mirror of https://github.com/helm/helm
Merge pull request #189 from vaikas-google/master
Add support for k8s secrets backed credentialspull/192/head
Brendan Melville
9 years ago
commit
b2ebb24c08
@ -0,0 +1,127 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2015 The Kubernetes Authors All rights reserved.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package registry
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/base64"
|
||||||
|
"encoding/json"
|
||||||
|
"flag"
|
||||||
|
"fmt"
|
||||||
|
"log"
|
||||||
|
|
||||||
|
"github.com/ghodss/yaml"
|
||||||
|
"github.com/kubernetes/deployment-manager/common"
|
||||||
|
"github.com/kubernetes/deployment-manager/util"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
kubePath = flag.String("kubectl", "./kubectl", "The path to the kubectl binary.")
|
||||||
|
kubeService = flag.String("service", "", "The DNS name of the kubernetes service.")
|
||||||
|
kubeServer = flag.String("server", "", "The IP address and optional port of the kubernetes master.")
|
||||||
|
kubeInsecure = flag.Bool("insecure-skip-tls-verify", false, "Do not check the server's certificate for validity.")
|
||||||
|
kubeConfig = flag.String("config", "", "Path to a kubeconfig file.")
|
||||||
|
kubeCertAuth = flag.String("certificate-authority", "", "Path to a file for the certificate authority.")
|
||||||
|
kubeClientCert = flag.String("client-certificate", "", "Path to a client certificate file.")
|
||||||
|
kubeClientKey = flag.String("client-key", "", "Path to a client key file.")
|
||||||
|
kubeToken = flag.String("token", "", "A service account token.")
|
||||||
|
kubeUsername = flag.String("username", "", "The username to use for basic auth.")
|
||||||
|
kubePassword = flag.String("password", "", "The password to use for basic auth.")
|
||||||
|
)
|
||||||
|
|
||||||
|
var kubernetesConfig *util.KubernetesConfig
|
||||||
|
|
||||||
|
const secretType = "Secret"
|
||||||
|
|
||||||
|
// CredentialProvider provides credentials for registries.
|
||||||
|
type SecretsCredentialProvider struct {
|
||||||
|
// Actual object that talks to secrets service.
|
||||||
|
k util.Kubernetes
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewSecretsCredentialProvider() common.CredentialProvider {
|
||||||
|
kubernetesConfig := &util.KubernetesConfig{
|
||||||
|
KubePath: *kubePath,
|
||||||
|
KubeService: *kubeService,
|
||||||
|
KubeServer: *kubeServer,
|
||||||
|
KubeInsecure: *kubeInsecure,
|
||||||
|
KubeConfig: *kubeConfig,
|
||||||
|
KubeCertAuth: *kubeCertAuth,
|
||||||
|
KubeClientCert: *kubeClientCert,
|
||||||
|
KubeClientKey: *kubeClientKey,
|
||||||
|
KubeToken: *kubeToken,
|
||||||
|
KubeUsername: *kubeUsername,
|
||||||
|
KubePassword: *kubePassword,
|
||||||
|
}
|
||||||
|
return &SecretsCredentialProvider{util.NewKubernetesKubectl(kubernetesConfig)}
|
||||||
|
}
|
||||||
|
|
||||||
|
func parseCredential(credential string) (*common.RegistryCredential, error) {
|
||||||
|
var c common.KubernetesSecret
|
||||||
|
if err := json.Unmarshal([]byte(credential), &c); err != nil {
|
||||||
|
return nil, fmt.Errorf("cannot unmarshal credential '%s' (%#v)", credential, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
d, err := base64.StdEncoding.DecodeString(c.Data["credential"])
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("cannot unmarshal credential '%s' (%#v)", c, err)
|
||||||
|
}
|
||||||
|
// And then finally unmarshal it from yaml to common.RegistryCredential
|
||||||
|
r := &common.RegistryCredential{}
|
||||||
|
if err := yaml.Unmarshal(d, &r); err != nil {
|
||||||
|
return nil, fmt.Errorf("cannot unmarshal credential %s (%#v)", c, err)
|
||||||
|
}
|
||||||
|
return r, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (scp *SecretsCredentialProvider) GetCredential(name string) (*common.RegistryCredential, error) {
|
||||||
|
o, err := scp.k.Get(name, secretType)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return parseCredential(o)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (scp *SecretsCredentialProvider) SetCredential(name string, credential *common.RegistryCredential) error {
|
||||||
|
// Marshal the credential & base64 encode it.
