This repository has been archived by the owner on Jul 18, 2019. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 2
/
create_kubeconfig.go
173 lines (142 loc) · 4.9 KB
/
create_kubeconfig.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
package sa
import (
"errors"
"fmt"
"io"
"os"
"github.com/spf13/cobra"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
kclientcmd "k8s.io/client-go/tools/clientcmd"
clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
kapi "k8s.io/kubernetes/pkg/api"
kcoreclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/core/internalversion"
"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
"github.com/openshift/origin/pkg/cmd/util/clientcmd"
"github.com/openshift/origin/pkg/serviceaccounts"
)
const (
CreateKubeconfigRecommendedName = "create-kubeconfig"
createKubeconfigShort = `Generate a kubeconfig file for a service account`
createKubeconfigUsage = `%s SA-NAME`
)
var (
createKubeconfigLong = templates.LongDesc(`
Generate a kubeconfig file that will utilize this service account.
The kubeconfig file will reference the service account token and use the current server,
namespace, and cluster contact info. If the service account has multiple tokens, the
first token found will be returned. The generated file will be output to STDOUT.
Service account API tokens are used by service accounts to authenticate to the API.
Client actions using a service account token will be executed as if the service account
itself were making the actions.`)
createKubeconfigExamples = templates.Examples(`
# Create a kubeconfig file for service account 'default'
%[1]s 'default' > default.kubeconfig`)
)
type CreateKubeconfigOptions struct {
SAName string
SAClient kcoreclient.ServiceAccountInterface
SecretsClient kcoreclient.SecretInterface
RawConfig clientcmdapi.Config
ContextNamespace string
Out io.Writer
Err io.Writer
}
func NewCommandCreateKubeconfig(name, fullname string, f *clientcmd.Factory, out io.Writer) *cobra.Command {
options := &CreateKubeconfigOptions{
Out: out,
Err: os.Stderr,
}
cmd := &cobra.Command{
Use: fmt.Sprintf(createKubeconfigUsage, name),
Short: createKubeconfigShort,
Long: createKubeconfigLong,
Example: fmt.Sprintf(createKubeconfigExamples, fullname),
Run: func(cmd *cobra.Command, args []string) {
cmdutil.CheckErr(options.Complete(args, f, cmd))
cmdutil.CheckErr(options.Validate())
cmdutil.CheckErr(options.Run())
},
}
cmd.Flags().StringVar(&options.ContextNamespace, "with-namespace", "", "Namespace for this context in .kubeconfig.")
return cmd
}
func (o *CreateKubeconfigOptions) Complete(args []string, f *clientcmd.Factory, cmd *cobra.Command) error {
if len(args) != 1 {
return cmdutil.UsageError(cmd, fmt.Sprintf("expected one service account name as an argument, got %q", args))
}
o.SAName = args[0]
client, err := f.ClientSet()
if err != nil {
return err
}
namespace, _, err := f.DefaultNamespace()
if err != nil {
return err
}
o.RawConfig, err = f.OpenShiftClientConfig().RawConfig()
if err != nil {
return err
}
if len(o.ContextNamespace) == 0 {
o.ContextNamespace = namespace
}
o.SAClient = client.Core().ServiceAccounts(namespace)
o.SecretsClient = client.Core().Secrets(namespace)
return nil
}
func (o *CreateKubeconfigOptions) Validate() error {
if o.SAName == "" {
return errors.New("service account name cannot be empty")
}
if o.SAClient == nil || o.SecretsClient == nil {
return errors.New("API clients must not be nil in order to create a new service account token")
}
if o.Out == nil || o.Err == nil {
return errors.New("cannot proceed if output or error writers are nil")
}
return nil
}
func (o *CreateKubeconfigOptions) Run() error {
serviceAccount, err := o.SAClient.Get(o.SAName, metav1.GetOptions{})
if err != nil {
return err
}
for _, reference := range serviceAccount.Secrets {
secret, err := o.SecretsClient.Get(reference.Name, metav1.GetOptions{})
if err != nil {
continue
}
if serviceaccounts.IsValidServiceAccountToken(serviceAccount, secret) {
token, exists := secret.Data[kapi.ServiceAccountTokenKey]
if !exists {
return fmt.Errorf("service account token %q for service account %q did not contain token data", secret.Name, serviceAccount.Name)
}
cfg := &o.RawConfig
if err := clientcmdapi.MinifyConfig(cfg); err != nil {
return fmt.Errorf("invalid configuration, unable to create new config file: %v", err)
}
ctx := cfg.Contexts[cfg.CurrentContext]
ctx.Namespace = o.ContextNamespace
// rename the current context
cfg.CurrentContext = o.SAName
cfg.Contexts = map[string]*clientcmdapi.Context{
cfg.CurrentContext: ctx,
}
// use the server name
ctx.AuthInfo = o.SAName
cfg.AuthInfos = map[string]*clientcmdapi.AuthInfo{
ctx.AuthInfo: {
Token: string(token),
},
}
out, err := kclientcmd.Write(*cfg)
if err != nil {
return err
}
fmt.Fprintf(o.Out, string(out))
return nil
}
}
return fmt.Errorf("could not find a service account token for service account %q", serviceAccount.Name)
}