes openapi spec and the Go packages API model representation. Here's a link to the issue that covers it: kubernetes/kubernetes#109427

I've opened a separate PR to address using the Kubernetes API for generating secrets: #204

cmd/internal/kube/secret.go

cmd/internal/kube/kube.go

Co-authored-by: Mark Gritter <mgritter@akitasoftware.com>

This provides a workaround to remove all telemetry info logs during a command's initialization. This is needed by the kube secret command because only the raw YAML output should be printed to stdout.

mgritter · 2023-03-21T19:05:31Z

cmd/internal/kube/secret.go

+		// Output the generated secret to the console
+		printer.RawOutput(output)


Sorry, I think I was unclear. The two uses cases are:

Apply directly
akita kube secret | kubectl apply -f -

Apply via a file (convenience, they could always pipe to a file.)
akita kube secret -f mysecret.yaml
kubectl apply -f mysecret.yaml

In case #2 we should not print to standard output as well, it should be one or the other. We can support this in a few different ways, I don't much care whether (a) standard out is the default if -f not specified, or (b) -f - writes to standard output..

I kind of think like in case #1 we should not write the file that was not asked for as well.

Come talk to me if what should happen in these two cases are still unclear.

mgritter · 2023-03-21T19:06:53Z

cmd/internal/kube/secret.go

+}
+
+// Creates a file at the give path to be used for storing of the generated Secret config
+// If any child dicrectories do not exist, it will be created.


Is this comment correct? I think you mean "it will not be created".

mgritter · 2023-03-21T19:10:26Z

pcap/stream_test.go

@@ -127,6 +128,7 @@ func runTCPFlowTestCase(c tcpFlowTestCase) error {
 }

 func TestTCPFlow(t *testing.T) {
+	telemetry.Init(false)


I think I understand the need here and in pase_http_test since the error functions in parsing send telemetry.

Is there a fix to telemetry that checks whether uninitialized instead? If it's not easy to do, we can keep this, it just seems a bit odd to be initializing telemetry in a situation where we don't really want it.

mgritter

Looks good!

This adds two new commands, `akita kube inject` and `akita kube secret`, for simplifying the process of installing Akita as a sidecar in Kubernetes Deployments. Changes include: - #202 - #207 - #206 --------- Signed-off-by: versilis <versilis@akitasoftware.com> Co-authored-by: Mark Gritter <mgritter@akitasoftware.com> Co-authored-by: Jed Liu <liujed@users.noreply.github.com>

versilis force-pushed the versilis/kube-secret branch from b7f4f96 to 3226cf1 Compare March 15, 2023 20:00

versilis added 5 commits March 15, 2023 17:22

Add base kube command

746248e

Signed-off-by: versilis <versilis@akitasoftware.com>

Refactor API credential check into a function

ad244de

Signed-off-by: versilis <versilis@akitasoftware.com>

Add template to generate secrets

3789778

Signed-off-by: versilis <versilis@akitasoftware.com>

Add kube secret command

e5b4a88

Signed-off-by: versilis <versilis@akitasoftware.com>

Add to root command

10ad02d

versilis force-pushed the versilis/kube-secret branch from 7202b3f to 10ad02d Compare March 15, 2023 22:23

versilis self-assigned this Mar 15, 2023

versilis changed the base branch from main to versilis/kube March 15, 2023 22:34

versilis added 5 commits March 15, 2023 19:11

Print success message when secret config is generated

0caeed3

Fix issues with output generation

e651574

Mark namespace flag as required

1c7ae51

Add comment

0fd9974

Update unit test

a7a2c07

versilis changed the title ~~Add Kube Secret Command~~ Add command to generate Kubernetes Secrets Mar 16, 2023

versilis requested a review from mgritter March 16, 2023 02:37

versilis marked this pull request as ready for review March 16, 2023 02:37

versilis added the 3 – Normal Priority Non-blocking review—please turn around quickly label Mar 16, 2023

mgritter requested changes Mar 16, 2023

View reviewed changes

versilis and others added 11 commits March 20, 2023 10:06

Apply suggestions from code review

ed0dfc8

Co-authored-by: Mark Gritter <mgritter@akitasoftware.com>

Remove old credential check in addAgentToECS

8d66125

Use the default namespace when none is provided

6596d5e

Rename flag variables to fit standard conventions

69857a4

Print output on successful secret generation

5acfe06

Add function to initialize telemetry

df81990

This provides a workaround to remove all telemetry info logs during a command's initialization. This is needed by the kube secret command because only the raw YAML output should be printed to stdout.

Return an error if directory does not exist

3dbe526

Add aliases for kube command

935b4bb

Tweak test names

562adb3

Fix test

24a8bc3

Update buffer initialization to use builtin constructor

edb4246

versilis mentioned this pull request Mar 21, 2023

Generate Secrets with Kubernetes API #204

Draft

versilis requested a review from mgritter March 21, 2023 16:12

mgritter requested changes Mar 21, 2023

View reviewed changes

mgritter reviewed Mar 21, 2023

View reviewed changes

versilis added 3 commits March 21, 2023 18:02

Only print when no file is specified

4490c52

Fix doc comment

ce8ba09

Use null analytics client by default

058e72c

mgritter approved these changes Mar 21, 2023

View reviewed changes

Add contextual information on successful file generation

44ba56b

versilis merged commit a87238f into versilis/kube Mar 21, 2023

versilis deleted the versilis/kube-secret branch March 21, 2023 23:52

This was referenced Mar 24, 2023

Simplify Kubernetes Injection #205

Merged

Add kube inject command #206

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add command to generate Kubernetes Secrets #202

Add command to generate Kubernetes Secrets #202

versilis commented Mar 15, 2023 •

edited

mgritter left a comment

mgritter Mar 16, 2023

versilis Mar 21, 2023

mgritter Mar 16, 2023

versilis Mar 21, 2023

mgritter Mar 21, 2023

mgritter Mar 21, 2023

mgritter Mar 21, 2023

mgritter left a comment

		// Output the generated secret to the console
		printer.RawOutput(output)

Add command to generate Kubernetes Secrets #202

Add command to generate Kubernetes Secrets #202

Conversation

versilis commented Mar 15, 2023 • edited

mgritter left a comment

Choose a reason for hiding this comment

mgritter Mar 16, 2023

Choose a reason for hiding this comment

versilis Mar 21, 2023

Choose a reason for hiding this comment

mgritter Mar 16, 2023

Choose a reason for hiding this comment

versilis Mar 21, 2023

Choose a reason for hiding this comment

mgritter Mar 21, 2023

Choose a reason for hiding this comment

mgritter Mar 21, 2023

Choose a reason for hiding this comment

mgritter Mar 21, 2023

Choose a reason for hiding this comment

mgritter left a comment

Choose a reason for hiding this comment

versilis commented Mar 15, 2023 •

edited