feat: functionality to write Kubeconfig file in CI workflows (#53)

Author: felix-seifert

kubernetes/Makefile

@@ -1,6 +1,9 @@
 KUBECTL ?= kubectl
 K8S_RESOURCES_DIR := .
 
+KUBECONFIG_TEMPLATE ?= ./sa-kubeconfig.yaml.template
+NEW_KUBECONFIG_FILE ?= ../sa-kubeconfig.yaml
+
 # Arg DIR is used to define applying resources only for specific app/subdir
 ifdef DIR
   TARGET_DIR := $(K8S_RESOURCES_DIR)/$(DIR)
@@ -24,7 +27,7 @@ define generate_skip_dirs_through_prune
 	$(foreach dir,$(SPACE_SEPARATED_SKIP_DIRS),-path $(TARGET_DIR)/$(dir) -o) -false
 endef
 
-.PHONY: apply-namespaces apply-all apply update-image print-decoded-token help
+.PHONY: apply-namespaces apply-all apply update-image print-decoded-token print-ca-cert print-api-url help
 
 .DEFAULT_GOAL := help
 
@@ -75,11 +78,11 @@ print-decoded-token: ## Print base64 decoded token of secret which is passed as
 		exit 1; \
 	fi
 	@NAME=$(SECRET_NAME) ; \
-	NAMESPACE=$$(kubectl get secrets --all-namespaces --output jsonpath='{range .items[?(@.metadata.name=="'"$$NAME"'")]}{.metadata.namespace}{"\n"}{end}') ; \
+	NAMESPACE=$$($(KUBECTL) get secrets --all-namespaces --output jsonpath='{range .items[?(@.metadata.name=="'"$$NAME"'")]}{.metadata.namespace}{"\n"}{end}') ; \
 	if [ -z "$$NAMESPACE" ]; then \
 		echo "Secret $$NAME not found in any namespace." >&2 ; exit 1 ; \
 	fi ; \
-	TOKEN=$$(kubectl get secret $$NAME -n $$NAMESPACE -o jsonpath='{.data.token}' | base64 --decode) ; \
+	TOKEN=$$($(KUBECTL) get secret $$NAME -n $$NAMESPACE -o jsonpath='{.data.token}' | base64 --decode) ; \
 	if [ -z "$$TOKEN" ]; then \
 		echo "Token not found in secret $$NAME in namespace $$NAMESPACE." >&2 ; exit 1 ; \
 	fi ; \
@@ -91,11 +94,11 @@ print-ca-cert: ## Print base64 encoded CA cert data of secret which is passed as
 		exit 1; \
     fi
 	@NAME=$(SECRET_NAME) ; \
-	NAMESPACE=$$(kubectl get secrets --all-namespaces --output jsonpath='{range .items[?(@.metadata.name=="'"$$NAME"'")]}{.metadata.namespace}{"\n"}{end}') ; \
+	NAMESPACE=$$($(KUBECTL) get secrets --all-namespaces --output jsonpath='{range .items[?(@.metadata.name=="'"$$NAME"'")]}{.metadata.namespace}{"\n"}{end}') ; \
 	if [ -z "$$NAMESPACE" ]; then \
 		echo "Secret $$NAME not found in any namespace." >&2 ; exit 1 ; \
 	fi ; \
-	CA_CERT_DATA=$$(kubectl get secret $$NAME -n $$NAMESPACE -o jsonpath='{.data.ca\.crt}') ; \
+	CA_CERT_DATA=$$($(KUBECTL) get secret $$NAME -n $$NAMESPACE -o jsonpath='{.data.ca\.crt}') ; \
 	if [ -z "$$CA_CERT_DATA" ]; then \
 		echo "Token not found in secret $$NAME in namespace $$NAMESPACE." >&2 ; exit 1 ; \
 	fi ; \
@@ -104,5 +107,17 @@ print-ca-cert: ## Print base64 encoded CA cert data of secret which is passed as
 print-api-url: ## Print URL of Kubernetes API server from `kubectl config view`
 	@echo $$($(KUBECTL) config view --minify -o jsonpath='{.clusters[0].cluster.server}')
 
+write-kubeconfig: ## Write a Kubeconfig file at location NEW_KUBECONFIG_FILE, needs args TOKEN, CA_CERT and API_URL
+	@if [ -z "$(TOKEN)" ] || [ -z "$(CA_CERT)" ] || [ -z "$(API_URL)" ]; then \
+		echo "Usage: make write-kubeconfig TOKEN=... CA_CERT=... API_URL=..."; \
+		exit 1; \
+	fi; \
+	sed \
+	  -e 's|{{TOKEN}}|$(TOKEN)|g' \
+	  -e 's|{{CA_CERT}}|$(CA_CERT)|g' \
+	  -e 's|{{API_SERVER}}|$(API_URL)|g' \
+	  $(KUBECONFIG_TEMPLATE) > $(NEW_KUBECONFIG_FILE); \
+	echo "Wrote $(NEW_KUBECONFIG_FILE)"
+
 help: ## Show this help
 	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z0-9._-]+:.*?## / {printf "\033[1m\033[36m%-24s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)

kubernetes/sa-kubeconfig.yaml.template

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Config
+clusters:
+  - name: gohfert-cluster
+    cluster:
+      server: {{API_SERVER}}
+      certificate-authority-data: {{CA_CERT}}
+users:
+  - name: service-account
+    user:
+      token: {{TOKEN}}
+contexts:
+  - name: sa-context
+    context:
+      cluster: gohfert-cluster
+      user: service-account
+      namespace: default
+current-context: sa-context
+
+# EOF