Allow custom CAs for the APIGenerator HTTPClient

[bigkevmcd]

This adds additional functionality allowing for a custom CA to be used when making APIClient requests.

[bigkevmcd]

@steve-fraser this one's for you :-)

[foot]

Code LGTM! Will try and test it out..

[foot]

Good catch

[foot]

Nice, needs a re-run on make api-docs? Could add a ci task to check for that.

[foot]

💯 , great keeping the docs up to date, would be great to replicate this in EE somehow (docs are in a diff repo for now.. 🤔 )

[foot]

TIL kube-public ns, I hadn't noticed it before

❯ kubectl get configmap -n kube-public kube-root-ca.crt -oyaml
apiVersion: v1
data:
  ca.crt: |
    -----BEGIN CERTIFICATE-----
    MIIC/jCCAeagAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwprdWJl
    cm5ldGVzMB4XDTIzMDcwNDE2MDgzNFoXDTMzMDcwMTE2MDgzNFowFTETMBEGA1UE
    AxMKa3ViZXJuZXRlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM5c
    +2hKTDF2l5by5JEMVWKDz7uq+IIDQvL4oMnMwDkzQOv6n+EOYwBZe5MVJnNblcNL
    cuapC3tMvShEwrD0nZKX5Fiml/iYzX1xiTUWRMP/5iRnLxhO0Fs8zYWXidJt1LiL
    5fHUITYzy+suRRCvfgWE+8m0YoqGPOP0tO3ZcKTKL/JxNMCu9Baek9MitgF4vhF3
    t5PglvDrd4Udk4MfegxrIZqJS0KG8dpljsVGmOJ3RKPMfOto+NKv8B4bu/n0dzhb
    XJbtYOtfpiQV/ygTnq5xoHgACxxDRGu7kkEzSSd7nWaiUYUmBq6dHiXULZ4mauaP
    he5gGuGjtAk+q7FepeECAwEAAaNZMFcwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB
    /wQFMAMBAf8wHQYDVR0OBBYEFCeJi5nkmDWkUElzi88hvlqmXeM0MBUGA1UdEQQO
    MAyCCmt1YmVybmV0ZXMwDQYJKoZIhvcNAQELBQADggEBAIfBvmlcpBlfoBz4EnJj
    esfhudXws8D5cQB3LUPiQqC+NxDcldg7BAd+bYnXbHwd445URd1CN2SKKqM1mmW5
    pdlPj5vI67w58p8qASK+zSR/hi44buVu9jJyxifh83vaD87g2jNaJhrTgszhX51e
    SpaE2hBCJL1SwAKYKRNs8W37+QuEiQUB+1sRJRDO5YhOCEgrfRYWGUzOsd0Noses
    0pUqFKermIEIqcxD7jcUINBwnwyHq54S71HM1aQQyn/DNNEBV3cYUzPg2jkZXXyj
    Ly0d6TD2YsvvofosgYgmQgN9nqZSyMJw0jd3salMsvDg0vLve666lIGMjZvKZCwX
    S9E=
    -----END CERTIFICATE-----
kind: ConfigMap
metadata:
  annotations:
    kubernetes.io/description: Contains a CA bundle that can be used to verify the
      kube-apiserver when using internal endpoints such as the internal service IP
      or kubernetes.default.svc. No other usage is guaranteed across distributions
      of Kubernetes clusters.
  creationTimestamp: "2023-07-04T16:08:58Z"
  name: kube-root-ca.crt
  namespace: kube-public
  resourceVersion: "348"
  uid: 66cf581e-3674-44ac-a43c-6a6495718d14

[foot]

Should our implementation be a secret or a configmap? No biggie.

If flux does secrets then makes sense we do too.

[bigkevmcd]

https://fluxcd.io/flux/components/source/gitrepositories/#secret-reference

[bigkevmcd]

You could use the same secret for this.

[bigkevmcd]

But, I wonder if we couldn't allow the key to be customisable?

[foot]

How would you query the kube-apiserver? You need a bearer token from some SA too I guess?

[bigkevmcd]

Yeah, you can do that via the headers mechanism.

And I think accessing the kube-apiserver is behind this request.

[foot]

Managed to change from a x509 error to a forbidden 👌

without secret ref:

❯ go run cmd/gitopssets-cli/main.go generate kube-server-gs.yaml
2023-07-11T13:51:33.793+0200	INFO	apiclient/api_client.go:83	generating params from APIClient generator	{"endpoint": "https://127.0.0.1:50607"}
2023-07-11T13:51:33.813+0200	ERROR	apiclient/api_client.go:100	failed to fetch endpoint	{"endpoint": "https://127.0.0.1:50607", "error": "Get \"https://127.0.0.1:50607\": tls: failed to verify certificate: x509: “kube-apiserver” certificate is not trusted"}

with

        secretRef:
          name: https-ca-credentials

we get

❯ go run cmd/gitopssets-cli/main.go generate kube-server-gs.yaml
2023-07-11T13:50:28.036+0200	INFO	apiclient/api_client.go:83	generating params from APIClient generator	{"endpoint": "https://127.0.0.1:50607"}
2023-07-11T13:50:28.046+0200	INFO	apiclient/api_client.go:113	failed to fetch endpoint	{"endpoint": "https://127.0.0.1:50607", "statusCode": 403, "response": "{\"kind\":\"Status\",\"apiVersion\":\"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"forbidden: User \\\"system:anonymous\\\" cannot get path \\\"/\\\"\",\"reason\":\"Forbidden\",\"details\":{},\"code\":403}\n"}