|
5 | 5 | "fmt" |
6 | 6 | "time" |
7 | 7 |
|
| 8 | + "sigs.k8s.io/yaml" |
| 9 | + |
8 | 10 | authenticationv1 "k8s.io/api/authentication/v1" |
9 | 11 | corev1 "k8s.io/api/core/v1" |
10 | 12 | rbacv1 "k8s.io/api/rbac/v1" |
@@ -341,3 +343,138 @@ func ComputeTokenRenewalTimeWithRatio(creationTime, expirationTime time.Time, ra |
341 | 343 | renewalAt := creationTime.Add(renewalAfter) |
342 | 344 | return renewalAt |
343 | 345 | } |
| 346 | + |
| 347 | +// oidcTrustConfig represents the configuration for an OIDC trust relationship. |
| 348 | +// It includes the host of the Kubernetes API server, CA data for TLS verification, |
| 349 | +// and the audience for the OIDC tokens. |
| 350 | +type oidcTrustConfig struct { |
| 351 | + // Host is the URL of the Kubernetes API server. |
| 352 | + Host string `json:"host,omitempty"` |
| 353 | + // CAData is the base64-encoded CA certificate data used to verify the server's TLS certificate. |
| 354 | + CAData []byte `json:"caData,omitempty"` |
| 355 | +} |
| 356 | + |
| 357 | +// WriteOIDCConfigFromRESTConfig converts a RESTConfig to an OIDC trust configuration format. |
| 358 | +// When creating a Kubernetes deployment, this configuration is used to set up the trust relationship to |
| 359 | +// the target cluster. |
| 360 | +// Example: |
| 361 | +// |
| 362 | +// spec: |
| 363 | +// |
| 364 | +// template: |
| 365 | +// spec: |
| 366 | +// volumes: |
| 367 | +// - name: oidc-trust-config |
| 368 | +// projected: |
| 369 | +// sources: |
| 370 | +// - secret: |
| 371 | +// name: oidc-trust-config |
| 372 | +// items: |
| 373 | +// - key: host |
| 374 | +// path: cluster/host |
| 375 | +// - key: caData |
| 376 | +// path: cluster/ca.crt |
| 377 | +// - serviceAccountToken: |
| 378 | +// audience: target-cluster |
| 379 | +// path: cluster/token |
| 380 | +// expirationSeconds: 3600 |
| 381 | +// |
| 382 | +// volumeMounts: |
| 383 | +// - name: oidc-trust-config |
| 384 | +// mountPath: /var/run/secrets/oidc-trust-config |
| 385 | +// readOnly: true |
| 386 | +func WriteOIDCConfigFromRESTConfig(restConfig *rest.Config) ([]byte, error) { |
| 387 | + oidcConfig := &oidcTrustConfig{ |
| 388 | + Host: restConfig.Host, |
| 389 | + CAData: restConfig.CAData, |
| 390 | + } |
| 391 | + |
| 392 | + configMarshaled, err := yaml.Marshal(oidcConfig) |
| 393 | + if err != nil { |
| 394 | + return nil, fmt.Errorf("failed to write OIDC trust config: %w", err) |
| 395 | + } |
| 396 | + |
| 397 | + return configMarshaled, nil |
| 398 | +} |
| 399 | + |
| 400 | +// WriteKubeconfigFromRESTConfig converts the RESTConfig to a kubeconfig format. |
| 401 | +// Supported authentication methods are Bearer Token, Username/Password and Client Certificate. |
| 402 | +func WriteKubeconfigFromRESTConfig(restConfig *rest.Config) ([]byte, error) { |
| 403 | + var authInfo *clientcmdapi.AuthInfo |
| 404 | + |
| 405 | + id := "cluster" |
| 406 | + |
| 407 | + type authType string |
| 408 | + const ( |
| 409 | + authTypeBearerToken authType = "BearerToken" |
| 410 | + authTypeBasicAuth authType = "BasicAuth" |
| 411 | + authTypeClientCert authType = "ClientCert" |
| 412 | + ) |
| 413 | + availableAuthTypes := make(map[authType]interface{}) |
| 414 | + if restConfig.BearerToken != "" { |
| 415 | + availableAuthTypes[authTypeBearerToken] = nil |
| 416 | + } |
| 417 | + |
| 418 | + if restConfig.Username != "" && restConfig.Password != "" { |
| 419 | + availableAuthTypes[authTypeBasicAuth] = nil |
| 420 | + } |
| 421 | + |
| 422 | + if restConfig.CertData != nil && restConfig.KeyData != nil { |
| 423 | + availableAuthTypes[authTypeClientCert] = nil |
| 424 | + } |
| 425 | + |
| 426 | + if len(availableAuthTypes) == 0 { |
| 427 | + return nil, fmt.Errorf("cannot write to kubeconfig when RESTConfig does not contain any supported authentication information") |
| 428 | + } |
| 429 | + |
| 430 | + if _, ok := availableAuthTypes[authTypeBearerToken]; ok { |
| 431 | + authInfo = &clientcmdapi.AuthInfo{ |
| 432 | + Token: restConfig.BearerToken, |
| 433 | + } |
| 434 | + } |
| 435 | + |
| 436 | + if _, ok := availableAuthTypes[authTypeBasicAuth]; ok { |
| 437 | + authInfo = &clientcmdapi.AuthInfo{ |
| 438 | + Username: restConfig.Username, |
| 439 | + Password: restConfig.Password, |
| 440 | + } |
| 441 | + } |
| 442 | + |
| 443 | + if _, ok := availableAuthTypes[authTypeClientCert]; ok { |
| 444 | + authInfo = &clientcmdapi.AuthInfo{ |
| 445 | + ClientCertificateData: restConfig.CertData, |
| 446 | + ClientKeyData: restConfig.KeyData, |
| 447 | + } |
| 448 | + } |
| 449 | + |
| 450 | + server := restConfig.Host |
| 451 | + if restConfig.APIPath != "" { |
| 452 | + server = fmt.Sprint(server, "/", restConfig.APIPath) |
| 453 | + } |
| 454 | + |
| 455 | + kubeConfig := clientcmdapi.Config{ |
| 456 | + CurrentContext: id, |
| 457 | + Contexts: map[string]*clientcmdapi.Context{ |
| 458 | + id: { |
| 459 | + AuthInfo: id, |
| 460 | + Cluster: id, |
| 461 | + }, |
| 462 | + }, |
| 463 | + Clusters: map[string]*clientcmdapi.Cluster{ |
| 464 | + id: { |
| 465 | + Server: server, |
| 466 | + CertificateAuthorityData: restConfig.CAData, |
| 467 | + }, |
| 468 | + }, |
| 469 | + AuthInfos: map[string]*clientcmdapi.AuthInfo{ |
| 470 | + id: authInfo, |
| 471 | + }, |
| 472 | + } |
| 473 | + |
| 474 | + configMarshaled, err := clientcmd.Write(kubeConfig) |
| 475 | + if err != nil { |
| 476 | + return nil, fmt.Errorf("failed to write RESTConfig to kubeconfig: %w", err) |
| 477 | + } |
| 478 | + |
| 479 | + return configMarshaled, nil |
| 480 | +} |
0 commit comments