-
Notifications
You must be signed in to change notification settings - Fork 450
/
bootstrap.go
141 lines (122 loc) · 5.63 KB
/
bootstrap.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
// Copyright (c) 2018 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package app
import (
"context"
"fmt"
"github.com/gardener/gardener/pkg/client/kubernetes"
"github.com/gardener/gardener/pkg/gardenlet/apis/config"
"github.com/gardener/gardener/pkg/gardenlet/bootstrap"
kutil "github.com/gardener/gardener/pkg/utils/kubernetes"
"github.com/sirupsen/logrus"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
certificatesv1beta1client "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
"k8s.io/client-go/tools/clientcmd"
"k8s.io/client-go/util/keyutil"
componentbaseconfig "k8s.io/component-base/config"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
)
func bootstrapKubeconfig(
ctx context.Context,
logger *logrus.Logger,
gardenClientConnection *config.GardenClientConnection,
seedClientConnection componentbaseconfig.ClientConnectionConfiguration,
seedConfig *config.SeedConfig,
) (
[]byte,
string,
string,
error,
) {
seedRESTCfg, err := kubernetes.RESTConfigFromClientConnectionConfiguration(&seedClientConnection, nil)
if err != nil {
return nil, "", "", err
}
k8sSeedClient, err := kubernetes.NewWithConfig(kubernetes.WithRESTConfig(seedRESTCfg))
if err != nil {
return nil, "", "", err
}
kubeconfigSecret := &corev1.Secret{}
if err := k8sSeedClient.Client().Get(ctx, kutil.Key(gardenClientConnection.KubeconfigSecret.Namespace, gardenClientConnection.KubeconfigSecret.Name), kubeconfigSecret); client.IgnoreNotFound(err) != nil {
return nil, "", "", err
}
if len(kubeconfigSecret.Data[kubernetes.KubeConfig]) > 0 {
logger.Info("Found kubeconfig generated from bootstrap process. Using it")
return kubeconfigSecret.Data[kubernetes.KubeConfig], "", "", nil
}
// kubeconfig secret not found or empty - trigger bootstrap process
if gardenClientConnection.BootstrapKubeconfig == nil {
return nil, "", "", fmt.Errorf("cannot trigger kubeconfig bootstrap process because `.gardenClientConnection.bootstrapKubeconfig` is not set")
}
logger.Info("No kubeconfig for garden cluster found, but bootstrap kubeconfig was given.")
// check if we got a kubeconfig for bootstrapping
bootstrapKubeconfigSecret := &corev1.Secret{}
if err := k8sSeedClient.Client().Get(ctx, kutil.Key(gardenClientConnection.BootstrapKubeconfig.Namespace, gardenClientConnection.BootstrapKubeconfig.Name), bootstrapKubeconfigSecret); err != nil {
return nil, "", "", err
}
if len(bootstrapKubeconfigSecret.Data[kubernetes.KubeConfig]) == 0 {
return nil, "", "", fmt.Errorf("bootstrap kubeconfig secret does not contain a kubeconfig")
}
// create certificate client with bootstrap kubeconfig in order to create CSR
bootstrapClientConfig, err := clientcmd.NewClientConfigFromBytes(bootstrapKubeconfigSecret.Data[kubernetes.KubeConfig])
if err != nil {
return nil, "", "", err
}
bootstrapConfig, err := bootstrapClientConfig.ClientConfig()
if err != nil {
return nil, "", "", err
}
bootstrapClient, err := certificatesv1beta1client.NewForConfig(bootstrapConfig)
if err != nil {
return nil, "", "", fmt.Errorf("unable to create certificates signing request client: %v", err)
}
logger.Info("Creating certificate signing request...")
// generate a new private key and create a CSR resource + wait until it got approved/signed
seedName := "<ambiguous>"
if seedConfig != nil {
seedName = seedConfig.Name
}
privateKeyData, err := keyutil.MakeEllipticPrivateKeyPEM()
if err != nil {
return nil, "", "", fmt.Errorf("error generating key: %v", err)
}
certData, csrName, err := bootstrap.RequestSeedCertificate(ctx, bootstrapClient.CertificateSigningRequests(), privateKeyData, seedName)
if err != nil {
return nil, "", "", err
}
logger.Infof("Certificate signing request got approved! Creating kubeconfig and storing it in secret %s/%s", gardenClientConnection.KubeconfigSecret.Namespace, gardenClientConnection.KubeconfigSecret.Name)
// marshal kubeconfig with just derived client certificate
kubeconfig, err := bootstrap.MarshalKubeconfigWithClientCertificate(bootstrapConfig, privateKeyData, certData)
if err != nil {
return nil, "", "", err
}
// store kubeconfig in kubeconfig secret in seed cluster and delete bootstrap kubeconfig secret
kubeconfigSecret.ObjectMeta = metav1.ObjectMeta{
Name: gardenClientConnection.KubeconfigSecret.Name,
Namespace: gardenClientConnection.KubeconfigSecret.Namespace,
}
if _, err := controllerutil.CreateOrUpdate(ctx, k8sSeedClient.Client(), kubeconfigSecret, func() error {
kubeconfigSecret.Data = map[string][]byte{kubernetes.KubeConfig: kubeconfig}
return nil
}); err != nil {
return nil, "", "", err
}
logger.Infof("Deleting secret %s/%s holding bootstrap kubeconfig", gardenClientConnection.BootstrapKubeconfig.Namespace, gardenClientConnection.BootstrapKubeconfig.Name)
if err := k8sSeedClient.Client().Delete(ctx, bootstrapKubeconfigSecret); client.IgnoreNotFound(err) != nil {
return nil, "", "", err
}
return kubeconfig, csrName, seedName, nil
}