mirror of
https://github.com/optim-enterprises-bv/kubernetes.git
synced 2025-11-02 03:08:15 +00:00
30f9893374
The current dryrun client implemnetation is suboptimal and sparse. It has the following problems: - When an object CREATE or UPDATE reaches the default dryrun client the operation is a NO-OP, which means subsequent GET calls must fully emulate the object that exists in the store. - There are multiple implmentations of a DryRunGetter interface such the one in init_dryrun.go but there are no implementations for reset, upgrade, join. - There is a specific DryRunGetter that is backed by a real client in clientbacked_dryrun.go, but this is used for upgrade and does not work in conjuction with a fake client. This commit does the following changes: - Removes all existing *dryrun*.go implementations. - Add a new DryRun implementation in dryrun.go that implements 3 clients - fake clientset, real clientset, real dynamic client. - The DryRun object uses the method chaining pattern. - Allows the user opt-in into real clients only if needed, by passing a real kubeconfig. By default only constructs a fake client. - The default reactor chain for the fake client, always logs the object action, then for GET or LIST actions attempts to use the real dynamic client to get the object. If a real object does not exist it attempts to get the object from the fake object store. - The user can prepend or append reactors to the chain. - All known needed reactors for operations during init, join, reset, upgrade are added as methods of the DryRun struct. - Adds detailed unit test for the DryRun struct and its methods including reactors. Additional changes: - Use the new DryRun implementation in all command workflows - init, join, reset, upgrade. - Ensure that --dry-run works even if there is no active cluster by returning faked objects. For join, a faked cluster-info with a fake bootstrap token and CA are used.
96 lines
4.0 KiB
Go
96 lines
4.0 KiB
Go
/*
|
|
Copyright 2016 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package discovery
|
|
|
|
import (
|
|
"net/url"
|
|
|
|
"github.com/pkg/errors"
|
|
|
|
clientset "k8s.io/client-go/kubernetes"
|
|
clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
|
|
"k8s.io/klog/v2"
|
|
|
|
kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
|
|
kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
|
|
"k8s.io/kubernetes/cmd/kubeadm/app/discovery/file"
|
|
"k8s.io/kubernetes/cmd/kubeadm/app/discovery/https"
|
|
"k8s.io/kubernetes/cmd/kubeadm/app/discovery/token"
|
|
kubeconfigutil "k8s.io/kubernetes/cmd/kubeadm/app/util/kubeconfig"
|
|
)
|
|
|
|
// TokenUser defines token user
|
|
const TokenUser = "tls-bootstrap-token-user"
|
|
|
|
// For returns a kubeconfig object that can be used for doing the TLS Bootstrap with the right credentials
|
|
// Also, before returning anything, it makes sure it can trust the API Server
|
|
func For(client clientset.Interface, cfg *kubeadmapi.JoinConfiguration) (*clientcmdapi.Config, error) {
|
|
// TODO: Print summary info about the CA certificate, along with the checksum signature
|
|
// we also need an ability for the user to configure the client to validate received CA cert against a checksum
|
|
config, err := DiscoverValidatedKubeConfig(client, cfg)
|
|
if err != nil {
|
|
return nil, errors.Wrap(err, "couldn't validate the identity of the API Server")
|
|
}
|
|
|
|
// If the users has provided a TLSBootstrapToken use it for the join process.
|
|
// This is usually the case of Token discovery, but it can also be used with a discovery file
|
|
// without embedded authentication credentials.
|
|
if len(cfg.Discovery.TLSBootstrapToken) != 0 {
|
|
klog.V(1).Info("[discovery] Using provided TLSBootstrapToken as authentication credentials for the join process")
|
|
|
|
_, clusterinfo := kubeconfigutil.GetClusterFromKubeConfig(config)
|
|
return kubeconfigutil.CreateWithToken(
|
|
clusterinfo.Server,
|
|
kubeadmapiv1.DefaultClusterName,
|
|
TokenUser,
|
|
clusterinfo.CertificateAuthorityData,
|
|
cfg.Discovery.TLSBootstrapToken,
|
|
), nil
|
|
}
|
|
|
|
// if the config returned from discovery has authentication credentials, proceed with the TLS bootstrap process
|
|
if kubeconfigutil.HasAuthenticationCredentials(config) {
|
|
return config, nil
|
|
}
|
|
|
|
// if there are no authentication credentials (nor in the config returned from discovery, nor in the TLSBootstrapToken), fail
|
|
return nil, errors.New("couldn't find authentication credentials for the TLS bootstrap process. Please use Token discovery, a discovery file with embedded authentication credentials or a discovery file without authentication credentials but with the TLSBootstrapToken flag")
|
|
}
|
|
|
|
// DiscoverValidatedKubeConfig returns a validated Config object that specifies where the cluster is and the CA cert to trust
|
|
func DiscoverValidatedKubeConfig(dryRunClient clientset.Interface, cfg *kubeadmapi.JoinConfiguration) (*clientcmdapi.Config, error) {
|
|
timeout := cfg.Timeouts.Discovery.Duration
|
|
switch {
|
|
case cfg.Discovery.File != nil:
|
|
kubeConfigPath := cfg.Discovery.File.KubeConfigPath
|
|
if isHTTPSURL(kubeConfigPath) {
|
|
return https.RetrieveValidatedConfigInfo(kubeConfigPath, timeout)
|
|
}
|
|
return file.RetrieveValidatedConfigInfo(kubeConfigPath, timeout)
|
|
case cfg.Discovery.BootstrapToken != nil:
|
|
return token.RetrieveValidatedConfigInfo(dryRunClient, &cfg.Discovery, timeout)
|
|
default:
|
|
return nil, errors.New("couldn't find a valid discovery configuration")
|
|
}
|
|
}
|
|
|
|
// isHTTPSURL checks whether the string is parsable as a URL and whether the Scheme is https
|
|
func isHTTPSURL(s string) bool {
|
|
u, err := url.Parse(s)
|
|
return err == nil && u.Scheme == "https"
|
|
}
|