|
||||||
|
b, err := yaml.Marshal(credential)
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("yaml marshal failed for credential: %s: %v", name, err)
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
enc := base64.StdEncoding.EncodeToString(b)
|
||||||
|
|
||||||
|
// Then create a kubernetes object out of it
|
||||||
|
metadata := make(map[string]string)
|
||||||
|
metadata["name"] = name
|
||||||
|
data := make(map[string]string)
|
||||||
|
data["credential"] = enc
|
||||||
|
obj := &common.KubernetesSecret{
|
||||||
|
Kind: secretType,
|
||||||
|
ApiVersion: "v1",
|
||||||
|
Metadata: metadata,
|
||||||
|
Data: data,
|
||||||
|
}
|
||||||
|
ko, err := yaml.Marshal(obj)
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("yaml marshal failed for kubernetes object: %s: %v", name, err)
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
log.Printf("Calling with: %s", string(ko))
|
||||||
|
o, err := scp.k.Create(string(ko))
|
||||||
|
log.Printf("Create returned: %s", o)
|
||||||
|
return err
|
||||||
|
}
|
||||||
@ -0,0 +1,41 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2015 The Kubernetes Authors All rights reserved.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package util
|
||||||
|
|
||||||
|
// KubernetesConfiguration defines the configuration options for talking to Kubernetes master
|
||||||
|
type KubernetesConfig struct {
|
||||||
|
KubePath string // The path to kubectl binary
|
||||||
|
KubeService string // DNS name of the kubernetes service
|
||||||
|
KubeServer string // The IP address and optional port of the kubernetes master
|
||||||
|
KubeInsecure bool // Do not check the server's certificate for validity
|
||||||
|
KubeConfig string // Path to a kubeconfig file
|
||||||
|
KubeCertAuth string // Path to a file for the certificate authority
|
||||||
|
KubeClientCert string // Path to a client certificate file
|
||||||
|
KubeClientKey string // Path to a client key file
|
||||||
|
KubeToken string // A service account token
|
||||||
|
KubeUsername string // The username to use for basic auth
|
||||||
|
KubePassword string // The password to use for basic auth
|
||||||
|
}
|
||||||
|
|
||||||
|
// Kubernetes defines the interface for talking to Kubernetes. Currently the
|
||||||
|
// only implementation is through kubectl, but eventually this could be done
|
||||||
|
// via direct API calls.
|
||||||
|
type Kubernetes interface {
|
||||||
|
Get(name string, resourceType string) (string, error)
|
||||||
|
Create(resource string) (string, error)
|
||||||
|
Delete(name string, resourceType string) (string, error)
|
||||||
|
}
|
||||||
@ -0,0 +1,135 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2015 The Kubernetes Authors All rights reserved.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package util
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"fmt"
|
||||||
|
"log"
|
||||||
|
"net"
|
||||||
|
"os"
|
||||||
|
"os/exec"
|
||||||
|
)
|
||||||
|
|
||||||
|
// KubernetesKubectl implements the interface for talking to Kubernetes by wrapping calls
|
||||||
|
// via kubectl.
|
||||||
|
type KubernetesKubectl struct {
|
||||||
|
KubePath string
|
||||||
|
// Base level arguments to kubectl. User commands/arguments get appended to this.
|
||||||
|
Arguments []string
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewKubernetesKubectl(config *KubernetesConfig) Kubernetes {
|
||||||
|
if config.KubePath == "" {
|
||||||
|
log.Fatalf("kubectl path cannot be empty")
|
||||||
|
}
|
||||||
|
// If a configuration file is specified, then it will provide the server
|
||||||
|
// address and credentials. If not, then we check for the server address
|
||||||
|
// and credentials as individual flags.
