1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
package clusterkcp
import (
"cmp"
"context"
"fmt"
"time"
"k8s.io/client-go/tools/clientcmd"
"github.com/johnandersen777/socialweb-computer-kcp/internal/clusterprovider"
"github.com/johnandersen777/socialweb-computer-kcp/internal/clusterstack"
"github.com/johnandersen777/socialweb-computer-kcp/internal/controllers/runtime/kube"
"github.com/johnandersen777/socialweb-computer-kcp/internal/eso"
"github.com/johnandersen777/socialweb-computer-kcp/internal/kcpserver"
)
const externalSecretsKubeconfigContext = "socialweb-external-secrets"
func ExternalSecrets(binary, bundle, legacyNamespace string) *clusterprovider.ExternalSecrets {
return &clusterprovider.ExternalSecrets{
Binary: binary,
Bundle: bundle,
LegacyNamespace: legacyNamespace,
WebhookCAName: eso.WebhookCAName,
Install: InstallExternalSecrets,
}
}
func InstallExternalSecrets(ctx context.Context, o clusterprovider.ExternalSecretsInstall) error {
legacy := cmp.Or(o.LegacyNamespace, eso.DefaultControllerNamespace)
minted, err := clusterprovider.MintTenantCredentialForClusterAs(ctx, o.StateDir, o.Cluster, o.APIServer,
eso.ControllerUser, []string{eso.ControllerGroup}, clusterprovider.DefaultCredentialValidity)
if err != nil {
return fmt.Errorf("clusterprovider: minting the credential the External Secrets "+
"controller of %s authenticates with: %w", o.Cluster, err)
}
if err := WriteKubeconfig(clusterstack.ExternalSecretsKubeconfig(o.DataDir), minted,
externalSecretsKubeconfigContext, clusterprovider.ErrExternalSecretsKubeconfigUnwritable); err != nil {
return err
}
caPEM, err := eso.EnsureWebhookTLS(eso.WebhookTLSPaths{
CertDir: clusterstack.ExternalSecretsCertDir(o.DataDir),
CAKey: clusterstack.ExternalSecretsCAKey(o.DataDir),
}, time.Now())
if err != nil {
return err
}
kc, err := adminFromDataDir(o.StateDir, o.Cluster, o.APIServer)
if err != nil {
return fmt.Errorf("clusterprovider: the admin client that installs the External "+
"Secrets CRDs into %s: %w", o.Cluster, err)
}
if err := eso.InstallBeside(ctx, kc, eso.BesideOptions{
BundlePath: o.Bundle,
LegacyNamespace: legacy,
WebhookURL: clusterprovider.ExternalSecretsWebhookURL(o.WebhookPort),
WebhookCAPEM: caPEM,
FieldManager: clusterprovider.AddOnFieldManager,
}); err != nil {
return fmt.Errorf("clusterprovider: installing the tenant half of the External "+
"Secrets controller of %s: %w", o.Cluster, err)
}
return nil
}
func adminFromDataDir(stateDir, cluster, apiserver string) (*kube.Client, error) {
dataDir, err := clusterprovider.ClusterDataDir(stateDir, cluster)
if err != nil {
return nil, err
}
cfg, err := clientcmd.BuildConfigFromFlags("", clusterstack.AdminKubeconfig(dataDir))
if err != nil {
return nil, fmt.Errorf("clusterprovider: the cluster's own admin credential: %w", err)
}
if apiserver != "" {
cfg.Host = apiserver
}
return kube.New(kcpserver.Throughput(cfg))
}
