forked from kubernetes-retired/bootkube
/
secret.go
68 lines (57 loc) · 2.26 KB
/
secret.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
package checkpoint
import (
"fmt"
"os"
"path"
"path/filepath"
"k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
// checkpointSecretVolumes ensures that all pod secrets are checkpointed locally, then converts the secret volume to a hostpath.
func (c *checkpointer) checkpointSecretVolumes(pod *v1.Pod) (*v1.Pod, error) {
uid, gid, err := podUserAndGroup(pod)
if err != nil {
return nil, fmt.Errorf("failed to checkpoint secret for pod %s/%s: %v", pod.Namespace, pod.Name, err)
}
for i := range pod.Spec.Volumes {
v := &pod.Spec.Volumes[i]
if v.Secret == nil {
continue
}
_, err := c.checkpointSecret(pod.Namespace, pod.Name, v.Secret.SecretName, uid, gid)
if err != nil {
return nil, fmt.Errorf("failed to checkpoint secret for pod %s/%s: %v", pod.Namespace, pod.Name, err)
}
}
return pod, nil
}
// checkpointSecret will locally store secret data.
// The path to the secret data becomes: checkpointSecretPath/namespace/podname/secretName/secret.file
// Where each "secret.file" is a key from the secret.Data field.
func (c *checkpointer) checkpointSecret(namespace, podName, secretName string, uid, gid int) (string, error) {
secret, err := c.apiserver.Core().Secrets(namespace).Get(secretName, metav1.GetOptions{})
if err != nil {
return "", fmt.Errorf("failed to retrieve secret %s/%s: %v", namespace, secretName, err)
}
basePath := secretPath(namespace, podName, secretName)
if err := os.MkdirAll(basePath, 0700); err != nil {
return "", fmt.Errorf("failed to create secret checkpoint path %s: %v", basePath, err)
}
if err := os.Chown(basePath, uid, gid); err != nil {
return "", fmt.Errorf("failed to chown secret checkpoint path %s: %v", basePath, err)
}
// TODO(aaron): No need to store if already exists
for f, d := range secret.Data {
if err := writeAndAtomicRename(filepath.Join(basePath, f), d, uid, gid, 0600); err != nil {
return "", fmt.Errorf("failed to write secret %s: %v", secret.Name, err)
}
}
return basePath, nil
}
func secretPath(namespace, podName, secretName string) string {
return filepath.Join(checkpointSecretPath, namespace, podName, secretName)
}
func podFullNameToSecretPath(id string) string {
namespace, podname := path.Split(id)
return filepath.Join(checkpointSecretPath, namespace, podname)
}