|
||||||
|
var args []string
|
||||||
|
if config.KubeConfig != "" {
|
||||||
|
config.KubeConfig = os.ExpandEnv(config.KubeConfig)
|
||||||
|
args = append(args, fmt.Sprintf("--kubeconfig=%s", config.KubeConfig))
|
||||||
|
} else {
|
||||||
|
if config.KubeServer != "" {
|
||||||
|
args = append(args, fmt.Sprintf("--server=https://%s", config.KubeServer))
|
||||||
|
} else if config.KubeService != "" {
|
||||||
|
addrs, err := net.LookupHost(config.KubeService)
|
||||||
|
if err != nil || len(addrs) < 1 {
|
||||||
|
log.Fatalf("cannot resolve DNS name: %v", config.KubeService)
|
||||||
|
}
|
||||||
|
|
||||||
|
args = append(args, fmt.Sprintf("--server=https://%s", addrs[0]))
|
||||||
|
}
|
||||||
|
|
||||||
|
if config.KubeInsecure {
|
||||||
|
args = append(args, fmt.Sprintf("--insecure-skip-tls-verify=%s", config.KubeInsecure))
|
||||||
|
} else {
|
||||||
|
if config.KubeCertAuth != "" {
|
||||||
|
args = append(args, fmt.Sprintf("--certificate-authority=%s", config.KubeCertAuth))
|
||||||
|
if config.KubeClientCert == "" {
|
||||||
|
args = append(args, fmt.Sprintf("--client-certificate=%s", config.KubeClientCert))
|
||||||
|
}
|
||||||
|
|
||||||
|
if config.KubeClientKey == "" {
|
||||||
|
args = append(args, fmt.Sprintf("--client-key=%s", config.KubeClientKey))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if config.KubeToken != "" {
|
||||||
|
args = append(args, fmt.Sprintf("--token=%s", config.KubeToken))
|
||||||
|
} else {
|
||||||
|
if config.KubeUsername != "" {
|
||||||
|
args = append(args, fmt.Sprintf("--username=%s", config.KubeUsername))
|
||||||
|
}
|
||||||
|
|
||||||
|
if config.KubePassword != "" {
|
||||||
|
args = append(args, fmt.Sprintf("--password=%s", config.KubePassword))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return &KubernetesKubectl{config.KubePath, args}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (k *KubernetesKubectl) Get(name string, resourceType string) (string, error) {
|
||||||
|
// Specify output as json rather than human readable for easier machine parsing
|
||||||
|
args := []string{"get",
|
||||||
|
"-o",
|
||||||
|
"json",
|
||||||
|
resourceType,
|
||||||
|
name}
|
||||||
|
return k.execute(args, "")
|
||||||
|
}
|
||||||
|
|
||||||
|
func (k *KubernetesKubectl) Create(resource string) (string, error) {
|
||||||
|
args := []string{"create"}
|
||||||
|
return k.execute(args, resource)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (k *KubernetesKubectl) Delete(name string, resourceType string) (string, error) {
|
||||||
|
args := []string{"delete",
|
||||||
|
resourceType,
|
||||||
|
name}
|
||||||
|
return k.execute(args, "")
|
||||||
|
}
|
||||||
|
|
||||||
|
func (k *KubernetesKubectl) execute(args []string, input string) (string, error) {
|
||||||
|
if len(input) > 0 {
|
||||||
|
args = append(args, "-f", "-")
|
||||||
|
}
|
||||||
|
|
||||||
|
// Tack on the common arguments to the end of the command line
|
||||||
|
args = append(args, k.Arguments...)
|
||||||
|
cmd := exec.Command(k.KubePath, args...)
|
||||||
|
cmd.Stdin = bytes.NewBuffer([]byte(input))
|
||||||
|
|
||||||
|
// Combine stdout and stderr into a single dynamically resized buffer
|
||||||
|
combined := &bytes.Buffer{}
|
||||||
|
cmd.Stdout = combined
|
||||||
|
cmd.Stderr = combined
|
||||||
|
|
||||||
|
if err := cmd.Start(); err != nil {
|
||||||
|
log.Printf("cannot start kubectl %#v", err)
|
||||||
|
return combined.String(), err
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := cmd.Wait(); err != nil {
|
||||||
|
log.Printf("kubectl failed: %#v", err)
|
||||||
|
return combined.String(), err
|
||||||
|
}
|
||||||
|
return combined.String(), nil
|
||||||
|
}
|
||||||
Loading…
Reference in new issue